>> Hello. After talking about malware,
let's go ahead and talk about
attacks that either traverse the network
>> or take advantage of network vulnerabilities.
>> The first thing we're going to look at are scans.
Just an average garden variety port scan uses
tools that are out there
that scan to see what ports are open.
We already talked about malware,
and that can include backdoor software that
gets installed and listens on a network port.
Ports provide pathways into your system.
If I were an attacker,
what I'd want to do is scan
and see what open ports you have.
There are also other types of scans, like XMAS scans
that tell an attacker what
operating system a host is running.
Every host or operating system response
to the TCP/IP suite a little differently.
If I send you a different type of packet or segment,
the way your host responds tells me
what operating system your host is running.
An XMAS scan is a TCP segment
>> with every flag set to one.
>> This is out of the ordinary.
Having every flag set to one is not
something you would see in normal communications.
Having every flag set to one is noticeable.
It is said to be lit up like a Christmas tree.
That's how it gets its name.
How your system responds to
such an anomaly would tell
me what operating system you are running.
Another type of attack is
called a man-in-the-middle attack.
It's exactly what it sounds like.
Someone inserts himself in the middle
of a communication path.
There are passive and active man-in-the-middle attacks.
A sniffing in attack is a passive form.
This is an attack where someone is
just watching the communication
with the packet analyzer or network analyzer,
something like Wireshark,
just to see what is traversing the network.
In this type of attack,
the person isn't doing anything
>> or causing any problems,
>> just watching and learning.
A session hijacking attack is
an active form of a man-in-the-middle attack.
This could be a TCP hijack
or some other session-based hijack.
Ultimately, it's going to involve
stealing session ID information,
or maybe they will disconnect
one of the participating hosts
and connect one of their hosts to
impersonate it using their information.
You can also see things like
rogue devices acting as man-in-the-middle attacks.
For example, they could set up
a wireless access point on your network and trick you
into sending your network traffic through
their Wi-Fi access point instead of the normal one.
Banner grabbing isn't necessarily
>> a network-based attack,
>> but sometimes when you have network utilities running,
they may show splash screens, or welcome screens,
>> or just some information
>> that's returned when you issue a command.
>> These tell you a little bit
more than those utility should.
For example, something as basic as NS lookup.
If you type NS lookup at a command prompt,
it will respond and show you who your DNS server is.
This type of attack simply
allows an attacker to get this information.
Now, we'll talk about Smurf attacks
>> and Fraggle attacks.
>> These tend to show up on the exam,
so you wouldn't want to have a good
idea of what these are.
The Smurf attack
as you can see in this diagram,
the attacker sends a packet to the address 1.1.1.255,
that's the broadcast address,
the 1.1.1 network,
goes through the router,
and when anybody sends
a broadcast packet through the router,
that's called a directed broadcast,
and that's no good.
We don't want anybody from the outside to send
anything to the broadcast address inside our network.
This is already something bad.
But if you notice with this attacker is doing,
he's sending an ICMP echo request or a ping.
That's what a Smurf attack uses.
He's sending the ping request across all these devices,
and sometimes those devices are referred to as
being bounced devices or part of the bounce site.
They're acting as zombies or bots.
He's using them against their wells, so to speak.
He pings the broadcast address, and
that ping goes to all the devices on the network,
but what he has done is spoof the source address.
It looks like the traffic is coming from
the victim whose address is 9.9.9.9.
That's not really the true source of the attack,
but he spoofs the source address
so all the devices respond to the victim.
If the attacker does this enough
with enough devices in the bounce site,
he could perform a denial of
service attack against the victim.
To mitigate against this,
you block ICMP or directed broadcasts
>> into your network.
>> That solves the problem of Smurf attacks.
Now, Fraggles work just like Smurfs do.
The exception is at the Fraggle uses
a UDP packet instead of an ICMP packet.
The reason is that ICMP is very frequently
blocked by routers with
access control lists or firewalls.
Very few networks are going to allow
ICMP from the outside into their network,
but UDP as we'll talk about later,
is such a powerful and
necessary protocol that it's really
difficult to block UDP without
losing a lot of desirable services.
UDP is more likely to
slip through an organization's firewall,
but it does the same thing.
It spoofs the source address,
and the UDP packet goes to
the internal devices at the bounce site.
They respond to the victim,
>> knocking the victim offline.
>> That's what Smurfs and Fraggles are.