Chapter 4.2: The Art of Protecting Secrets _ Access Controls

Physical Access Controls

Physical access controls are actual barriers deployed to prevent direct contact with systems. The goal is to prevent unauthorized users from gaining physical access to facilities, equipment, and other organizational assets.

Physical access control determines who can enter (or exit), where they can enter (or exit), and when they can enter (or exit).

Examples of physical access controls include the following:

• Guards (Figure 1) monitor the facility

• Fences (Figure 2) protect the perimeter

• Motion detectors (Figure 3) detect moving objects

• Laptop locks (Figure 4) safeguard portable equipment

• Locked doors (Figure 5) prevent unauthorized access

• Swipe cards (Figure 6) allow access to restricted areas

• Guard dogs  protect the facility
• Video cameras  monitor a facility by collecting and recording images
• Mantraps allow access to the secured area after door 1 closes

• Alarms detect intrusion

Logical Access Controls

Logical access controls are the hardware and software solutions used to manage access to resources and systems. These technology-based solutions include tools and protocols that computer systems use for identification, authentication, authorization, and accountability.

Logical access controls include the following:

• Encryption is the process of taking plaintext and creating ciphertext
• Smart cards have an embedded microchip
• Passwords are protected string of characters
• Biometrics are users’ physical characteristics
• Access Control Lists (ACLs) define the type of traffic allowed on a network
• Protocols are a set of rules that govern the exchange of data between devices
• Firewalls prevent unwanted network traffic
• Routers connect at least two networks
• Intrusion Detection Systems monitor a network for suspicious activities
• Clipping Levels are certain allowed thresholds for errors before triggering a red flag

Administrative Access Controls

Administrative access controls are the policies and procedures defined by organizations to implement and enforce all aspects of controlling unauthorized access. Administrative controls focus on personnel and business practices. Administrative controls include the following:

• Policies are statements of intent
• Procedures are the detailed steps required to perform an activity
• Hiring practices involves the steps an organization takes to find qualified employees
• Background checks are an employment screening that includes information of past employment verification, credit history, and criminal history
• Data classification categorizes data based on its sensitivity
• Security training educates employees about the security policies at an organization
• Reviews evaluate an employee’s job performance

Mandatory Access Control

Mandatory access control (MAC) restricts the actions that a subject can perform on an object. A subject can be a user or a process. An object can be a file, a port, or an input/output device. An authorization rule enforces whether or not a subject can access the object.

Organizations use MAC where different levels of security classifications exist. Every object has a label and every subject has a clearance. A MAC system restricts a subject based on the security classification of the object and the label attached to the user.

For example, take the military security classifications Secret and Top Secret. If a file (an object) is considered top secret, it is classified (labeled) Top Secret. The only people (subjects) that may view the file (object) are those with a Top Secret clearance. It is up to the access control mechanism to ensure that an individual (subject) with only a Secret clearance, never gains access to a file labeled as Top Secret. Similarly, a user (subject) cleared for Top Secret access cannot change the classification of a file (object) labeled Top Secret to Secret. Additionally, a Top Secret user cannot send a Top Secret file to a user cleared only to see Secret information.

Discretionary Access Control

An object’s owner determines whether to allow access to an object with discretionary access control (DAC). DAC grants or restricts object access determined by the object’s owner. As the name implies, controls are discretionary because an object owner with certain access permissions can pass on those permissions to another subject.

In systems that employ discretionary access controls, the owner of an object can decide which subjects can access that object and what specific access they may have. One common method to accomplish this is with permissions, as shown in the figure. The owner of a file can specify what permissions (read/write/execute) other users may have.

Access control lists are another common mechanism used to implement discretionary access control. An access control list uses rules to determine what traffic can enter or exit a network

Role-Based Access Control

Role-based access control (RBAC) depends on the role of the subject. Roles are job functions within an organization. Specific roles require permissions to perform certain operations. Users acquire permissions through their role.

RBAC can work in combination with DAC or MAC by enforcing the policies of either one. RBAC helps to implement security administration in large organizations with hundreds of users and thousands of possible permissions. Organizations widely accept the use of RBAC to manage computer permissions within a system, or application, as a best practice.

Rule-Based Access Control

Rule-based access control uses access control lists (ACLs) to help determine whether to grant access. A series of rules is contained in the ACL, as shown in the figure. The determination of whether to grant access depends on these rules. An example of such a rule is one that states that no employee may have access to the payroll file after hours or on weekends.

As with MAC, users cannot change the access rules. Organizations can combine rule-based access control with other strategies for implementing access restrictions. For example, MAC methods can utilize a rule-based approach for implementation.

Activity - Identify Access Control Strategies

What is Identification?

Identification enforces the rules established by the authorization policy. A subject requests access to a system resource. Every time the subject requests access to a resource, the access controls determine whether to grant or deny access. For example, the authorization policy determines what activities a user can perform on a resource.

A unique identifier ensures the proper association between allowed activities and subjects. A username is the most common method used to identify a user. A username can be an alphanumeric combination, a personal identification number (PIN), a smart card, or biometric, such as a fingerprint, retina scan, or voice recognition.

A unique identifier ensures that a system can identify each user individually; therefore, allowing an authorized user to perform the appropriate actions on a particular resource.

Identification Controls

Cybersecurity policies determine which identification controls should be used. The sensitivity of the information and information systems determine how stringent the controls. The increase in data breaches has forced many organizations to strengthen their identification controls. For example, the credit card industry in the United States requires all vendors to convert to smart card identification systems.

What You Know

Passwords, passphrases, or PINs are all examples of something that the user knows. Passwords are the most popular method used for authentication. The terms passphrase, passcode, passkey, or PIN are generically referred to as password. A password is a string of characters used to prove a user’s identity. If this string of characters relates back to a user (such as a name, birthdate, or address), it will be easier for cyber criminals to guess a user’s password.

A number of publications recommend that a password be at least eight characters. Users should not create a password that is so long that it is difficult to memorize, or conversely, so short that it becomes vulnerable to password cracking. Passwords should contain a combination of upper and lowercase letters, numbers, and special characters. Click here to test current passwords.

Users need to use different passwords for different systems because if a criminal cracks the user’s password once, the criminal will have access to all of a user’s accounts. A password manager can help a user create and remember strong passwords. Click here to view a strong password generator.

What You Have

Smart cards and security key fobs are both examples of something that users have in their possession.

Smart Card Security (Figure 1) – A smart card is a small plastic card, about the size of a credit card, with a small chip embedded in it. The chip is an intelligent data carrier, capable of processing, storing, and safeguarding data. Smart cards store private information, such as bank account numbers, personal identification, medical records, and digital signatures. Smart cards provide authentication and encryption to keep data safe.

Security Key Fob (Figure 2) – A security key fob is a device that is small enough to attach to a key ring. It uses a process called two-factor authentication, which is more secure than a username and password combination. First, the user enters a personal identification number (PIN). If correctly entered, the security key fob will display a number. This is the second factor, which the user must enter to log in to the device or network.

Who You Are

A unique physical characteristic, such as a fingerprint, retina, or voice, that identifies a specific user is called biometrics. Biometric security compares physical characteristics against stored profiles to authenticate users. A profile is a data file containing known characteristics of an individual. The system grants the user access if his or her characteristics match saved settings. A fingerprint reader is a common biometric device.

There are two types of biometric identifiers:

• Physiological characteristics – these include fingerprints, DNA, face, hands, retina, or ear features
• Behavioral characteristics - include patterns of behavior, such as gestures, voice, typing rhythm, or the way a user walks

Biometrics is becoming increasingly popular in public security systems, consumer electronics, and point-of-sale applications. Implementing biometrics uses a reader or scanning device, software that converts the scanned information into digital form, and a database that stores biometric data for comparison.

