Training & Professional Development

Denial-of-Service Attacks

• Prevents systems from processing or responding to legitimate traffic
• Transmits data packets
• Exploits a known fault in an OS, service or application
• Results in system crash or CPU at 100%
• Distributed reflective denial of service DRDoS
• Reflected approach, rather than direct to victim, manipulates traffic so that attack is reflected back to victim from other sources
• Example: DNS Poisoning and SMURF

Skills Refresh

Smurf and Fraggle Attacks

• A smurf attack is another type of flood attack, but it floods the victim with Internet Control Message Protocol (ICMP) echo packets instead of with TCP SYN packets.
• More specifically, it is a spoofed broadcast ping request using the IP address of the victim as the source IP address. Ping uses ICMP to check connectivity with remote systems.
• Normally, ping sends an echo request to a single system, and the system responds with an echo reply. However, in a smurf attack, the attacker sends the echo request out as a broadcast to all systems on the network and spoofs the source IP address. All these systems respond with echo replies to the spoofed IP address, flooding the victim with traffic.

Smurf attacks take advantage of an amplifying network (also called a smurf amplifier) by sending a directed broadcast through a router.

• All systems on the amplifying network then attack the victim.
• However, RFC 2644, released in 1999, changed the standard default for routers so that they do not forward directed broadcast traffic.
• When administrators correctly configure routers in compliance with RFC 2644, a network cannot be an amplifying network.
• This limits smurf attacks to a single network. Additionally, it’s becoming common to disable ICMP on firewalls, routers, and even many servers to prevent any type of attacks using ICMP.
• When standard security practices are used, smurf attacks are rarely a problem today.

Fraggle

• Fraggle attacks are similar to smurf attacks.
• However, instead of using ICMP, a fraggle attack uses UDP packets over UDP ports 7 and 19.
• The fraggle attack will broadcast a UDP packet using the spoofed IP address of the victim.
• All systems on the network will then send traffic to the victim, just as with a smurf attack.

Botnets

• Robots or Zombies, introduced through malware, often browser based
• Allows a herder to send instructions to the computer
  • Gamover Zues GOZ,
  • CrytoLocker ransomware
  • Simda
  • Esthost DNS Changer

Ping of Death – Teardrop and Land Attacks 

• POD
  
  • Oversized packets, changes size of packets to over 64KB
  • Results crash, buffer overflow
  • Rarely successful today
• Teardrop
  
  • Fragments traffic so data can’t be put back together
  • Land Attacks
  • Sends spoofed SYN packets as both source and destination

These and many additional concepts are core to Networking, Cloud, and Cyber Security. 

They are foundational to any of the following top security threat discussions.

SSLv3 is broken

What is SSLv3?  How did it breaK?

Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), both of which are frequently referred to as 'SSL', are cryptographic protocols designed to provide communications security over a computer network.

• security protocol (cryptographic protocol or encryption protocol)
• performs a security-related function and applies cryptographic methods, often as sequences of cryptographic primitives. A protocol describes how the algorithms should be used. A sufficiently detailed protocol includes details about data structures and representations, at which point it can be used to implement multiple, interoperable versions of a program.[1]

Cryptographic protocols are widely used for secure application-level data transport. A cryptographic protocol usually incorporates at least some of these aspects:

• Key agreement or establishment
• Entity authentication
• Symmetric encryption and message authentication material construction
• Secured application-level data transport
• Non-repudiation methods
• Secret sharing methods
• Secure multi-party computation

For example, Transport Layer Security (TLS) is a cryptographic protocol that is used to secure the web (HTTP/HTTPS) connections. It has an entity authentication mechanism, based on the X.509 system; a key setup phase, where symmetric encryption key is formed by employing public-key cryptography; and an application-level data transport function. These three aspects have important interconnections. Standard TLS does not have non-repudiation support.

• There are other types of cryptographic protocols as well, and even the term itself has various readings; Cryptographic application protocols often use one or more underlying key agreement methods, which are also sometimes themselves referred to as "cryptographic protocols". For instance, TLS employs what is known as the Diffie-Hellman key exchange, which although it is only a part of TLS per se, Diffie-Hellman may be seen as a complete cryptographic protocol in itself for other applications.

Oh, Diffie you're so fine, you're so fine you blow my mind, hey Diffie.

(This is Whitfield Diffie and the "women who will talk to him".  Please excuse the Nerds Who Attract joke.  Only I, and 20 thousand other RSA attendees will get it.)

So, what are some of the more well-known exploits that resulted from a lack of security awareness, failed patching, and other generally poor choices in the design of our hastily migrated to cloud applications?