Network Attacks
Objective 4.2: Summarize various types of attacks and their impact to the network
● Dos and DDos Attacks
○ Denial of Service (DoS) Attack
■ Occurs when one machine overwhelms a victim system with continuous
service requests
■ Leads to resource exhaustion, causing the victim system to crash
■ TCP SYN Flood
● Involves initiating multiple TCP sessions without completing them
● TCP Handshake – in a normal scenario, involves SYN, SYN/ACK,
and ACK packets
● Attack Process – attacker sends SYN packets, victim reserves
resources, but attacker ignores subsequent SYN/ACK packets,
leading to half-open connections and resource exhaustion
● Attacker often spoofs source IP during the three-way handshake
to flood the server
■ SMURF Attack (ICMP Flood)
● Utilizes ICMP traffic instead of TCP traffic
242
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Attacker sends ping to subnet broadcast address with a spoofed
source IP, causing all devices on the subnet to respond to the
victim server
● Attack can be intensified by sending multiple requests to different
subnets, leading to resource exhaustion
○ Distributed Denial of Service (DDoS) Attack
■ Involves multiple machines simultaneously overwhelming a single server
■ Botnet
● Collection of compromised computers under the control of a
Command and Control (C2) server
■ Zombie
● Individually compromised computers within a botnet
■ C2 server controls all zombies, allowing coordinated attacks
○ Preventing DDoS Attacks
■ Cloud Challenge – cloud-based resources can horizontally scale to handle
increased demand
■ Cost Consideration – despite scaling, organizations may face substantial
costs for illegitimate traffic during DDoS attacks
■ Prevention Importance – emphasizes the need to implement preventive
measures to avoid financial and operational consequences
243
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● MAC Flooding
○ MAC Flooding
■ A network attack technique aimed at compromising a switch's security by
overflowing its MAC table
○ Normal Switch Operation
■ Utilizes MAC tables to associate MAC addresses with switchports for
efficient data forwarding
○ Attack Implications
■ Data Snooping
● Attackers are enabled to capture sensitive data by forcing the
switch into hub mode
■ Disruption of Services
● Network performance is degraded and may lead to
Denial-of-Service attacks
■ Bypassing Security Measures
● MAC flooding allows attackers to circumvent MAC address filtering
and gain unauthorized network access
○ Execution of MAC Flooding
■ Attackers use specialized tools to flood the switch with random MAC
addresses, forcing it into fail-safe mode
○ Detection and Prevention
■ Implement anomaly-based intrusion detection systems (IDS)
244
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Employ network monitoring tools
■ Configure port security
■ Set MAC address limits per switchport
■ Use VLANs to segregate network traffic and limit the impact of MAC
flooding attacks
● Address Resolution Protocol (ARP) Attacks
○ Address Resolution Protocol (ARP)
■ Used to map IP addresses to MAC addresses on a local area network
○ ARP Spoofing
■ Occurs when an attacker sends falsified ARP messages, linking their MAC
address with a legitimate IP
■ Goals are to intercept, modify, or stop data-in-transit, and initiate on-path
attacks
○ ARP Poisoning
■ Corrupts ARP cache by associating attacker's MAC with IP addresses of
LAN devices
■ Enables alteration of network traffic flow, interception, session hijacking,
or DoS attacks
○ Difference between ARP Spoofing and ARP Poisoning
■ ARP Spoofing – Targets single host's traffic
■ ARP Poisoning – Affects all hosts in a LAN
245
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Motivations for ARP Attacks
■ Data Interception
■ On-Path Attack
■ Network Disruptions
○ Techniques for ARP Attacks
■ Scanning network for IP-MAC pairs and sending fake ARP responses
■ Conducting ARP poisoning via ARP flood
○ Detection and Prevention
■ Use ARP monitoring tools to detect unusual ARP traffic patterns
■ Alert network administrators
■ Configure intrusion detection systems to identify ARP spoofing or
poisoning activities
■ Implement preventive measures
● Static ARP entries
● Dynamic ARP inspection
● Network segmentation
● VPNs or encryption technologies
● VLAN Hopping
○ Virtual Local Area Network(VLAN)
■ Segregates broadcast domains at Layer 2 of the OSI model, enhancing