Multi-factor Authentication

Multi-factor authentication uses at least two methods of verification. A security key fob is a good example. The two factors are something you know, such as a password, and something you have, such as a security key fob. Take this a step further by adding something you are, such as a fingerprint scan.

Multi-factor authentication can reduce the incidence of online identity theft because knowing the password would not give cyber criminals access to user information. For example, an online banking website might require a password and a PIN that the user receives on his or her smartphone. As shown in the figure, withdrawing cash from an ATM is another example of multifactor authentication. The user must have the bankcard and know the PIN before the ATM will dispense cash.

Activity - Identify Authentication Methods

What is Authorization?

Authorization controls what a user can and cannot do on the network after successful authentication. After a user proves his or her identity, the system checks to see what network resources the user can access and what the user can do with the resources. As shown in the figure, authorization answers the question, “What read, copy, create, and delete privileges does the user have?”

Authorization uses a set of attributes that describes the user’s access to the network. The system compares these attributes to the information contained within the authentication database, determines a set of restrictions for that user, and delivers it to the local router where the user is connected.

Authorization is automatic and does not require users to perform additional steps after authentication. Implement authorization immediately after the user authenticates.

Using Authorization

Defining authorization rules is the first step in controlling access. An authorization policy establishes these rules.

A group membership policy defines authorization based on membership in a specific group. For example, all employees of an organization have a swipe card, which provides access to the facility. If an employee’s job does not require that she have access to the server room, her security card will not allow her to enter that room.

An authority-level policy defines access permissions based on an employee’s standing within the organization. For example, only senior-level employees in an IT department may access the server room.

What is Accountability?

Accountability traces an action back to a person or process making the change to a system, collects this information, and reports the usage data. The organization can use this data for such purposes as auditing or billing. The collected data might include the log in time for a user, whether the user log in was a success or failure, or what network resources the user accessed. This allows an organization to trace actions, errors, and mistakes during an audit or investigation.

Implementing Accountability

Implementing accountability consists of technologies, policies, procedures, and education. Log files provide detailed information based on the parameters chosen. For example, an organization may look at the log for login failures and successes. Login failures can indicate that a criminal tried to hack an account. Login successes tell an organization which users are using what resources and when. Is it normal for an authorized user to access the corporate network at 3:00 a.m.? The organization’s policies and procedures spell out what actions should be recorded and how the log files are generated, reviewed and stored.

Data retention, media disposal, and compliance requirements all provide accountability. Many laws require the implementation of measures to secure different data types. These laws guide an organization on the right way to handle, store, and dispose of data. The education and awareness of an organization’s policies, procedures, and related laws can also contribute to accountability.

Preventive Controls

Prevent means to keep something from happening. Preventive access controls stop unwanted or unauthorized activity from happening. For an authorized user, a preventive access control means restrictions. Assigning user specific privileges on a system is an example of a preventive control. Even though a user is an authorized user, the system puts limits in place to prevent the user from accessing and performing unauthorized actions. A firewall that blocks access to a port or service that cyber criminals can exploit is also a preventive control.

Deterrent Controls

A deterrent is the opposite of a reward. A reward encourages individuals to do the right thing, while a deterrent discourages them from doing the wrong thing. Cyber security professionals and organizations use deterrents to limit or mitigate an action or behavior, but deterrents do not stop them. Access control deterrents discourage cyber criminals from gaining unauthorized access to information systems and sensitive data. Access control deterrents discourage attacking systems, stealing data, or spreading malicious code. Organizations use access control deterrents to enforce cybersecurity policies.

Deterrents make potential cyber criminals think twice before committing a crime. The figure lists common access control deterrents used in the cybersecurity world.

Detective Controls

Detection is the act or process of noticing or discovering something. Access control detections identify different types of unauthorized activity. Detection systems can be very simple, such as a motion detector or security guard. They can also be more complex, such as an intrusion detection system. All detective systems have several things in common; they look for unusual or prohibited activity. They also provide methods to record or alert system operators of potential unauthorized access. Detective controls do not prevent anything from happening; they are more of an after-the-fact measure.

Corrective Controls

Corrective counteracts something that is undesirable. Organizations put corrective access controls in place after a system experiences a threat. Corrective controls restore the system back to a state of confidentiality, integrity, and availability. They can also restore systems to normal after unauthorized activity occurs.

Recovery Controls

Recovery is a return to a normal state. Recovery access controls restore resources, functions, and capabilities after a violation of a security policy. Recovery controls can repair damage, in addition to stopping any further damage. These controls have more advanced capabilities over corrective access controls.

Compensative Controls

Compensate means to make up for something. Compensative access controls provide options to other controls to bolster enforcement in support of a security policy.

A compensative control can also be a substitution used in place of a control that is not possible under the circumstances. For example, an organization may not be able to have a guard dog, so instead it deploys a motion detector with a spotlight and a barking sound.

Activity – Compare Types of Security Controls

What is Data Masking?

Data masking technology secures data by replacing sensitive information with a non-sensitive version. The non-sensitive version looks and acts like the original. This means that a business process can use non-sensitive data and there is no need to change the supporting applications or data storage facilities. In the most common use case, masking limits the propagation of sensitive data within IT systems by distributing surrogate data sets for testing and analysis. Information can be dynamically masked if the system or application determines that a user request for sensitive information is risky.

Data Masking Techniques

Data masking can replace sensitive data in non-production environments to protect the underlying information.

There are several data masking techniques that can ensure that data remains meaningful but changed enough to protect it.

• Substitution replaces data with authentic looking values to apply anonymity to the data records.
• Shuffling derives a substitution set from the same column of data that a user wants to mask. This technique works well for financial information in a test database, for example.
• Nulling out applies a null value to a particular field, which completely prevents visibility of the data.

What is Steganography?

Steganography conceals data (the message) in another file such as a graphic, audio, or other text file. The advantage of steganography over cryptography is that the secret message does not attract any special attention. No one would ever know that a picture actually contained a secret message by viewing the file either electronically or in hardcopy.

There are several components involved in hiding data. First, there is the embedded data, which is the secret message. The cover-text (or cover-image or cover-audio) hides the embedded data producing the stego-text (or stego-image or stego-audio). A stego-key controls the hiding process.

Steganography Techniques

The approach used to embed data in a cover-image is using Least Significant Bits (LSB). This method uses bits of each pixel in the image. A pixel is the basic unit of programmable color in a computer image. The specific color of a pixel is a blend of three colors—red, green, and blue (RGB). Three bytes of data specify a pixel’s color (one byte for each color). Eight bits make up a byte. A 24-bit color system uses all three bytes. LSB uses a bit of each of the red, green, and blue color components. Each pixel can store 3 bits.

The figure shows three pixels of a 24-bit color image. One of the letters in the secret message is the letter T, and inserting the character T changes only two bits of the color. The human eye cannot recognize the changes made to the least significant bits. The result is a hidden character.

On average, not more than half of the bits in an image will need to change to hide a secret message effectively.

Social Steganography

Social steganography hides information in plain sight by creating a message that can be read a certain way by some to get the message. Others who view it in a normal way will not see the message. Teens on social media use this tactic to communicate with their closest friends while keeping others, like their parents, unaware of what the message actually means. For example, the phrase “going to the movies” might mean “going to the beach”.

Individuals in countries that censor media also use social steganography to get their messages out by misspelling words on purpose or making obscure references. In effect, they communicate to different audiences simultaneously.

Detection

Steganalysis is the discovery that hidden information exists. The goal of steganalysis is to discover the hidden information.

Patterns in the stego-image create suspicion. For example, a disk may have unused areas that hide information. Disk analysis utilities can report on hidden information in unused clusters of storage devices. Filters can capture data packets that contain hidden information in packet headers. Both of these methods are using steganography signatures.

