Network protocols are vulnerable to attacks!

All protocols have an attack surface
Attack surface is the set of vulnerabilities
Hackers exploit these vulnerabilities
Protocol designers must anticipate attacks

What are some common attacks on computer networking protocol?

Interception attacks
Network layer attacks
Internet layer attacks
Name-resolution attacks
Web-based attacks

Attacking the MAC Address

MAC Spoofing/Cloning
- Attacker changes a device’s MAC address
- Now possible to bypass network access controls
- Enables the impersonation of legitimate devices

MAC Flooding
- Switches track MAC to IP address mapping
- Overloads the switch with fake MAC addresses
- Compromises network performance

Attack performed at the network layer
Exploits the inherent weaknesses of MAC addresses
How can we mitigate this type of attack?

Mitigating the MAC Address Attacks

Port Security
- Configure switch ports to allow only specific MAC addresses
- Limit the number of MAC addresses per port
- Use sticky MAC addresses to learn and restrict MAC addresses
802.1X Authentication
- Network access controls to authenticate devices before network access
- Ensure that only authorized devices can connect to the network
VLAN Segmentation
- Segment the network into smaller VLANs
- Limit the broadcast domain and reduce the impact of MAC spoofing

Combine application and transport layer security to achieve a network that is more secure overall! Nice!

What are the greatest security vulnerabilities at the application level of the network protocol stack? How to control?

Let’s talk about prominent types of injection attacks at the application layer!

Cross-site scripting attacks
SQL injection attacks

Remote Code Execution

Gives attacker ability to run arbitrary code
Start a shell with administrative privileges
Gains full control of the system, its users, and data
The “launching pad” for attacks like a denial of service

The buffer overflow attack is a common method for achieving remote code execution! What is it? How can we prevent this attack?

Privilege Escalation

Details about the attack
- Gain access to protected resources
- Example: CVE-2021-4034 in Linux pkexec
- Exploit gives regular user a root shell

Methods of privilege escalation
- Credential exploitation
- Vulnerabilities or misconfigurations
- Social engineering

Privilege escalation types
- Horizontal: move between user accounts
- Vertical: gain higher-level access (e.g., user to admin)

Can we build a network monitoring tool?

Client sends messages to server
Server receives messages from clients
Intercept network communication
Client and server are not aware!

Network Monitoring Tool

Let’s build a client and a server and intercept network communication!
networkmonitor start a process in one of these modes:
- Client and Server Protocols:
  - Socket Server: Start a server using sockets
  - Socket Client: Start a client using sockets
  - XML-RPC Server: Start a server using XML-RPC
  - XML-RPC Client: Start a client using XML-RPC
- Interception Mechanisms:
  - Socket Interception: Intercept socket network communication
  - XML-RPC Interception: Intercept XML-RPC network communication
See the course web site’s project description for more details!

Networking Attacks

Network protocols are vulnerable to attacks!

Network Protocol Lifecycle

What are some common attacks on computer networking protocol?

“Man-in-the-Middle” Attack

Replays and One-Time Passwords

Attacking the MAC Address

Mitigating the MAC Address Attacks

IP Spoofing

Combine application and transport layer security to achieve a network that is more secure overall! Nice!

DNS Cache Poisoning

What are the greatest security vulnerabilities at the application level of the network protocol stack? How to control?

OWASP Top Ten

Let’s talk about prominent types of injection attacks at the application layer!

Cross-Site Scripting (XSS)

SQL Injection Attacks

Outcomes from Successful Attacks

Remote Code Execution

Privilege Escalation

Denial of Service (DoS)

Can we build a network monitoring tool?

Network Monitoring Tool

Summary of Network Security Attacks

Key Concepts

Studied Protocols

Key Concepts

Best Practices

Implementation

Exploration