network security
246
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Commonly utilized in intranets and local area networks to partition and
secure network segments
○ VLAN Hopping
■ Exploits misconfigurations to gain unauthorized access to different VLAN
■ Double Tagging
● Attacker exploits trunk port vulnerabilities to direct traffic to
another VLAN
○ Inner tag
■ Contains the true destination
○ Outer tag
■ Denotes the native VLAN
○ Purpose of VLAN Hopping
■ Blind attacks
● Commands are sent to the victim, but the
attacker or pen tester does not get to see
any of the responses
■ Denial of Service (DoS) or Stress Testing
● Does not always require response data,
facilitating various attack scenarios
○ Prevention Measures
■ Change the default configuration of the native
VLAN from VLAN ID 1 to another identifier
247
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Avoid adding user devices to the native VLAN
■ Switch Spoofing
● Attackers use Dynamic Trunking Protocol (DTP) to negotiate trunk
ports
● Disabling dynamic switch port modes helps prevent switch
spoofing attacks
■ MAC Table Overflow
● Overloading CAM tables can cause switches to act like hubs,
exposing traffic from other VLANs
● Flood the switch's CAM table with MAC addresses to induce this
behavior
○ By grasping these key concepts and preventive measures, you can better
understand and mitigate VLAN hopping vulnerabilities
● Domain Name System (DNS) Attacks
○ Domain Name System (DNS)
■ Fundamental internet component translating domain names to IP
addresses
○ DNS Cache Poisoning
■ Corrupting DNS resolver cache with false information to redirect traffic
248
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Mitigations:
● Utilize Domain Name System Security Extensions (DNSSEC) to add
a digital signature
● Implement secure network configurations and firewalls
○ DNS Amplification Attacks
■ Overwhelm target system with DNS response traffic
■ Limit size of DNS responses or rate limit DNS response traffic for
mitigation
○ DNS Tunneling
■ Involves using the DNS protocol to encapsulate non-DNS traffic (such as
HTTP or SSH, over port 53) to attempt to bypass firewall rules
■ Can be used for command and control or data exfiltration
■ Mitigation involves regularly monitoring of DNS logs to analyze for any
signs of unusual patterns of behavior
○ Domain Hijacking
■ Unauthorized change of domain registration
■ Can lead to redirection to malicious websites
■ Mitigations:
● Conduct regular updates
● Ensure that registration account information is secure
● Use domain registry lock services
249
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ DNS Zone Transfer Attacks
■ Pretend to be authorized system to get entire DNS zone data
■ Expose sensitive network infrastructure information
○ DNS attacks exploit vulnerabilities to disrupt services, steal information, or
redirect traffic
● On-path Attack
○ On-Path Attack
■ An attack where the penetration tester places their workstation between
two hosts to capture, monitor, and relay communications
■ Captures authorization packets, allowing the attacker to take over the
authorized session between client and server
■ Methods of On-Path Attack
● ARP Poisoning
● DNS Poisoning
● Rogue Wireless Access Point
● Rogue Hub/Switch
○ Replay Attack
■ Occurs when an attacker captures valid data and repeats it either
immediately or with a delay
250
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Example
● Capturing authentication handshake to gain access to network
resources
○ Relay Attack
■ An attack where the attacker becomes a proxy between two hosts,
intercepting and potentially modifying communications
■ Example:
● Modifying transaction details in online banking to divert funds
○ Challenges with Encryption
■ SSL/TLS Encryption poses difficulty in intercepting and cracking
communications
■ Techniques to overcome challenges with encryption:
● SSL Stripping
○ Redirecting HTTPS requests to HTTP to capture
unencrypted data
● Downgrade Attack
○ An attack that persuades client or server to adopt lower
security modes
○ Convinces systems to abandon higher security modes in
favor of lower ones
251
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Example:
■ Allowing encryption at lower levels (e.g., SSL 2.0) to
facilitate easier interception
○ Not limited to SSL/TLS
■ Applicable to any encryption or protection
mechanism like WiFi, VPNs, etc.