By comparing an original image with the stego-image, an analyst may pick up repetitive patterns visually.

Obfuscation

Data obfuscation is the use and practice of data masking and steganography techniques in the cybersecurity and cyber intelligence profession. Obfuscation is the art of making the message confusing, ambiguous, or harder to understand. A system may purposely scramble messages to prevent unauthorized access to sensitive information.

Applications

Software watermarking protects software from unauthorized access or modification. Software watermarking inserts a secret message into the program as proof of ownership. The secret message is the software watermark. If someone tries to remove the watermark, the result is nonfunctional code.

Software obfuscation translates software into a version equivalent to the original but one that is harder for attackers to analyze. Trying to reverse engineer the software gives unintelligible results from software that still functions.

Ref : [1]

Chapter 4.1: The Art of Protecting Secrets _ Cryptography

The principles of cryptology explain how modern day protocols and algorithms secure communications. Cryptology is the science of making and breaking secret codes. The development and use of codes is cryptography. Studying and breaking codes is cryptanalysis. Society has used cryptography for centuries to protect secret documents. For example, Julius Caesar used a simple alphabetic cipher to encrypt messages to his generals in the field. His generals would have knowledge of the cipher key required to decrypt the messages. Today, modern day cryptographic methods ensure secure communications.

Access control is, as its name suggests, a way of controlling access to a building, a room, a system, a database, a file, and information. Organizations employ a variety of access control techniques to protect confidentiality. This chapter will examine the four steps in the access control process: 1) identification, 2) authentication, 3) authorization, and 4) accountability. In addition, the chapter describes the different access control models and access control types.

The chapter concludes by discussing the various ways users mask data. Data obfuscation and steganography are two techniques used to accomplish data masking.

What is Cryptography?

Cryptology is the science of making and breaking secret codes. Cryptography is a way to store and transmit data so only the intended recipient can read or process it. Modern cryptography uses computationally secure algorithms to make sure that cyber criminals cannot easily compromise protected information.

Data confidentiality ensures privacy so that only the intended receiver can read the message. Parties achieve this through encryption. Encryption is the process of scrambling data so that an unauthorized party cannot easily read it.

When enabling encryption, readable data is plaintext, or cleartext, while the encrypted version is encrypted text or ciphertext. Encryption converts the plaintext readable message to ciphertext, which is the unreadable, disguised message. Decryption reverses the process. Encryption also requires a key, which plays a critical role in encrypting and decrypting a message. The person possessing the key can decrypt the ciphertext to plaintext.

Historically, parties have used various encryption algorithms and methods. An algorithm is the process or formula used to solve a problem. Julius Caesar is said to have secured messages by putting two sets of the alphabet, side-by-side, and then shifting one of them by a specific number of places. The number of places in the shift serves as the key. He converted plaintext into ciphertext using this key, and only his generals, who also had the key, knew how to decipher the messages. This method is the Caesar cipher. The figure shows a secret message using the Caesar cipher.

The History of Cryptography

The history of cryptography started in diplomatic circles thousands of years ago. Messengers from a king’s court took encrypted messages to other courts. Occasionally, other courts not involved in the communication, attempted to steal messages sent to a kingdom they considered an adversary. Not long after, military commanders started using encryption to secure messages.

Over the centuries, various cipher methods, physical devices, and aids encrypted and decrypted text:

Scytale

Caesar Cipher

Vigenère Cipher 

Enigma Machine

All cipher methods use a key to encrypt or decrypt a message. The key is an important component in the encryption algorithm. An encryption algorithm is only as good as the key used. The more complexity involved, the more secure the algorithm. Key management is an important piece in the process.

Creating Ciphertext

Each encryption method uses a specific algorithm, called a cipher, to encrypt and decrypt messages. A cipher is a series of well-defined steps used to encrypt and decrypt messages. There are several methods of creating ciphertext:

Transposition – letters are rearranged

Substitution – letters are replaced

One-time pad – plaintext combined with a secret key creates a new character, which then combines with the plaintext to produce ciphertext

Old encryption algorithms, such as the Caesar cipher or the Enigma machine, depended on the secrecy of the algorithm to achieve confidentiality. With modern technology, where reverse engineering is often simple, parties use public-domain algorithms. With most modern algorithms, successful decryption requires knowledge of the appropriate cryptographic keys. This means that the security of encryption lies in the secrecy of the keys, not the algorithm.

Some modern encryption algorithms still use transposition as part of the algorithm.

Key management is the most difficult part of designing a cryptosystem. Many cryptosystems have failed because of mistakes in their key management, and all modern cryptographic algorithms require key management procedures. In practice, most attacks on cryptographic systems involve attacking the key management system, rather than the cryptographic algorithm itself.

Activity – Exploring the Vigenère Cipher

Two Types of Encryption

Cryptographic encryption can provide confidentiality by incorporating various tools and protocols.

There are two approaches to ensuring the security of data when using encryption. The first is to protect the algorithm. If the security of an encryption system depends on the secrecy of the algorithm itself, the most important aspect is to guard the algorithm at all costs. Every time someone finds out the details of the algorithm, every party involved would need to change the algorithm. That approach does not sound very secure or manageable. The second approach is to protect the keys. With modern cryptography, the algorithms are public. The cryptographic keys ensure the secrecy of the data. Cryptographic keys are passwords that are part of the input into an encryption algorithm together along with the data requiring encryption.

There are two classes of encryption algorithms:

Symmetric algorithms - These algorithms use the same pre-shared key, sometimes called a secret key pair, to encrypt and decrypt data. Both the sender and receiver know the pre-shared key before any encrypted communication begins. As shown in Figure 1, symmetric algorithms use the same key to encrypt and decrypt the plaintext. Encryption algorithms that use a common key are simpler and need less computational power.

Asymmetric algorithms - Asymmetrical encryption algorithms use one key to encrypt data and a different key to decrypt data. One key is public and the other is private. In a public-key encryption system, any person can encrypt a message using the public key of the receiver, and the receiver is the only one that can decrypt it using his private key. Parties exchange secure messages without needing a pre-shared key, as shown in Figure 2. Asymmetric algorithms are more complex. These algorithms are resource intensive and slower to execute.

The Symmetrical Encryption Process

Symmetric algorithms use the same pre-shared key to encrypt and decrypt data, a method also known as private-key encryption.

For example, Alice and Bob live in different locations and want to exchange secret messages with one another through the mail system. Alice wants to send a secret message to Bob.

Private-key encryption uses a symmetric algorithm. As illustrated by the keys in the figure, Alice and Bob have identical keys to a single padlock. The key exchange happened prior to sending any secret messages. Alice writes a secret message and puts it in a small box that she locks using the padlock. She mails the box to Bob. The message is safe inside the box as the box makes its way through the post office system. When Bob receives the box, he uses his key to unlock the padlock and retrieve the message. Bob can use the same box and padlock to send a secret reply back to Alice.

If Bob wants to talk to Carol, he needs a new pre-shared key for that communication to keep it secret from Alice. The more people Bob wants to communicate with securely, the more keys he will need to manage.

Types of Cryptography

The most common types of cryptography are block ciphers and stream ciphers. Each method differs in the way that it groups bits of data to encrypt it.

Block Ciphers

Block ciphers transform a fixed-length block of plaintext into a common block of ciphertext of 64 or 128 bits. Block size is the amount of data encrypted at any one time. To decrypt this ciphertext, apply the reverse transformation to the ciphertext block, using the same secret key.

