Speaker 1: Welcome to another deep dive. Today. We're going to be
Speaker 1: looking at network security, yeah, and going beyond the basics
Speaker 1: to really get into some of the practical attack and
Speaker 1: defense techniques. And for this deep dive, we're using the
Speaker 1: book Understanding Network Hacks, Attack and Defense with Python three.
Speaker 1: That's right, Yeah, and it's really cool because it's like
Speaker 1: a hacker's playbook. But we're going to be focusing on
Speaker 1: the defense side of things exactly.
Speaker 2: We're going to try to get into the mind of
Speaker 2: an attacker so you can be better prepared to defend
Speaker 2: your own systems.
Speaker 1: I like it. So we're going to start with some
Speaker 1: of the core networking concepts just to get us all
Speaker 1: on the same page for sure.
Speaker 2: Got to build that foundation.
Speaker 1: Yeah, and then we'll dive into some real world attack
Speaker 1: techniques and how those can be used to exploit vulnerabilities
Speaker 1: in different well, I guess network protocols, right, Yeah. So
Speaker 1: let's start with something I think most people think is
Speaker 1: pretty secure. Ethernet. Okay, those physical cables, you know, plugged in,
Speaker 1: what could go wrong?
Speaker 2: Right? You would think that, right, Yeah, But every device
Speaker 2: on an Ethernet network has what's called a massy address
Speaker 2: and it's like a unique identifier for that device.
Speaker 1: Yeah, like a digital fingerprint. I've heard it.
Speaker 2: Called exactly, And a lot of people assume those are unspoofable,
Speaker 2: so to speak.
Speaker 1: Wait, spoofed. Hold on, how is that even possible? I
Speaker 1: thought MC addresses were hard coded into the hardware.
Speaker 2: They are, but an attacker can still send out data
Speaker 2: packets that make it look like it's coming from a
Speaker 2: different MC address. Okay, So they could pretend to be
Speaker 2: your printer for example. Oh sneaky, and your computer wouldn't
Speaker 2: know the difference.
Speaker 1: Oh wow.
Speaker 2: So that's why AMT address filtering by itself isn't enough
Speaker 2: for security.
Speaker 1: So even if you have a list of approved devices,
Speaker 1: someone could still slip through by faking their ID.
Speaker 2: Precisely. It shows how we need multiple layers of security.
Speaker 1: You know, there's a little unsettling.
Speaker 2: Yeah. And another thing about Ethernet is how it handles
Speaker 2: all the traffic. It uses this thing called CSMACD.
Speaker 1: Okay, what is that? Exactly?
Speaker 2: It stands for a Carrier Sense multiple Access with Collision
Speaker 2: detect and basically it's how Ethernet avoids those data collisions,
Speaker 2: you know, when multiple devices try to send stuff at
Speaker 2: the same time.
Speaker 1: Okay, so it keeps things running smoothly. Yeah. Does that
Speaker 1: have any impact on security though not directly.
Speaker 2: But it's important to remember that while it manages the
Speaker 2: flow of traffic, it doesn't actually prevent attackers from sniffing
Speaker 2: that data.
Speaker 1: Sniffing, yeah, like listening in on conversation exactly.
Speaker 2: All that data going across the network is traveling in
Speaker 2: these little packets, and anyone with the right tools and
Speaker 2: access can capture and analyze those packets.
Speaker 1: Okay, So what about VLANs then, aren't they supposed to
Speaker 1: like segment the network and add an extra layer of security.
Speaker 2: Yeah, a lot of people think that. Okay, but it's
Speaker 2: kind of a myth. VLANs are great for network management,
Speaker 2: but they don't offer that hardcore security that some people expect.
Speaker 2: An attacker can jump between VLANs using certain techniques, you know,
Speaker 2: and totally bypass those separations.
Speaker 1: You mean, even with VLANs in place, shouldn't get complacent
Speaker 1: about security.
