- In 8.4, we're gonna take a closer look
at digital infrastructure attacks.
Now, the objective
of digital infrastructure attacks is disruption
or manipulation or compromise
of either IT, information technology,
or OT, operational technology systems.
So what's the difference?
Well, IT systems are primarily concerned with managing data
and information assets,
where OT, operational technologies,
focused on the use of hardware and software systems
to monitor and control physical processes generally
in an industrial or factory setting.
So for example,
in a manufacturing plant or a transportation system.
So here are four cyber attacks terms to know,
two of which we've already talked about, two will be new;
targeted, opportunistic amplification and reflection.
In a targeted attack, the attacker chooses a target
for a specific objective.
We've already talked about this one,
generally influenced by the value of the asset
and or the potential outcome.
They don't know what the target's weaknesses are,
they just know they're going after that target.
In an opportunistic attack,
the attacker takes advantage of a vulnerable target.
We talked about this one earlier as well.
This is when the attacker is looking for a weak
or a vulnerable target, and that's who they go after.
In an amplification attack,
the attacker uses an amplification factor
in order to multiply its power.
So for example, the use of botnets,
when we talked about bots and zombies,
botnets are just when we have a lot of bots
that are connected together to launch a DDoS,
a distributed denial of service attack or a spam campaign.
And then in a reflection attack,
the attacker sends a large number of requests to a device
with the victim's IP address as the source address.
So then it bounces back, right, to that victim.
Now, that's often used in conjunction
with an amplification attack.
Targeted, opportunistic, amplification and reflection,
make sure you know these four cyber attack terms.
So let's look at the primary digital attack categories;
spoofing, poisoning, hijacking, and denial of service.
Spoofing is impersonating an address, a system, or a person,
and it enables the attacker to act as a trusted source
and either redirect or manipulate actions.
Poisoning is manipulating the trusted source of data.
So for example, a DNS zone file or a routing table.
And that enables the attacker
to control the trusted source of data
and redirect or manipulate actions.
Hijacking is intercepting communication between two
or more systems, and that enables the attacker
to eavesdrop or to capture or to manipulate,
and or to reuse data packets.
And then a denial of service attack,
is overwhelming system resources,
and that enables the attacker
to make those services unavailable for their intended use.
So those are our four broad categories;
spoofing, poisoning, hijacking, and denial of service.
Now, let's dive into each one of them individually.
So in the spoofing attack, right,
what we're doing here is,
our adversary is impersonating an address, a system,
or a person.
The outcome is enabling the attacker
to act as the trusted source
and or redirect or manipulate actions.
And some examples
of a spoofing attack would be an IP address spoofing,
where using a known trusted IP address
for authentication or response,
or using a fake IP address to disguise the sender,
or a MAC, a media access control address spoofing.
Now, every network interface has a unique address known
as a MAC address or a media access control address,
and that identifies that device on the network.
So MAC address spoofing could be used
to using a known trusted MAC address to get access,
using a known trusted MAC address to circumvent licensing,
or using a fake MAC address to mask the identity
of a device.
Now, a poisoning attack is manipulating
or altering a trusted source of data.
And the outcome is and enables the attacker to control
that trusted source of data, that routing table,
that DNS zone file, the ARP cache,
and from there, redirect or manipulate actions.
So two primary type of attacks you wanna recognize;
an ARP cache poisoning and a DNS cache poisoning.
So the ARP cache address resolution protocol is used to map
or resolve a MAC address, right?
That's the unique address that every network interface has
to an IP address.
So it's used from MAC to IP address resolution
or back from IP to Mac.
So our attacker can use a poisoned ARP cache
to redirect traffic to a malicious host,
or using a poison ARP cache,
actually, just to even stop traffic.
DNS caches are used for domain or host name
to IP resolution.
So DNS cache poisoning,
you know, that set of information,
can be used to divert website traffic to a malicious site,
or to divert website traffic to a non-existent site.
Now, a hijacking attack is intercepting communication,
between two systems,
literally hijacking the communications.
The attacker captures and or controls communication,
between the two systems.
There are two types of attacks I want you to know,
an on-path hijacking and the session hijacking.
Now, on-path hijacking,
is either exploiting the realtime processing
of transactions, conversations, or data transfer.
We used to refer to that as man in the middle.
We're now referring to that as on-path,
or manipulating the browser
to control a session including what's displayed.
And we used to refer to that as man in the browser.