Block ciphers usually result in output data that is larger than the input data, because the ciphertext must be a multiple of the block size. For example, Data Encryption Standard (DES) is a symmetric algorithm that encrypts blocks in 64-bit chunks using a 56-bit key. To accomplish this, the block algorithm takes data one chunk at a time, for example, 8 bytes per chunk, until the entire block is full. If there is less input data than one full block, the algorithm adds artificial data, or blanks, until it uses the full 64 bits, as shown in Figure 1 for the 64 bits on the left.

Stream Ciphers

Unlike block ciphers, stream ciphers encrypt plaintext one byte or one bit at a time, as shown in Figure 2. Think of stream ciphers as a block cipher with a block size of one bit. With a stream cipher, the transformation of these smaller plaintext units varies, depending on when they are encountered during the encryption process. Stream ciphers can be much faster than block ciphers, and generally do not increase the message size, because they can encrypt an arbitrary number of bits.

A5 is a stream cipher that provides voice privacy and encrypts cell phone communications. It is also possible to use DES in stream cipher mode.

Complex cryptographic systems can combine block and stream in the same process.

Symmetric Encryption Algorithms

Numerous encryption systems use symmetric encryption. Some of the common encryption standards that use symmetric encryption include the following:

3DES (Triple DES): Digital Encryption Standard (DES) is a symmetric block cipher with 64-bit block size that uses a 56-bit key. It takes a 64-bit block of plaintext as input and outputs a 64-bit block of ciphertext. It always operates on blocks of equal size and it uses both permutations and substitutions in the algorithm. A permutation is a way of arranging all elements of a set.

Triple DES encrypts data three times and uses a different key for at least one of the three passes, giving it a cumulative key size of 112-168 bits. 3DES is resistant to attack, but it is much slower than DES.

The 3DES encryption cycle is as follows:

1. Data encrypted by first DES
2. Data decrypted by second DES
3. Data re-encrypted by third DES

The reverse process decrypts the ciphertext.

IDEA: The International Data Encryption Algorithm (IDEA) uses 64-bit blocks and 128-bit keys. IDEA performs eight rounds of transformations on each of the 16 blocks that results from dividing each 64-bit block. IDEA was the replacement for DES, and now PGP (Pretty Good Privacy) uses it. PGP is a program that provides privacy and authentication for data communication. GNU Privacy Guard (GPG) is a licensed, free version of PGP.

AES: The Advanced Encryption Standard (AES) has a fixed block size of 128-bits with a key size of 128, 192, or 256 bits. The National Institute of Standards and Technology (NIST) approved the AES algorithm in December 2001. The U.S. government uses AES to protect classified information.

AES is a strong algorithm that uses longer key lengths. AES is faster than DES and 3DES, so it provides both a solution for software applications as well as hardware use in firewalls and routers.

Other block ciphers include Skipjack (developed by the NSA), Blowfish, and Twofish.

Activity - Using Symmetrical Encryption

The Asymmetrical Encryption Process

Asymmetric encryption, also called public-key encryption, uses one key for encryption that is different from the key used for decryption. A criminal cannot calculate the decryption key based on knowledge of the encryption key, and vice versa, in any reasonable amount of time.

If Alice and Bob exchange a secret message using public-key encryption, they use an asymmetric algorithm. This time Bob and Alice do not exchange keys prior to sending secret messages. Instead, Bob and Alice each have a separate padlock with separate corresponding keys. For Alice to send a secret message to Bob, she must first contact him and ask him to send his open padlock to her. Bob sends the padlock but keeps his key. When Alice receives the padlock, she writes her secret message and puts it in a small box. She also puts her open padlock in the box but keeps her key. She then locks the box with Bob’s padlock. When Alice locks the box, she is no longer able to get inside because she does not have a key to that padlock. She mails the box to Bob and, as the box travels through the mail system, no one is able to open it. When Bob receives the box, he can use his key to unlock the box and retrieve the message from Alice. To send a secure reply, Bob puts his secret message in the box, along with his open padlock, and locks the box using Alice’s padlock. Bob mails the secured box back to Alice.

For example, in Figure 1, Alice requests and obtains Bob’s public key. In Figure 2, Alice uses Bob’s public key to encrypt a message using an agreed-upon algorithm. Alice sends the encrypted message to Bob, and Bob then uses his private key to decrypt the message, as shown in Figure 3.

Asymmetric Encryption Algorithms

Asymmetric algorithms use formulas that anyone can look up. The pair of unrelated keys is what makes these algorithms secure. The asymmetric algorithms include:

RSA (Rivest-Shamir-Adleman) - uses the product of two very large prime numbers with an equal length of between 100 and 200 digits. Browsers use RSA to establish a secure connection.

Diffie-Hellman - provides an electronic exchange method to share the secret key. Secure protocols, such as Secure Sockets Layer (SSL), Transport Layer Security (TLS), Secure Shell (SSH), and Internet Protocol Security (IPsec), use Diffie-Hellman.

ElGamal - uses the U.S. government standard for digital signatures. This algorithm is free for use because no one holds the patent.

Elliptic Curve Cryptography (ECC) - uses elliptic curves as part of the algorithm. In the U.S., the National Security Agency uses ECC for digital signature generation and key exchange.

Key Management

Key management includes the generation, exchange, storage, use, and replacement of keys used in an encryption algorithm.

Key management is the most difficult part of designing a cryptosystem. Many cryptosystems have failed because of mistakes in their key management procedures. In practice, most attacks on cryptographic systems target the key management level, rather than the cryptographic algorithm itself.

As shown in the figure, there are several essential characteristics of key management to consider.

Two terms used to describe keys are:

• Key length - Also called the key size, this is the measure in bits.
• Keyspace - This is the number of possibilities that a specific key length can generate.

As key length increase, the keyspace increases exponentially. The keyspace of an algorithm is the set of all possible key values. Longer keys are more secure; however, they are also more resource intensive. Almost every algorithm has some weak keys in its keyspace that enable a criminal to break the encryption via a shortcut.

Comparing Encryption Types

It is important to understand the differences between symmetric and asymmetric encryption methods. Symmetric encryption systems are more efficient and can handle more data. However, key management with symmetric encryption systems is more problematic and harder to manage. Asymmetric cryptography is more efficient at protecting the confidentiality of small amounts of data, and its size and speed make it more secure for tasks such as electronic key exchange which is a small amount of data rather than encrypting large blocks of data.

Maintaining confidentiality is important for both data at rest and data in motion. In both cases, symmetric encryption is favored because of its speed and the simplicity of the algorithm. Some asymmetric algorithms can significantly increase the size of the object encrypted. Therefore, in the case of data in motion, use public key cryptography to exchange the secret key, and then symmetric cryptography to ensure the confidentiality of the data sent.

Applications

There are many applications for both symmetric and asymmetric algorithms.

A one-time password-generating token is a hardware device that uses cryptography to generate a one-time password. A one-time password is an automatically generated numeric or alphanumeric string of characters that authenticates a user for one transaction of one session only. The number changes every 30 seconds or so. The session password appears on a display and the user enters the password.

The electronic payment industry uses 3DES. Operating systems use DES to protect user files and system data with passwords. Most encrypting file systems, such as NTFS, use AES.

Four protocols use asymmetric key algorithms:

1. Internet Key Exchange (IKE), which is a fundamental component of IPsec Virtual Private Networks (VPNs).
2. Secure Socket Layer (SSL), which is a means of implementing cryptography into a web browser.
3. Secure Shell (SSH), which is a protocol that provides a secure remote access connection to network devices.
4. Pretty Good Privacy (PGP), which is a computer program that provides cryptographic privacy and authentication to increase the security of email communications.

A VPN is a private network that uses a public network, usually the Internet, to create a secure communication channel. A VPN connects two endpoints such as two remote offices over the Internet to form the connection.

