3.1 Network Vulnerabilities and Attacks

New to switches, MAC addresses or DNS? Do the Before Unit 3: Networking Basics side quest first. This topic assumes it.

1. Four common network attacks (3.1.A)

Attack	What the adversary does	What it is an example of
ARP poisoning	sends falsified ARP packets so the default gateway pairs the target’s internet protocol (IP) address with the adversary’s MAC address	an on-path attack, using MAC spoofing
MAC flooding	sends a switch a flood of Ethernet frames, each with a different MAC address	eavesdropping (sniffing)
DNS poisoning	poses as an authoritative name server and plants a fake DNS record	credential harvesting
Smurf attack	sends many Internet Control Message Protocol (ICMP) requests, carrying the victim’s address, to a network’s broadcast address	denial of service (DoS)

ARP poisoning: getting on the path [3.1.A.1]

The default gateway uses ARP to build a table that pairs IP addresses with MAC addresses. In ARP poisoning, the adversary sends the gateway falsified ARP packets so that the target’s IP address is linked to the adversary’s MAC address. Traffic meant for the target now reaches the adversary first. Faking a MAC address like this is MAC spoofing.

This makes ARP poisoning an on-path attack, also called a man-in-the-middle attack. The adversary sits in the data stream between two parties, captures what each sends, and may copy or alter it before passing it on. Both parties believe they are talking directly to each other. Run the ARP poisoning simulator to see the gateway’s table change.

MAC flooding: making a switch broadcast [3.1.A.2]

A switch normally sends each frame only to the port where the destination MAC address lives. In MAC flooding, the adversary sends the switch many Ethernet frames, each with a different MAC address. This can force the switch into broadcast mode, so it sends frames out of every port, and the adversary collects frames meant for other devices. Capturing data in transit to record and copy it is eavesdropping, also called sniffing. Try it in the simulator below.

DNS poisoning: sending users to a fake site [3.1.A.3]

In DNS poisoning, the adversary pretends to be an authoritative name server (NS) and plants a fake DNS record on a DNS server. Browsers that ask that server are redirected to a malicious website built to look like the real login page. Users type their real usernames and passwords, and the adversary captures them. Setting up a fake login site to collect real credentials is credential harvesting.

Smurf attacks: turning a network against a victim [3.1.A.4]

A smurf attack tries to overwhelm a network with ICMP requests. The adversary sends many requests with the victim’s address as the source to the network’s broadcast address. The gateway passes each request to every device on the network, and every device replies to the victim. The flood of replies can block legitimate messages.

• A denial of service (DoS) attack makes a system or resource unavailable to authorized users. A smurf attack is one kind.
• When many devices attack the same target at the same time, it is a distributed denial of service (DDoS) attack.

2. How adversaries exploit network weaknesses (3.1.B)

1. No firewall, or a badly configured one [3.1.B.1]. Adversaries can send malicious traffic into the network to flood it (a DoS), to map its internal structure, or to spoof a legitimate device.
2. One compromised device [3.1.B.2]. Once adversaries control one device, they often use that access to compromise other devices on the same local area network (LAN). This is lateral movement.
3. An open data port [3.1.B.3]. A wall data port leads straight to a switch port. Unless the switch limits which devices each port accepts (port security), anyone who plugs in is on the LAN, ready to launch DoS, MAC flooding or MAC spoofing attacks.
4. A signal that leaves the building [3.1.B.4]. Standing outside a secure space, an adversary can pick up the wireless access point’s signal and beacon frames, learn about the wireless network, and attempt eavesdropping and cryptographic attacks.
5. A network that does not check who joins [3.1.B.5]. Attacking from inside is easier than attacking from outside, so adversaries try to join the network. If the network never asks a device or user to prove who they are, joining is easy.
6. A rogue access point [3.1.B.6]. An adversary plugs a wireless access point into an open network port. The rogue access point gives wireless access to the LAN, possibly from outside the building, and bypasses the firewalls.
7. Weak wireless encryption [3.1.B.7]. Adversaries can try to break wireless encryption, then intercept, steal or compromise data on the network. Topic 3.2 covers strong encryption.

3. Assessing and documenting network risks (3.1.C)

What is at stake [3.1.C.1]. Network vulnerabilities can let adversaries intercept and alter data in transit, launch DoS attacks, or move laterally to more sensitive or critical systems. Each of these threatens confidentiality, integrity or availability.

What the adversary can do	Main goal of security put at risk
intercept data in transit	confidentiality
alter data in transit	integrity
launch a DoS attack	availability
move laterally to critical systems	any of the three, depending on what those systems hold

Finding vulnerabilities [3.1.C.2]. Automated vulnerability scanners check networks, devices and applications for known vulnerabilities. Their reports usually list each vulnerability found, its severity, and how to mitigate it.

Likelihood [3.1.C.3]. Exploiting many network vulnerabilities takes advanced technical ability and knowledge. The harder an exploit is, the lower its likelihood.

Rating the risk [3.1.C.4 to 3.1.C.6]

Rating	What it means	Example (original)
High	an adversary can easily cause significant harm: capture traffic, spoof a legitimate device, or launch a DoS attack	a public library lobby has live data ports with no port security, so anyone can plug in, capture traffic or pose as a staff computer
Moderate	an adversary could gain information about the systems or devices on the network	the network answers unauthenticated scans with a list of device names and operating system versions
Low	hard to exploit, and likely to have little negative impact	a printer’s settings page, reachable only from a locked server room, runs an old version with a flaw that needs rare expertise to use

When you document a risk, state the vulnerability, how likely it is to be exploited (and why), what the impact would be, and the rating that follows.

Where this shows up next

• Protecting networks with policies and wireless security: topic 3.2.
• Segmentation, which limits lateral movement: topic 3.3.
• Firewalls at every point of ingress and egress: topic 3.4.
• Detecting each attack in this topic: topic 3.5.