● Rogue Device and Attacks
○ Rogue Devices
■ Unauthorized devices or services on a network that allows unauthorized
individuals to connect to that network
■ Identified by MAC address and IP address
■ Use digital certificates for authentication and encryption (IPsec, HTTPS) to
authorize devices
○ Rogue System Detection
■ Process of identifying and removing machines on the network that are
not supposed to be there
○ Types of Rogue Systems
■ Network Taps
● Physical device that is attached to cabling to record packets
passing over the network segment
252
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Wireless Access Points (WAPs)
● Devices that can be connected to the network and extend the
physical network into the wireless spectrum
● Types of Rogue Access Points
○ Connected to a network
■ Allows adversaries to convert radio signals into
physical network access
○ Evil Twin
■ Attacker sets up own access point with his own
internet connection, masquerading as legitimate
network
● Scanning airwaves to identify and remove rogue devices is crucial
● Tools like Wi-Fi Pineapple enable easy creation of rogue access
points, posing significant threats to unsuspecting users
■ Servers
● Set up as honeypots to harvest data
■ Wired/Wireless Clients
● Personal devices connected to network
● Bring Your Own Device Policy
○ Personal devices are not considered as rogue devices
unless they are used to do things that are unauthorized
253
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Unauthorized Software
● Installed without permission
■ Virtual Machines
● Created within highly virtualized environments
■ Smart Appliances
● Vulnerabilities in internet-connected devices
○ Detection and Removal
■ Visual Inspection
● Checking ports and switches for rogue devices
■ Network Mapping and Host Discovery
● Use enumeration scanners to identify hosts
■ Wireless Monitoring
● Detect unknown SSIDs within range
■ Packet Sniffing and Traffic Flows
● Identify unauthorized protocols and peer-to-peer communication
■ NAC and Intrusion Detection
● Use automated network scanning for prevention and detection
○ Mitigation
■ Use digital certificates and encryption for authentication
■ Perform regular inventories to detect additional or rogue devices
■ Implement network access control (NAC) and intrusion detection systems
(IDS) for automated scanning and defense
254
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Key Points
■ Rogue devices can compromise network security
■ Detection and removal are crucial for network integrity
● Social Engineering Attacks
○ Social Engineering
■ Any attempt to manipulate users into revealing confidential information
or performing actions detrimental to the user or system security
■ Focus
● Exploiting human vulnerabilities to bypass technical controls
○ Types of Social Engineering Attacks
■ Phishing
● Sending deceptive emails to trick users into revealing sensitive
information
● Example
○ Fake PayPal email requesting account information
● Effectiveness
○ High, even with obvious signs of phishing
● Variants
○ Phishing – most broad type, does not target any particular
person
○ Spear phishing – more targeted form
255
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Whaling – targets key executives
■ Tailgating
● Unauthorized entry into secure areas by following an authorized
person
● Prevention
○ Train employees to shut doors behind them
■ Piggybacking
● Gaining entry to a secure area with an employee's consent
● Example
○ Asking someone to hold the door open with hands full
■ Shoulder Surfing
● Gaining authentication information by direct observation
● Example
○ Watching someone type their password
■ Eavesdropping
● Listening in on conversations to gather sensitive information
● Example
○ Overhearing business discussions to gain insights
■ Dumpster Diving
● Scavenging for personal or confidential information in trash or
recycling
256
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Prevention
○ Shred paperwork before disposal or use locked trash cans
● Understanding Phishing Attacks: Demonstration
● Malware Attacks
○ Malware
■ Short-hand term for malicious software
■ Designed to infiltrate a computer system and possibly damage it without
the user's knowledge or consent
○ Malware Types
■ Virus
● Malicious code that infects a computer when run
■ Worm
● Self-replicating malware that spreads without user interaction
● Exploits security vulnerabilities in OS, protocols, or applications
● Notable Examples
○ Nimda (2001) – infected the entire internet in 22 minutes
○ Conficker (2009) – infected 9-15 million machines, creating
a botnet
■ Trojan Horse
● Malware disguised as legitimate software
257
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Remote Access Trojan (RAT)
○ A common type of Trojan that provides the attacker with
remote control of a victim's system
■ Ransomware
● Malware that restricts access until a ransom is paid
● Encrypts files or changes passwords, demanding payment for
access
● Notable Example
● SamSam (2018) – cost Atlanta over $17 million to fix
■ Spyware
● Malware that gathers information without consent
● Types
○ Adware – for advertising
○ Keylogger – captures keystrokes
■ Rootkit
● Malware that gains administrative control without detection
● Difficult to detect, often requires booting from an external device
○ Prevention and Best Practices
■ Always check files for malware before downloading or installing
■ Keep software up to date to patch vulnerabilities
■ Use reputable antivirus software and firewalls
■ Educate users about safe browsing and downloading practices