VPNs use IPsec. IPsec is a suite of protocols developed to achieve secure services over networks. IPsec services allow for authentication, integrity, access control, and confidentiality. With IPsec, remote sites can exchange encrypted and verified information.

Data in use is a growing concern to many organizations. When in use, data no longer has any protection because the user needs to open and change the data. System memory holds data in use and it can contain sensitive data such as the encryption key. If criminals compromise data in use, they will have access to data at rest and data in motion.

Activity - Compare Symmetrical Versus Asymmetrical Encryption

Ref : [1]

Chapter 3: Cybersecurity Threats, Vulnerabilities, and Attacks

Threats, vulnerabilities, and attacks are the central focus of cybersecurity professionals. A threat is the possibility that a harmful event, such as an attack, will occur. A vulnerability is a weakness that makes a target susceptible to an attack. An attack is a deliberate exploitation of a discovered weakness in computer information systems, either as specific targets or merely as targets of opportunity. Cyber criminals may have different motivations for selecting a target of an attack. Cyber criminals succeed by continuously searching for and identifying systems with clear vulnerabilities. Common victims include unpatched systems or systems missing virus and spam detection.

This chapter examines the most common cybersecurity attacks. Cybersecurity professionals must understand how each attack works, what it exploits, and how it affects the victim. The chapter begins by explaining the threat of malware and malicious code and then goes into explaining the types of deception involved with social engineering. A cyberattack is any type of offensive maneuver used by cyber criminals to target computer information systems, computer networks, or other computer devices. Cyber criminals launch offensive maneuvers against both wired and wireless networks.

What is Malware?

Malicious software, or malware, is a term used to describe software designed to disrupt computer operations, or gain access to computer systems, without the user's knowledge or permission. Malware has become an umbrella term used to describe all hostile or intrusive software. The term malware includes computer viruses, worms, Trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. Malware may be obvious and simple to identify or it can be very stealthy and almost impossible to detect.

Viruses, Worms, and Trojan Horses

Cyber criminals target user’s end devices through the installation of malware. Click Play to view an animation of the three most common types of malware.

Viruses

A virus is malicious executable code attached to another executable file, such as a legitimate program. Most viruses require end-user initiation, and can activate at a specific time or date. Computer viruses usually spread in one of three ways: from removable media; from downloads off the Internet; and from email attachments. Viruses can be harmless and simply display a picture or they can be destructive, such as those that modify or delete data. In order to avoid detection, a virus mutates. The simple act of opening a file can trigger a virus. A boot sector, or file system virus, infects USB flash drives and can spread to the system’s hard disk. Executing a specific program can activate a program virus. Once the program virus is active, it will usually infect other programs on the computer or other computers on the network. The Melissa Virus was an example of a virus spread via email. Melissa affected tens of thousands of users and caused an estimated $1.2 billion in damage. Click here to read more about viruses.

Worms

Worms are malicious code that replicates by independently exploiting vulnerabilities in networks. Worms usually slow down networks. Whereas a virus requires a host program to run, worms can run by themselves. Other than the initial infection, worms no longer require user participation. After a worm affects a host, it is able to spread very quickly over the network. Worms share similar patterns. They all have an enabling vulnerability, a way to propagate themselves, and they all contain a payload.

Worms are responsible for some of the most devastating attacks on the Internet. For example, in 2001, the Code Red worm infected 658 servers. Within 19 hours, the worm infected over 300,000 servers.

Trojan horse

A Trojan horse is malware that carries out malicious operations under the guise of a desired operation such as playing an online game. This malicious code exploits the privileges of the user that runs it. A Trojan horse differs from a virus because the Trojan binds itself to non-executable files, such as image files, audio files, or games.

Logic Bombs

A logic bomb is a malicious program that uses a trigger to awaken the malicious code. For example, triggers can be dates, times, other programs running, or the deletion of a user account. The logic bomb remains inactive until that trigger event happens. Once activated, a logic bomb implements a malicious code that causes harm to a computer. A logic bomb can sabotage database records, erase files, and attack operating systems or applications. Cybersecurity specialists recently discovered logic bombs that attack and destroy the hardware components in a workstation or server including the cooling fans, CPU, memory, hard drives and power supplies. The logic bomb overdrives these devices until they overheat or fail.

Ransomware

Ransomware holds a computer system, or the data it contains, captive until the target makes a payment. Ransomware usually works by encrypting data in the computer with a key unknown to the user. The user must pay a ransom to the criminals to remove the restriction.

Some other versions of ransomware can take advantage of specific system vulnerabilities to lock down the system. Ransomware propagates as a Trojan horse and is the result of a downloaded file or some software weakness.

Payment through an untraceable payment system is always the criminal’s goal. Once the victim pays, the criminal supplies a program that decrypts the files or sends an unlock code. Click here to read more about ransomware.

Backdoors and Rootkits

A backdoor refers to the program or code introduced by a criminal who has compromised a system. The backdoor bypasses the normal authentication used to access a system. A few common backdoor programs are Netbus and Back Orifice, which both allow remote access to unauthorized system users. The purpose of the backdoor is to grant the cyber criminals future access to the system even if the organization fixes the original vulnerability used to attack the system. Usually, criminals have authorized users unknowingly run a Trojan horse program on their machine to install the backdoor.

A rootkit modifies the operating system to create a backdoor. Attackers then use the backdoor to access the computer remotely. Most rootkits take advantage of software vulnerabilities to perform privilege escalation and modify system files. Privilege escalation takes advantage of programming errors or design flaws to grant the criminal elevated access to network resources and data. It is also common for rootkits to modify system forensics and monitoring tools, making them very hard to detect. Often, a user must wipe and reinstall the operating system of a computer infected by a rootkit.

Defending Against Malware

A few simple steps can help defend against all forms of malware:

• Antivirus Program - The majority of antivirus suites catch most widespread forms of malware. However, cyber criminals develop and deploy new threats on a daily basis. Therefore, the key to an effective antivirus solution is to keep the signatures updated. A signature is like a fingerprint. It identifies the characteristics of a piece of malicious code.
• Up-to-Date Software - Many forms of malware achieve their objectives through exploitation of vulnerabilities in software, both in the operating system and applications. Although operating system vulnerabilities were the main source of problems, today’s application-level vulnerabilities pose the greatest risk. Unfortunately, while operating system vendors are becoming more and more responsive to patching, most application vendors are not.

Activity - Identify Types of Malicious Code

Spam

Email is a universal service used by billions worldwide. As one of the most popular services, email has become a major vulnerability to users and organizations. Spam, also known as junk mail, is unsolicited email. In most cases, spam is a method of advertising. However, spam can send harmful links, malware, or deceptive content. The end goal is to obtain sensitive information such as a social security number or bank account information. Most spam comes from multiple computers on networks infected by a virus or worm. These compromised computers send out as much bulk email as possible.

Even with these security features implemented, some spam might still get through. Watch for some of the more common indicators of spam:

• An email has no subject line.
• An email is requesting an update to an account.
• The email text has misspelled words or strange punctuation.
• Links within the email are long and/or cryptic.
• An email looks like correspondence from a legitimate business.
• The email requests that the user open an attachment.

If a user receives an email that contains one or more of these indicators, he or she should not open the email or any attachments. It is very common for an organization’s email policy to require a user receiving this type of email to report it to the cyber security staff. Almost all email providers filter spam. Unfortunately, spam still consumes bandwidth, and the recipient's server still has to process the message.

Spyware, Adware, and Scareware

Spyware is software that enables a criminal to obtain information about a user’s computer activities. Spyware often includes activity trackers, keystroke collection, and data capture. In an attempt to overcome security measures, spyware often modifies security settings. Spyware often bundles itself with legitimate software or with Trojan horses. Many shareware websites are full of spyware.

