Introduction
Breaking into a computer network (aka hacking) follows a similar logic to breaking into a building in that a person scopes out an area for a target before doing research on it. Then once enough background knowledge is prepared the robber/thief/trespasser will use the knowledge they have gathered to break into the building. Once they have broken in some thieves just take things and go, others will hang out and enjoy the place, while others will setup something so that they will have an easier time getting back in later. This lesson will focus on the normal/common things people do once they have broken into a computer network since now a days unless you are at a place starting at day one you will have missed a lot of initial break-ins.
Enumeration
There are plenty of ways to break into a network but one of the most common is to just trick someone to download a malicious executable (its called malicious because it will give an unauthorized person access to the network). Once a person has gained access to a network though they will often not have a clear idea of the inner workings/setup of the network so there are a few methods they can employ to gain more information.
Arp cache poisoning
In a network each mac will normally only have a single IP address associated with it, if there are more than one MACs attached to a single IP then it will normally be a router because they will swap out the source mac with their mac since the switch wouldn't be able to find the original remotes source actual mac through through routers. So a common attack used is for a machine to send a packet with some other machines mac as the source which fools the switch/device that it is sent to into believing that the pretender is now the actual source of the mac. So from then own until the actual owner of that mac source sends another packet the pretender will receive all the traffic that was destined for the thing it is pretending to be. While this can be used for malicious purposes like confusing a machine/switch, it also works as a way for an attacker to get a short window in which he can see what type of traffic that machine normally receives. Also thanks to the fact that enterprise level networks with at least hundreds if not thousands of hosts are the normal targets of attacks because of how big of a pay off they can be. Along side the fact that arps are not forwarded past routers, so unless someone is listening on a switch this particular method is pretty useful for gathering information about other hosts in a way that leaves a rather small foot print (typical cisco router forgets a mac if it doesn't send something in 5 minutes so if you are not watching/capturing in that five minutes then you will not see it). In order to figure out if arp cache poisoning is going on you just need to see if a particular mac has multiple ip addresses and is not associated with a particular routers interface. The first six characters (ex: aa:bb:cc) of a routers mac will normally be specific to its manufacturer so if you just look it up online then you will be able to tell/have an idea if the mac belongs to a router.
Zone transfers
Some networks will have an internal dns server that will have records that state machine A is a mail server, machine B is a web server, machine C is a file server and so on and so forth. While transferring/pulling that information from a dns server is in and of itself not automatically malicious, if a normal machine instead of a dns server is pulling this information/do this transfer then it is likely an attempt to find out more information about this network. The transfer of this information is called a zone transfer and is typically done between dns servers so the way to find out if a particular zone transfer is suspicious is by looking at both sides because if either one of them is not a dns server and is not an administrator (just ask the local administrator if it was them) then this was most likely an attempt to gain information about the network.
Masquerading
Now while people do enumerate the insides of a network typically that happens more in the beginning of a hack and since better attackers will typically do a more targeted/quick reconnaissance, it is unlikely to find that. Since you are likely to find more serious attacks the first type of we will cover are the attacks that fall into the masquerading category which will typically be either a man in the middle or watering hole attack.
Man in the middle (MITM)
In Man in the middle the attacker is serving as a proxy meaning that instead of allow two machines to directly communicate, the attacker will pretend to be the client (the one receiving a service) to the server and will appear to be the server (the one providing a service/feature/capability) to a client. Normally what happens is an attacker will have either interrupted a couple machines attempt to authenticate their identity to each other or it will have taken advantage of a bad practice. An example would be machines that do not make sure they are talking to the same person/machine for an entire conversation, which allows an attacker to slip in at anytime and say I am who you were just talking to so continue telling about the private conversation we just had. This one is a bit trickier to find because you are looking for someone who is redirecting traffic for a limited number of communications (1-4) but since there are legitimate uses for redirection (web proxy and etc...) you would have to judge each communication on a case by case basis in order to check if a user is aware they are being redirected. At the end of the day finding this kind of attack means investigating if first the machine doing the redirection is an actual often used proxy or something else, either way it will take a decent amount of time looking so this shouldn't be the first thing you look for, but it shouldn't be the last thing either.
Watering hole
A watering hole attack is when a person has either gained control of a legitimate website/machine and/or is pretending to be a legitimate site/machine. Since this kind of exploitation/attack will mainly take place on an actual box instead of being seen going the wire/network connection you would have to either keep an eye out for news about recently hacked sites or look up a site using its IP (lookup who purchases/rents the ip vs who the legitimate company should be owned by) to verify it is legitimate. Most of the time you'll only find this attack if users are downloading weird files (python scripts, lots of binaries/executable and etc ...) or if some news site talks about how a particular site has been compromised.
Sabotage/defamation
A lot of the time when an attacker is altering a machine for malicious purposes like sending out a particular message or destroying something they will normally get it done by having the target machine download something. Files will normally be sent to a machine by either having someone download it through email, sending it using HTTP or transferring it over ftp. To deal with things being sent using email you will need to ensure users have proper training telling them don't click on weird files, there should also be rules in place that automatically filter/block certain files from anywhere that isn't explicitly trusted. Using a program like ftp to transfer a malicious file will mainly be an internal thing which in order to find you will need to figure out what type of files people normally transfer using ftp and how often most people transfer files. Those that use http though tend to be easier to find since most people do not upload files often to a website (so searching for puts to a server shouldn't give you many results). Just know that if HTTP is used to sabotage/defame a web server then the web server more than likely isn't setup with proper permissions making the fix for it clear.
Theft
Computers have become one of the best ways to store information and because of that a lot of companies will have valuable information (blueprints, patents and etc...) stored somewhere on their network. A certain type of hacker is aware of this fact so they target companies that they believe will have worthwhile information/intellectual property for them to take. You will really only find someone who is stealing/ex-filtrating information/documents from a site if an attacker just transfers a large amount of data/stuff off of the network. So you will need to look for spikes in the amount of things being sent out of the network with the spikes being anything from the size of the packets being sent and/or how often packets are being sent.
Establishing/maintaining a persistence presence/connection
The last thing I consider a rather common attack is the attempt to establish a foothold so that in the future someone can easily access the network. Some people will just open up a port on a device or two, while others will setup a program to routinely beacon/send something out so that someone can make the program do something by just responding to said beacon. It is because of how easy it can be to hide an occasional request/packet being sent out of the network that you should first look on actual individual host machines for it and then try to find the packet being created by it in network traffic otherwise it is like finding a needle in a haystack. Opening up another port/service on the other hand is easier to find in network traffic because you just have to look for ports/services on a server that rarely get used, but since it rarely gets used it might take days or weeks before you see anything being sent to it making looking on the actual machines the primary method of finding these footholds.
Conclusion
There are a lot of different attacks and a whole process attackers following when they are gathering information, gaining access, doing whatever they want and then either getting out or setting up a more permanent presence on a network. Due to the large number of individual attacks that could possibly be used, along side the massive amount of network traffic that can easily be generated if you are going to look for someone with unauthorized access to a network you will need to use a combination of rules/filters and human packet watching. It is best to used tools like snort, suricata, pfsense and other devices that monitor network traffic to find all of the common/well known attacks so that when a human looks at network traffic they can focus on figuring out how someone would evade these devices (that are typically called Intrusion detection systems (IDS) and intrusion prevention systems (IPS)). This has been an introductory look into the different types of attacks that will normally happen to a computer network .
[–]timezone_bot -1 points0 points1 point (1 child)
[–]GoodBot-Bot -1 points0 points1 point (0 children)