1 00:00:00,330 --> 00:00:03,460 Man, the minute a tax or an item. 2 00:00:03,520 --> 00:00:03,980 OK. 3 00:00:05,370 --> 00:00:12,930 Now, what is meant in the attack now it is a common type of cyber security attack that allows attackers 4 00:00:12,930 --> 00:00:16,320 to eavesdrop on the communication between to target. 5 00:00:16,530 --> 00:00:23,670 The attack takes place in between two legitimately communicating posts, allowing the attacker to listen 6 00:00:23,670 --> 00:00:27,890 to a conversation they should normally not be able to listen to. 7 00:00:28,050 --> 00:00:29,830 Hence the name man in the middle. 8 00:00:30,510 --> 00:00:37,020 As you can see from this graph, we have and we have Bob and I will send a message to Bob now. 9 00:00:37,020 --> 00:00:43,890 We have Eve, which is the eavesdropper, and it will start listening to that message and intercepting 10 00:00:43,890 --> 00:00:44,460 the traffic. 11 00:00:45,370 --> 00:00:52,060 And actually, this is what Eliot did in the scene, when you start intercepting the traffic and he 12 00:00:52,060 --> 00:00:53,330 noticed that our website. 13 00:00:53,710 --> 00:00:59,610 Don't worry, we will talk about this later on, indicates how he managed to do such a thing technically. 14 00:00:59,620 --> 00:00:59,980 I mean. 15 00:01:00,930 --> 00:01:05,940 Now, here you can see that Alice and Bob are having conversation and even want to eavesdrop on the 16 00:01:05,940 --> 00:01:08,520 conversation, but also remain transparent. 17 00:01:09,090 --> 00:01:14,330 Now, Eve could tell that she was booked and that she was Alice. 18 00:01:15,060 --> 00:01:22,170 This would lead us to believe she's speaking to Bob while actually revealing her part of their conversation 19 00:01:22,170 --> 00:01:22,580 to it. 20 00:01:22,710 --> 00:01:27,390 And if I could then gather information from this and have the responses. 21 00:01:28,410 --> 00:01:34,050 The message I wrote to Bob, who thinks he's talking to Alice as a result, if he's able to transparently 22 00:01:34,050 --> 00:01:35,450 hijack their conversation. 23 00:01:35,610 --> 00:01:40,140 So the types of men in the middle attacks, we have the privilege at this point. 24 00:01:40,590 --> 00:01:47,160 So device is equipped with wireless cards, with open try to connect to the access point that is emitting 25 00:01:47,520 --> 00:01:48,660 the strongest signal. 26 00:01:49,200 --> 00:01:54,750 Attackers can set up their own wireless access point and track nearby devices to join. 27 00:01:54,750 --> 00:02:00,270 It's to meet all of the victims network traffic can now be manipulated by the attacker. 28 00:02:00,630 --> 00:02:06,660 This is a dangerous because the attacker doesn't even have to be a trusted network to do this. 29 00:02:06,840 --> 00:02:11,000 The attacker simply needs a close enough physical proximity. 30 00:02:11,040 --> 00:02:12,390 We have to stop spoofing. 31 00:02:13,740 --> 00:02:19,260 Now, Art is the address whose illusion of Brautigan and it is used to resolve the IP addresses to physical 32 00:02:19,260 --> 00:02:23,970 makk or media access control addresses in a local Nettwerk area. 33 00:02:24,240 --> 00:02:31,380 OK, now, when a host needs to talk to us with a given IP address, it references the art cache to 34 00:02:31,380 --> 00:02:32,260 resolve the idea. 35 00:02:32,280 --> 00:02:33,360 This to a Mac address. 36 00:02:33,900 --> 00:02:40,260 If the evidence is not known, a request is made asking for Mac address of the device with the IP address. 37 00:02:40,410 --> 00:02:44,990 Because after all, this is a letter to the detailing player, which is Mac address. 38 00:02:45,390 --> 00:02:51,670 So we need the answer to resolution or to map the IP to Mac and vice versa. 39 00:02:51,960 --> 00:02:54,830 Actually we have something called Reverse R US as well. 40 00:02:55,080 --> 00:02:57,370 Rob, this is to do the bus visit. 41 00:02:57,390 --> 00:02:58,440 Think OK. 42 00:02:59,410 --> 00:03:05,120 No, actually, this is the thing that it used to hijack the traffic technique. 43 00:03:05,470 --> 00:03:10,230 OK, but again, we will talk about this, how he managed to do that. 44 00:03:10,240 --> 00:03:12,970 What are the tools and how to do such a tech? 45 00:03:13,150 --> 00:03:16,850 Don't worry, we will do that and we will build the environment for that. 46 00:03:17,800 --> 00:03:23,080 Now we have and also the dotcom wishing to pose as another host. 47 00:03:23,080 --> 00:03:24,300 Good response to request. 48 00:03:24,580 --> 00:03:28,330 It shouldn't be responding to it with its own Mac address. 