Adware typically displays annoying pop-ups to generate revenue for its authors. The malware may analyze user interests by tracking the websites visited. It can then send pop-up advertising pertinent to those sites. Some versions of software automatically install Adware. Some adware only delivers advertisements, but it is also common for adware to come with spyware.

Scareware persuades the user to take a specific action based on fear. Scareware forges pop-up windows that resemble operating system dialogue windows. These windows convey forged messages stating that the system is at risk or needs the execution of a specific program to return to normal operation. In reality, no problems exist, and if the user agrees and allows the mentioned program to execute, malware infects his or her system.

Phishing

Phishing is a form of fraud. Cyber criminals use email, instant messaging, or other social media to try to gather information such as login credentials or account information by masquerading as a reputable entity or person. Phishing occurs when a malicious party sends a fraudulent email disguised as being from a legitimate, trusted source. The message intent is to trick the recipient into installing malware on his or her device or into sharing personal or financial information. An example of phishing is an email forged to look like it came from a retail store asking the user to click a link to claim a prize. The link may go to a fake site asking for personal information, or it may install a virus.

Spear phishing is a highly targeted phishing attack. While phishing and spear phishing both use emails to reach the victims, spear phishing sends customized emails to a specific person. The criminal researches the target’s interests before sending the email. For example, a criminal learns that the target is interested in cars and has been looking to buy a specific model of car. The criminal joins the same car discussion forum where the target is a member, forges a car sale offering, and sends an email to the target. The email contains a link for pictures of the car. When the target clicks on the link, he or she unknowingly installs malware on the computer. Click here to learn more about email frauds.

Vishing, Smishing, Pharming, and Whaling

Vishing is phishing using voice communication technology. Criminals can spoof calls from legitimate sources using voice over IP (VoIP) technology. Victims may also receive a recorded message that appears legitimate. Criminals want to obtain credit card numbers or other information to steal the victim’s identity. Vishing takes advantage of the fact that people trust the telephone network.

Smishing (Short Message Service phishing) is phishing using text messaging on mobile phones. Criminals impersonate a legitimate source in an attempt to gain the trust of the victim. For example, a smishing attack might send the victim a website link. When the victim visits the website, malware is installed on the mobile phone.

Pharming is the impersonation of a legitimate website in an effort to deceive users into entering their credentials. Pharming misdirects users to a fake website that appears to be official. Victims then enter their personal information thinking that they connected to a legitimate site.

Whaling is a phishing attack that targets high profile targets within an organization such as senior executives. Additional targets include politicians or celebrities.

Browser Plugins and Browser Poisoning

Security breaches can affect web browsers by displaying pop-up advertising, collecting personally identifiable information, or installing adware, viruses, or spyware. A criminal can hack a browser’s executable file, a browser’s components, or its plugins.

Plugins

The Flash and Shockwave plugins from Adobe enable the development of interesting graphic and cartoon animations that greatly enhance the look and feel of a web page. Plugins display the content developed using the appropriate software.

Until recently, plugins had a remarkable safety record. As Flash-based content grew and became more popular, criminals examined the Flash plugins and software, determined vulnerabilities, and exploited Flash Player. Successful exploitation could cause a system crash or allow a criminal to take control of the affected system. Expect increased data losses to occur as criminals continue to investigate the more popular plugins and protocols for vulnerabilities.

SEO Poisoning

Search engines such as Google work by ranking pages and presenting relevant results based on users’ search queries. Depending on the relevancy of web site content, it may appear higher or lower in the search result list. SEO, short for Search Engine Optimization, is a set of techniques used to improve a website’s ranking by a search engine. While many legitimate companies specialize in optimizing websites to better position them, SEO poisoning uses SEO to make a malicious website appear higher in search results.

The most common goal of SEO poisoning is to increase traffic to malicious sites that may host malware or perform social engineering. To force a malicious site to rank higher in search results, attackers take advantage of popular search terms.

Browser Hijacker

A browser hijacker is malware that alters a computer's browser settings to redirect the user to websites paid for by the cyber criminals' customers. Browser hijackers usually install without the user's permission and are usually part of a drive-by download. A drive-by download is a program that automatically downloads to the computer when a user visits a web site or views an HTML email message. Always read user agreements carefully when downloading programs to avoid this type of malware.

Defending Against Email and Browser Attacks

Methods for dealing with spam include filtering email, educating the user about being cautious towards unknown email(s), and using host/server filters.

It is difficult to stop spam, but there are ways to diminish its effects. For example, most ISPs filter spam before it reaches the user’s inbox. Many antivirus and email software programs automatically perform email filtering. This means that they detect and remove spam from an email inbox.

Organizations must also make employees aware of the dangers of opening email attachments that may contain a virus or a worm. Do not assume that email attachments are safe, even when they come from a trusted contact. A virus may be trying to spread by using the sender’s computer. Always scan email attachments before opening them.

The Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft and fraud that result from phishing and email spoofing.

Keeping all software updated ensures that the system has all of the latest security patches applied to take away known vulnerabilities. Click here to learn more about avoiding browser attacks

Activity - Identify Email and Browser Attacks

Social Engineering

Social engineering is a completely non-technical means for a criminal to gather information on a target. Social engineering is an attack that attempts to manipulate individuals into performing actions or divulging confidential information.

Social engineers often rely on people’s willingness to be helpful but also prey on people’s weaknesses. For example, an attacker could call an authorized employee with an urgent problem that requires immediate network access. The attacker could appeal to the employee’s vanity, invoke authority using name-dropping techniques, or appeal to the employee’s greed.

These are some types of social engineering attacks:

Pretexting - This is when an attacker calls an individual and lies to them in an attempt to gain access to privileged data. An example involves an attacker who pretends to need personal or financial data in order to confirm the identity of the recipient.

Something for Something (Quid pro quo) - This is when an attacker requests personal information from a party in exchange for something, like a gift.

Social Engineering Tactics

Social engineers rely on several tactics. Social engineering tactics include:

• Authority – people are more likely to comply when instructed by “an authority”
• Intimidation – criminals bully a victim into taking action
• Consensus/Social Proof – people will take action if they think that other people like it too
• Scarcity – people will take action when they think there is a limited quantity
• Urgency – people will take action when they think there is a limited time
• Familiarity/Liking – Criminals build a rapport with the victim to establish a relationship
• Trust – Criminals build a trusting relationship with a victim which may require more time to establish

Activity - Identify Social Engineering Tactics

Shoulder Surfing and Dumpster Diving

A criminal observes, or shoulder surfs, to pick up PINs, access codes or credit card numbers. An attacker can be in close proximity to his victim or the attacker can use binoculars or closed circuit cameras to shoulder surf. That is one reason that a person can only read an ATM screen at certain angles. These types of safeguards make shoulder surfing much more difficult.

"One man's trash is another man's treasure". This phrase can be especially true in the world of dumpster diving which is the process of going through a target's trash to see what information an organization throws out. Consider securing the trash receptacle. Any sensitive information should be properly disposed of through shredding or the use of burn bags, a container that holds classified or sensitive documents for later destruction by fire.

Impersonation and Hoaxes

Impersonation is the action of pretending to be someone else. For example, a recent phone scam targeted taxpayers. A criminal, posing as an IRS employee, told the victims that they owed money to the IRS. The victims must pay immediately through a wire transfer. The impersonator threatened that failure to pay will result in an arrest. Criminals also use impersonation to attack others. They can undermine the credibility of individuals by using website or social media postings.

A hoax is an act intended to deceive or trick. A cyber hoax can cause just as much disruption as an actual breach would cause. A hoax elicits a user reaction. The reaction can create unnecessary fear and irrational behavior. Users pass hoaxes through email and social media. Click here to visit a website that lists hoax messages.