Speaker 2: Absolutely, you need other security measures, you know, like firewalls,
Speaker 2: intrusion detection systems, that kind of thing to really lock
Speaker 2: things down.
Speaker 1: Okay, So before we go any further, I think we
Speaker 1: should back up a bit. Okay, how do devices actually
Speaker 1: find each other on a network.
Speaker 2: Ah. That's where ARP comes in, the Just Resolution protocol.
Speaker 2: It's how devices figure out each other's MC addresses.
Speaker 1: Right right, Because you might know a device's IP address,
Speaker 1: but you need its MSI address to actually, you know,
Speaker 1: send it data exactly.
Speaker 2: So your computer will send out what's called an ARP
Speaker 2: request okay, And it's basically like saying, hey, who has
Speaker 2: this IP, what's your MC and then the device with
Speaker 2: that IP address will respond with its MC address.
Speaker 1: Okay. What's the security problem there?
Speaker 2: Well, this whole process relies on trust, right, And what
Speaker 2: if an attacker sends out fake ARP.
Speaker 1: Responses, Oh, I see where you're going with this?
Speaker 2: They can poison the ARP cash you know, and then
Speaker 2: other devices believe that the attacker's MC address is the
Speaker 2: real one, so.
Speaker 1: The attacker can trick devices into sending their traffic to
Speaker 1: the wrong place exactly.
Speaker 2: That sets the stage for all sorts of attacks like
Speaker 2: man in the middle, where the attacker sits between two devices,
Speaker 2: listening in and even messing with the data.
Speaker 1: Man, this is getting interesting. It's crazy how even the
Speaker 1: most basic network processes have these vulnerabilities just lurking under
Speaker 1: the surface.
Speaker 2: Yeah, it really is.
Speaker 1: I am ready to dive deeper into these attack techniques.
Speaker 2: Let's do it.
Speaker 1: So we talked about ARP and how attackers can manipulate
Speaker 1: that whole process to get themselves in a prime position, right,
Speaker 1: So now I want to know what they can actually
Speaker 1: de with that access.
Speaker 2: Okay, Well, once they're there, you know, kind of sitting
Speaker 2: in the middle of everything, one of their favorite tools
Speaker 2: is sniffing. Sniffing, Yeah, they can actually capture the data
Speaker 2: packets as they're flowing between those two devices.
Speaker 1: So like a digital eavesdropper exactly. Okay, but would an
Speaker 1: encryption stop them in their tracks.
Speaker 2: It makes it a lot harder, that's for sure, but
Speaker 2: it's not foolproof. Think of it this way. Even if
Speaker 2: they can't read the actual message because it's all scrambled, right,
Speaker 2: they can still see things like the source and destination
Speaker 2: IP addresses, you know, okay, how much data is being sent,
Speaker 2: what protocols are being used, that kind of thing.
Speaker 1: So even encrypto traffic leave some kind of footprint.
Speaker 2: Exactly, and that can tell them a lot about what's
Speaker 2: going on.
Speaker 1: So like who you're talking to, what websites you're visiting, exactly,
Speaker 1: what kind of information is being exchanged.
Speaker 2: Yeah, all of that, and there are really powerful tools
Speaker 2: out there like TCP dump and wire shark that can
Speaker 2: capture all this stuff decode it all in real time.
Speaker 1: Wow.
Speaker 2: The book even shows you how to use like simple
Speaker 2: Python scripts to analyze network traffic.
Speaker 1: So it's not just about stealing passwords anymore. No, attackers
Speaker 1: can actually glean a lot of intelligence from patterns in
Speaker 1: network traffic.
Speaker 2: Absolutely wow. Okay, Now let's move on to IP spoofing. Okay,
Speaker 2: this is where the attacker basically disguises themselves as another
Speaker 2: device on the network.
Speaker 1: But wouldn't the system, you know, be able to tell
Speaker 1: that that IP addresses fake?