49 00:03:28,630 --> 00:03:34,890 So with some precisely placed Becket's, an attacker can sniff the private traffic between two hosts. 50 00:03:35,200 --> 00:03:40,340 Valuable information can be extracted from the traffic, such as the extent of station Tucanes yearning 51 00:03:40,360 --> 00:03:44,800 for access to application accounts that that should not be able to access. 52 00:03:45,490 --> 00:03:50,110 Now we have the DNS spoofing or the multicast DNS. 53 00:03:50,530 --> 00:03:57,390 So the multicast that is similar to DNS, but it is done on local area network Dilan using broadcast 54 00:03:57,400 --> 00:03:57,820 like the. 55 00:03:58,600 --> 00:04:04,000 This makes it the perfect target for spoofing attacks and the local Namba solution system is supposed 56 00:04:04,000 --> 00:04:07,790 to make the configuration of the device extremely simple. 57 00:04:08,260 --> 00:04:13,600 Also, the that do not have to know exactly which addresses their devices should be communicating with 58 00:04:13,930 --> 00:04:14,170 them. 59 00:04:14,470 --> 00:04:16,360 The system preserves it for them. 60 00:04:16,570 --> 00:04:23,290 Devices such as TVs, printers and entertainment systems make use of this protocol since they are typically 61 00:04:23,500 --> 00:04:24,500 on trusted network. 62 00:04:24,670 --> 00:04:31,030 So when an application needs to know the address of a certain device such as TV, the clothing and attacker 63 00:04:31,030 --> 00:04:40,000 can easily respond to that request, with big data instructing it to resort to an address it has control 64 00:04:40,000 --> 00:04:40,360 over. 65 00:04:40,900 --> 00:04:48,190 So since devices keep a local cache of addresses, the victim will now see that device and trusted for 66 00:04:48,190 --> 00:04:49,290 a duration of time. 67 00:04:50,050 --> 00:04:57,210 We have the DNA spoofing similar to the way our IP address to Mac address on the Lamborghini's resolved 68 00:04:57,550 --> 00:04:58,790 domain name to EBE. 69 00:04:58,930 --> 00:05:01,330 OK, I think you are familiar with that. 70 00:05:01,510 --> 00:05:02,780 If you are not, it's OK. 71 00:05:02,830 --> 00:05:05,540 This is the domain name system or server. 72 00:05:05,770 --> 00:05:10,420 This is to map domain names to IP or IP to domain names. 73 00:05:10,780 --> 00:05:17,140 So when using DNA spoofing attack that Dukkha attempts to introduce corrupt DNS cache information to 74 00:05:17,140 --> 00:05:21,520 a host in an attempt to exploit another host using their domain name. 75 00:05:22,040 --> 00:05:28,540 OK, so this leads to victim sending sensitive information to malicious hosts with the belief they are 76 00:05:28,540 --> 00:05:30,370 sending information to a trusted source. 77 00:05:30,520 --> 00:05:36,760 An attacker who has already spoofed an IP address could have a much easier time spoofing Deanna simply 78 00:05:36,760 --> 00:05:43,030 by reserving the IP address, by reserving the address of a DNS server to attack us at this. 79 00:05:44,170 --> 00:05:47,530 So we have men in the middle attack techniques. 80 00:05:48,860 --> 00:05:55,430 The first thing which is the sniffing attackers can use Becket's capture tools to inspect baggage at 81 00:05:55,430 --> 00:05:56,560 a lower level. 82 00:05:57,550 --> 00:06:04,540 Using specific wireless devices that are allowed to be put into monitoring or promiscuous mode can allow 83 00:06:04,540 --> 00:06:11,500 an attacker to see Becket's that are not intended for a see, such as addressed or to other hosts. 84 00:06:12,900 --> 00:06:19,530 Now we have the injection, and Ataka can also leverage their devices, monitoring not to inject malicious 85 00:06:19,530 --> 00:06:20,640 Becket's into data. 86 00:06:20,640 --> 00:06:27,540 Communication streams to markets can blend in with their data communication streams appearing to be 87 00:06:27,540 --> 00:06:28,770 part of the communication. 88 00:06:28,770 --> 00:06:35,640 But many issues in nature and Beckert injection usually involves first sniffing to determine how and 89 00:06:35,640 --> 00:06:36,450 when to craft. 90 00:06:36,450 --> 00:06:44,280 And Becket's we have the session highjacking most web application use and Nojin mechanism that generates 91 00:06:44,400 --> 00:06:51,600 a temporary session talking to us for future requests to avoid requiring the user to type a password 92 00:06:51,720 --> 00:06:58,800 at every page so an attacker can sniff sensitive topic to identify the session, talking for a user 93 00:06:58,800 --> 00:07:05,820 and use it to make a request as the user and the attacker doesn't need to speak once he had a session 94 00:07:05,820 --> 00:07:06,180 talking. 