Piggybacking and Tailgating

Piggybacking occurs when a criminal tags along with an authorized person to gain entry into a secure location or a restricted area. Criminals use several methods to piggyback:

• They give the appearance of being escorted by the authorized individual
• They join a large crowd pretending to be a member
• They target a victim who is careless about the rules of the facility

Tailgating is another term that describes the same practice.

A mantrap prevents piggybacking by using two sets of doors. After individuals enter an outer door, that door must close before entering the inner door.

Online, Email, and Web-based Deception

Forwarding hoax emails and other jokes, funny movies, and non-work-related emails at work may violate the company's acceptable use policy and result in disciplinary actions

Defending Against Deception

Organizations need to promote awareness of social engineering tactics and properly educate employees on prevention measures, such as the following:

• Never provide confidential information or credentials via email, chat sessions, in-person, or on the phone to unknown parties.
• Resist the urge to click on enticing emails and website links.
• Keep an eye out for uninitiated or automatic downloads.
• Establish policies and educate employees about those policies.
• When it comes to security, give employees a sense of ownership.
• Do not fall to pressure from unknown individuals.

Activity - Identify Social Engineering Threats

Denial of Service

Denial-of-Service (DoS) attacks are a type of network attack. A DoS attack results in some sort of interruption of network services to users, devices, or applications. There are two major types of DoS attacks:

• Overwhelming Quantity of Traffic – The attacker sends an enormous quantity of data at a rate that the network, host, or application cannot handle. This causes a slowdown in transmission or response, or a crash of a device or service.
• Maliciously Formatted Packets – The attacker sends a maliciously formatted packet to a host or application and the receiver is unable to handle it. For example, an application cannot identify packets containing errors or improperly formatted packets forwarded by the attacker. This causes the receiving device to run very slowly or crash.

DoS attacks are a major risk because they can easily interrupt communication and cause significant loss of time and money. These attacks are relatively simple to conduct, even by an unskilled attacker.

The goal of a denial-of-service attack is to deny access to authorized users making the network unavailable (remember the three underlying security principles: confidentiality, integrity, and availability). Click Play in Figure 1 to view the animation of a DoS attack.

A Distributed DoS Attack (DDoS) is similar to a DoS attack, but it originates from multiple, coordinated sources. As an example, a DDoS attack could proceed as follows:

An attacker builds a network of infected hosts, called a botnet, comprised of zombies. Zombies are the infected hosts. The attacker uses handler systems to control the zombies. The zombie computers constantly scan and infect more hosts, creating more zombies. When ready, the hacker instructs the handler systems to make the botnet of zombies carry out a DDoS attack.

Sniffing

Sniffing is similar to eavesdropping on someone. It occurs when attackers examine all network traffic as it passes through their NIC, independent of whether or not the traffic is addressed to them or not. Criminals accomplish network sniffing with a software application, hardware device, or a combination of the two. As shown in the figure, sniffing views all network traffic or it can target a specific protocol, service, or even string of characters such as a login or password. Some network sniffers observe all traffic and modify some or all of the traffic as well.

Sniffing also has its benefits. Network administrators may also use sniffers to analyze network traffic, identify bandwidth issues, and troubleshoot other network issues.

Physical security is important in preventing the introduction of sniffers on the internal network.

Spoofing

Spoofing is an impersonation attack, and it takes advantage of a trusted relationship between two systems. If two systems accept the authentication accomplished by each other, an individual logged onto one system might not go through an authentication process again to access the other system. An attacker can take advantage of this arrangement by sending a packet to one system that appears to have come from a trusted system. Since the trusted relationship is in place, the targeted system may perform the requested task without authentication.

There are multiple types of spoofing attacks.

• MAC address spoofing occurs when one computer accepts data packets based on the MAC address of another computer.
• IP spoofing sends IP packets from a spoofed source address to disguise itself.
• Address Resolution Protocol (ARP) is a protocol that resolves IP addresses to MAC addresses for transmitting data. ARP spoofing sends spoofed ARP messages across a LAN to link the criminal’s MAC address with the IP address of an authorized member of the network.
• The Domain Name System (DNS) associates domain names with IP addresses. DNS server spoofing modifies the DNS server to reroute a specific domain name to a different IP address controlled by the criminal.

Man-in-the-middle

A criminal performs a man-in-the-middle (MitM) attack by intercepting communications between computers to steal information crossing the network. The criminal can also choose to manipulate messages and relay false information between hosts since the hosts are unaware that a modification to the messages occurred. MitM allows the criminal to take control over a device without the user’s knowledge.

Man-In-The-Mobile (MitMo) is a variation of man-in-middle. MitMo takes control over a mobile device. The infected mobile device sends user-sensitive information to the attackers. ZeuS, an example of an exploit with MitMo capabilities, allows attackers quietly to capture 2-step verification SMS messages sent to users. For example, when a user sets up an Apple ID, he or she must provide an SMS-capable phone number to receive a temporary verification code via text message to prove the user’s identity. Malware spies on this type of communication and relays the information back to the criminals.

A replay attack occurs when an attacker captures a portion of a communication between two hosts and then retransmits the captured message later. Replay attacks circumvent authentication mechanisms.

Zero-Day Attacks

A zero-day attack, sometimes referred to as a zero-day threat, is a computer attack that tries to exploit software vulnerabilities that are unknown or undisclosed by the software vendor. The term zero hour describes the moment when someone discovers the exploit. During the time it takes the software vendor to develop and release a patch, the network is vulnerable to these exploits, as shown in the figure. Defending against these fast-moving attacks requires network security professionals to adopt a more sophisticated view of the network architecture. It is no longer possible to contain intrusions at a few points in the network.

Keyboard Logging

Keyboard logging is a software program that records or logs the keystrokes of the user of the system. Criminals can implement keystroke loggers through software installed on a computer system or through hardware physically attached to a computer. The criminal configures the key logger software to email the log file. The keystrokes captured in the log file can reveal usernames, passwords, websites visited, and other sensitive information.

Keyboard loggers can be legitimate, commercial software. Parents often purchase key logger software to track the websites and behavior of children using the Internet. Many anti-spyware applications are able to detect and remove unauthorized key loggers. Although keylogging software is legal, criminals use the software for illegal purposes.

Activity - Identify Cyber Attacks

Defending Against Attacks

An organization can take a number of steps to defend against various attacks. Configure firewalls to discard any packets from outside of the network that have addresses indicating that they originated from inside the network. This situation does not normally occur, and it indicates that a cybercriminal attempted a spoofing attack.

To prevent DoS and DDoS attacks, ensure patches and upgrades are current, distribute the workload across server systems, and block external Internet Control Message Protocol (ICMP) packets at the border. Network devices use ICMP packets to send error messages. For example, the ping command uses ICMP packets to verify that a device can communicate with another on the network.

Systems can prevent falling victim to a replay attack by encrypting traffic, providing cryptographic authentication, and including a time stamp with each portion of the message. Click here to learn more about ways to prevent cyber attacks.

Grayware and SMiShing

Grayware is becoming a problem area in mobile security with the popularity of smartphones. Grayware includes applications that behave in an annoying or undesirable manner. Grayware may not have recognizable malware concealed within, but it still may pose a risk to the user. For example, Grayware can track the user’s location. The authors of grayware usually maintain legitimacy by including an application’s capabilities in the small print of the software license agreement. Users install many mobile apps without really considering their capabilities.

SMiShing is short for SMS phishing. It uses Short Message Service (SMS) to send fake text messages. The criminals trick the user into visiting a website or calling a phone number. Unsuspecting victims may then provide sensitive information such as credit card information. Visiting a website might result in the user unknowingly downloading malware that infects the device.