But again, we'll now refer to that
as an on-path hijacking attack.
And then we have session hijacking
which is stealing session cookies
to be able to take over a user's active session.
In the web environment,
we have some specific types of hijacking attacks.
Generally, what our attacker's doing is,
attempting misdirection to a fraudulent website.
So the attacker directs or redirects the victim
to a fraudulent site for malicious purposes.
Now, there are three web hijacking attacks you wanna know,
domain hijacking, URL squatting, and typo squatting.
Now, domain hijacking is the unauthorized modification
of a domain name registration.
So manipulating DNS settings is registering or in some way,
using an internet domain name
that actually belongs to somebody else.
And typo squatting is taking advantage of common typos
to create fraudulent domains.
So Google is G-O-O-G-L-E.
So a typo squat domain might be G-O-O-O-G-L-E,
adding that extra O, taking advantage of those typos,
at which point, right,
we have misdirection to a fraudulent website.
And then we have our denial of service attack.
And the goal of a denial of service attack is
to overwhelm system resources.
Now, at that point,
the resources become unavailable for their intended use.
So two types of attacks to know
for denial of service, a DoS,
which is just a plain denial of service attack
and a DDoS, which stands for distributed denial of service.
In a denial of service attack,
the attackers generally transmitting malformed packets
or unusual requests from point A to point B,
so that point B eventually becomes overwhelmed.
In a distributed denial of service,
there's a massive volume of service requests come
from multiple sources.
A lot of times, those instructions were from bots or zombies
and it often uses the amplification
and the reflection techniques that we talked about earlier.
So make sure that you know these different types of attacks
so you can recognize them if you're given a scenario.
And that my friends, brings us to a three-second challenge.
Five challenge questions, three seconds each,
let's do it.
Manipulating a trusted source of data, what's that called?
One, two, three.
That's gonna be poisoning.
Number two, impersonating an address system or purpose.
One, two, three.
That's gonna be spoofing.
Number three, attack designed to overwhelm system resources.
One, two, three.
That's a denial of service
or a distributed denial of service attack.
Number four, manipulating the browser
to control a session including what's displayed.
This is the one we said had a new name.
One, two, three.
This is an on-path attack.
We used to refer to it as a man in the browser attack
or a MitB.
And lastly, number five,
use of hardware and software systems
to monitor and control physical processes
in industrial settings.
What does that refer to?
One, two, three.
And that is gonna be OT or operational technology.
Right, that brings us to a security-in-action.
This one is about a cyber attack.
We have a hacktivist group initiated a poisoning attack
on your regional DNS servers,
which resulted in traffic being redirected
to a much smaller competitor.
The competitor site was unable to handle the traffic,
and subsequently crashed.
Now, post-incident, you're writing up an assessment
and you wanna include a preface
that includes a brief incident synopsis.
And because your audience isn't technical,
you know, you really want to explain
what went on in non-technical terms.
So a couple of key things here, right?
We have a hacktivist group.
We have a poisoning attack on our DNS servers.
Our competitor site subsequently crashed.
So, let's write up our assessment
and what we wanna include in the preface,
which includes that brief incident synopsis
in a non-technical way.
So go ahead and put me on pause while you work on that.
Come on back, and we'll do an explanation together.
Well, let's start with defining what a hacktivist is.
Hacktivists are cyber adversaries,
whose motivation is generally political.
Poisoning is the manipulation of trusted data.
Now, in this case,
the DNS internet locator record was changed
to point from www.ourrcompany.com site
to www.competitorcompany.com site.
Now, the increase in traffic was intended
to consume resources and cause a denial of service.
And in the end, really both companies were victimized.
The smaller company crashed,
the larger company lost their customers,
they went somewhere else.
Why would a hacktivist do this?
Again, a hacktivist is trying to make a statement.
So maybe the hacktivist really had some issue
with the competitor.
Now, hacktivist will tend to see one of two things,
either defacement or denial of service,
but explaining what's a hacktivist, what's poisoning?
How is DNS used?
In simple terms,
how did this attack occur and who was the victim?
And doing all that is definitely security and action.
There's your word cloud.
There's a lot in this word cloud, a lot.
We just went through a lot of material.
So please take your time,
you know, go through all of these terms,
and make sure you can speak to them all,
that you have clarity and that you're confident.
And if not, go back in the lesson, right?
And find out what it is that you don't know.
Do that before you move on.
But when you're ready, move on,
and I'll see you in the next lesson.