95 00:07:07,150 --> 00:07:15,220 We have the Strabane, since using HDTV is a common safeguard against art or DNA spoofing, attack US, 96 00:07:15,220 --> 00:07:22,780 use SS and strobing to intercept packets and act up their HDTV Espace address requests to go to there 97 00:07:22,780 --> 00:07:27,580 actually to be equivalent point forcing the host to make requests to the server. 98 00:07:27,580 --> 00:07:31,690 Unencrypted sensitive information can be leaked in a plain text. 99 00:07:32,410 --> 00:07:34,590 No how to detect man in the at. 100 00:07:35,880 --> 00:07:41,760 Now, do think many the middle at that can be very difficult without taking the proper steps, if you 101 00:07:41,760 --> 00:07:46,830 are actively searching to determine if your communication have been intercepted, the Middle East, 102 00:07:46,890 --> 00:07:50,460 that can potentially go unnoticed until it is too late. 103 00:07:50,880 --> 00:07:57,630 So checking for proper authentication and implementation, some sort of time detection are typically 104 00:07:57,630 --> 00:08:00,320 the key methods to detect possible attack. 105 00:08:00,660 --> 00:08:03,840 So the timber tomber or timber detection. 106 00:08:04,290 --> 00:08:08,790 But this procedure might require extra forensic analysis after the fact. 107 00:08:09,360 --> 00:08:17,070 OK, so it is important to take precautionary measures to prevent many attacks before they occur rather 108 00:08:17,070 --> 00:08:23,550 than attempting to detect them while they are actively accurate, being aware of browsing practices 109 00:08:23,670 --> 00:08:28,680 and recognizing potentially harmful areas can be essential to maintaining a secure network. 110 00:08:29,070 --> 00:08:32,940 OK, now what is the best practices to prevent many of the major attacks? 111 00:08:33,390 --> 00:08:36,710 The first thing, strong web or web encryption on access point. 112 00:08:37,590 --> 00:08:42,930 So having a strong encryption mechanism on wireless access point prevents unwanted user from joining 113 00:08:42,930 --> 00:08:44,910 your network just by being nearby. 114 00:08:45,910 --> 00:08:53,280 A weak encryption mechanism can allow an attacker to brute force his way into a network and begin management 115 00:08:53,290 --> 00:08:53,800 genetic. 116 00:08:54,910 --> 00:08:58,090 So the stronger the encryption implementation, that's easier for you are. 117 00:08:59,330 --> 00:09:05,570 Another thing which is strong Rolton login credentials, of course, don't you, as admin admin, so 118 00:09:05,570 --> 00:09:11,550 it is essential to make sure your login is checked, not just your wi fi password, but your router 119 00:09:11,570 --> 00:09:15,660 login credentials if an attacker finds your login credentials. 120 00:09:15,950 --> 00:09:22,080 They can change your DNS servers to their malicious servers or even worse, infect your rather with 121 00:09:22,080 --> 00:09:22,950 the malicious software. 122 00:09:23,060 --> 00:09:29,570 We have virtual private network, the VPN, so we can be used to create a secure environment for sensitive 123 00:09:29,570 --> 00:09:31,870 information within a local area network. 124 00:09:32,210 --> 00:09:37,320 So they use a key best encryption to create a subnet for secure communication. 125 00:09:37,490 --> 00:09:44,450 This way, even if an attacker happens to get on a network that is shared, he will not be able to decipher 126 00:09:44,600 --> 00:09:46,880 the traffic in the VPN because it is encrypted. 127 00:09:47,240 --> 00:09:54,750 We can force activities so actually we can be used to securely communicate over activity using public 128 00:09:54,780 --> 00:09:56,090 private key exchange. 129 00:09:56,600 --> 00:09:59,920 This prevents an attacker from having any use of data. 130 00:09:59,930 --> 00:10:02,360 He may be sniffing website. 131 00:10:02,580 --> 00:10:07,100 So you should only use expletives and not provide alternatives. 132 00:10:07,820 --> 00:10:14,150 Users can install browser ins to enforce always using HDTV on requests. 133 00:10:14,510 --> 00:10:20,210 The public Quebecer based authentication, many of them attacks typically involve spoofing something 134 00:10:20,210 --> 00:10:20,740 or another. 135 00:10:20,990 --> 00:10:27,320 So public Kieber based authentication like oracy can be used in various layers of this deck to help 136 00:10:27,320 --> 00:10:32,480 ensure whether the things you are communicating with are actually the things you want to communicate 137 00:10:32,660 --> 00:10:33,980 to be communicating with. 138 00:10:34,340 --> 00:10:35,180 Thanks for watching.