Rogue Access Points

A rogue access point is a wireless access point installed on a secure network without explicit authorization. A rogue access point can be set up in two ways. The first is when a well-intentioned employee is trying to be helpful by making it easier to connect mobile devices. The second way is when a criminal gains physical access to an organization by sneaking in and installs the rogue access point. Since both are unauthorized, both pose risks to the organization.

A rogue access point can also refer to a criminal’s access point. In this instance, the criminal sets up the access point as a MitM device to capture login information from users.

An Evil Twin attack uses the criminal’s access point improved with higher power and higher gain antennas to look like a better connection option for users. After users connect to the evil access point, the criminals can analyze traffic and execute MitM attacks.

RF Jamming

Wireless signals are susceptible to electromagnetic interference (EMI), radio-frequency interference (RFI), and may even be susceptible to lightning strikes or noise from fluorescent lights. Wireless signals are also susceptible to deliberate jamming. Radio frequency (RF) jamming disrupts the transmission of a radio or satellite station so that the signal does not reach the receiving station.

The frequency, modulation, and power of the RF jammer needs to be equal to that of the device that the criminal wants to disrupt in order to successfully jam the wireless signal.

Bluejacking and Bluesnarfing

Bluetooth is a short-range, low-power protocol. Bluetooth transmits data in a personal area network, or PAN, and can include devices such as mobile phones, laptops, and printers. Bluetooth has gone through several version releases. Easy configuration is a characteristic of Bluetooth, so there is no need for network addresses. Bluetooth uses pairing to establish the relationship between devices. When establishing the pairing, both devices use the same passkey.

Bluetooth vulnerabilities have surfaced, but due to the limited range of Bluetooth, the victim and the attacker need to be within range of each other.

• Bluejacking is the term used for sending unauthorized messages to another Bluetooth device. A variation of this is to send a shocking image to the other device.
• Bluesnarfing occurs when the attacker copies the victim's information from his device. This information can include emails and contact lists.

WEP and WPA Attacks

Wired Equivalent Privacy (WEP) is a security protocol that attempted to provide a wireless local area network (WLAN) with the same level of security as a wired LAN. Since physical security measures help to protect a wired LAN, WEP seeks to provide similar protection for data transmitted over the WLAN with encryption.

WEP uses a key for encryption. There is no provision for key management with WEP, so the number of people sharing the key will continually grow. Since everyone is using the same key, the criminal has access to a large amount of traffic for analytic attacks.

WEP also has several problems with its initialization vector (IV) which is one of the components of the cryptographic system:

• It is a 24-bit field, which is too small.
• It is cleartext, which means it is readable.
• It is static so identical key streams will repeat on a busy network.

Wi-Fi Protected Access (WPA) and then WPA2 came out as improved protocols to replace WEP. WPA2 does not have the same encryption problems because an attacker cannot recover the key by observing traffic. WPA2 is susceptible to attack because cyber criminals can analyze the packets going between the access point and a legitimate user. Cyber criminals use a packet sniffer and then run attacks offline on the passphrase.

Defending Against Wireless and Mobile Device Attacks

There are several steps to take to defend against wireless and mobile device attacks. Most WLAN products use default settings. Take advantage of the basic wireless security features such as authentication and encryption by changing the default configuration settings.

Restrict access point placement with the network by placing these devices outside the firewall or within a demilitarized zone (DMZ) which contains other untrusted devices such as email and web servers.

WLAN tools such as NetStumbler may discover rogue access points or unauthorized workstations. Develop a guest policy to address the need when legitimate guests need to connect to the Internet while visiting. For authorized employees, utilize a remote access virtual private network (VPN) for WLAN access.

Cross-Site Scripting

Cross-site scripting (XSS) is a vulnerability found in web applications. XSS allows criminals to inject scripts into the web pages viewed by users. This script can contain malicious code.

Cross-site scripting has three participants: the criminal, the victim, and the website. The cyber-criminal does not target a victim directly. The criminal exploits vulnerability within a website or web application. Criminals inject client-side scripts into web pages viewed by users, the victims. The malicious script unknowingly passes to the user's browser. A malicious script of this type can access any cookies, session tokens, or other sensitive information. If criminals obtain the victim’s session cookie, they can impersonate that user.

Code Injection

One way to store data at a website is to use a database. There are several different types of databases such as a Structured Query Language (SQL) database or an Extensible Markup Language (XML) database. Both XML and SQL injection attacks exploit weaknesses in the program such as not validating database queries properly.

XML Injection

When using an XML database, an XML injection is an attack that can corrupt the data. After the user provides input, the system accesses the required data via a query. The problem occurs when the system does not properly scrutinize the input request provided by the user. Criminals can manipulate the query by programming it to suit their needs and can access the information on the database.

All sensitive data stored in the database is accessible to the criminals and they can make any number of changes to the website. An XML injection attack threatens the security of the website.

SQL Injection

The cybercriminal exploits a vulnerability by inserting a malicious SQL statement in an entry field. Again, the system does not filter the user input correctly for characters in an SQL statement. Criminals use SQL injection on websites or any SQL database.

Criminals can spoof an identity, modify existing data, destroy data, or become administrators of the database server.

Buffer Overflow

A buffer overflow occurs when data goes beyond the limits of a buffer. Buffers are memory areas allocated to an application. By changing data beyond the boundaries of a buffer, the application accesses memory allocated to other processes. This can lead to a system crash, data compromise, or provide escalation of privileges.

The CERT/CC at Carnegie Mellon University estimates that nearly half of all exploits of computer programs stem historically from some form of buffer overflow. The generic classification of buffer overflows includes many variants, such as static buffer overruns, indexing errors, format string bugs, Unicode and ANSI buffer size mismatches, and heap overruns.

Remote Code Executions

Vulnerabilities allow a cybercriminal to execute malicious code and take control of a system with the privileges of the user running the application. Remote code execution allows a criminal to execute any command on a target machine.

Take, for example, Metasploit. Metasploit is a tool for developing and executing exploit code against a remote target. Meterpreter is an exploit module within Metasploit that provides advanced features. Meterpreter allows criminals to write their own extensions as a shared object. Criminals upload and inject these files into a running process on the target. Meterpreter loads and executes all of the extensions from memory, so they never involve the hard drive. This also means that these files fly under the radar of antivirus detection. Meterpreter has a module for controlling a remote system’s webcam. Once a criminal installs Meterpreter on the victim’s system, he or she can view and capture images from the victim’s webcam.

ActiveX Controls and Java

When browsing the web, some pages may not work properly unless the user installs an ActiveX control. ActiveX controls provide the capability of a plugin to Internet Explorer. ActiveX controls are pieces of software installed by users to provide extended capabilities. Third parties write some ActiveX controls and they may be malicious. They can monitor browsing habits, install malware, or log keystrokes. ActiveX controls also work in other Microsoft applications.

Java operates through an interpreter, the Java Virtual Machine (JVM). The JVM enables the Java program’s functionality. The JVM sandboxes or isolates untrusted code from the rest of the operating system. There are vulnerabilities, which allow untrusted code to go around the restrictions imposed by the sandbox. There are also vulnerabilities in the Java class library, which an application uses for its security. Java is the second biggest security vulnerability next to Adobe’s Flash plugin.

Defending Against Application Attacks

The first line of defense against an application attack is to write solid code. Regardless of the language used, or the source of outside input, prudent programming practice is to treat all input from outside a function as hostile. Validate all inputs as if they were hostile.

Keep all software including operating systems and applications up to date, and do not ignore update prompts. Not all programs update automatically. At the very least, select the manual update option. Manual updates allow users to see exactly what updates take place.

Activity - Identify Types of Application and Web Attacks

Ref : [1]