Speaker 2: Well, the Internet relies on a lot of trust, you know,
Speaker 2: and attackers exploit that, right, So they carefully craft packets
Speaker 2: make it look like that traffic is coming from a
Speaker 2: legitimate source.
Speaker 1: It's like a digital mask.
Speaker 2: Yeah pretty much.
Speaker 1: Okay, So then what can they do with that?
Speaker 2: Oh, all sorts of things you know, bypass access controls,
Speaker 2: inject data into the network, even launch a denial of
Speaker 2: service attack.
Speaker 1: A denial of service attack, those are the ones that
Speaker 1: like take websites offline.
Speaker 2: Right, yeah, exactly.
Speaker 1: Okay.
Speaker 2: One example the book covers is something called a s
Speaker 2: yn flood attack. Okay, Now, remember that TCP three way
Speaker 2: handshake we talked about earlier.
Speaker 1: Vaguely remind me how that works again.
Speaker 2: Sure, So it's basically how two devices establish a TCP connection, right,
Speaker 2: uh huh. The client sends a syn packet, the server
Speaker 2: responds with the syn ack packet. Okay, and then the
Speaker 2: client completes the handshake by sending an ack packet.
Speaker 1: Got it.
Speaker 2: Now. In an s yn flood attack, what happens is
Speaker 2: the attacker bombards the server with all these syn packets,
Speaker 2: but they never complete the handshake because.
Speaker 1: They're using spoofed IP addresses exactly.
Speaker 2: So the server gets all bogged down with all these
Speaker 2: half open connections. Oh and legitimate users can't get through.
Speaker 1: So it's like calling a restaurant and tying up all
Speaker 1: the lines so that no one else can make a reservation.
Speaker 2: Perfect analogy.
Speaker 1: I like that.
Speaker 2: And these attacks are surprisingly easy to launch. You know,
Speaker 2: the book actually shows you how to write a basic
Speaker 2: syn floodscript in Python.
Speaker 1: No way. Yeah, it's a little alarming.
Speaker 2: It is. But there are ways to defend against these attacks,
Speaker 2: you know, like syn cookies, which is a technique servers
Speaker 2: can use to kind of change up that handshake process
Speaker 2: and make it harder for attackers to exploit it. Okay,
Speaker 2: so there's this constant back and forth between the attackers
Speaker 2: and the defenders.
Speaker 1: Gotcha.
Speaker 2: What attackers can do depends a lot on what doors
Speaker 2: they can find.
Speaker 1: Open doors, you mean, like open ports on a computer.
Speaker 2: Exactly. Every computer has these virtual ports, and each port
Speaker 2: is associated with a specific service like web browsing or email,
Speaker 2: and attackers use something called port scanning to find those
Speaker 2: open and vulnerable ports.
Speaker 1: So they're like checking all the windows and doors to
Speaker 1: see if they can get in.
Speaker 2: Yeah, that's a good way to put it. They use
Speaker 2: tools to probe different ports and see which ones are
Speaker 2: open and listening. Okay, and once they find one, they
Speaker 2: can start exploring for weaknesses in that service.
Speaker 1: It's like casing the joint, you know, like a burglar
Speaker 1: figuring out how to break in exactly. Wow. Okay, so
Speaker 1: we've seen how attackers can spy on traffic right impersonaid devices,
Speaker 1: overload systems. Now I want to know what happens when
Speaker 1: they're actually inside the network.
Speaker 2: Well, one thing they can do is something called session hijacking. Okay,
Speaker 2: This is where they take over an existing connection between
Speaker 2: two parties.
Speaker 1: Like if I'm logged into my bank account, yeah, exactly,
Speaker 1: and an attacker can just jump in there.
Speaker 2: They can try to insert themselves into that session, so.
Speaker 1: They could see everything I'm doing. Potentially it even like
Speaker 1: make transactions or something.
Speaker 2: That's the danger.
Speaker 1: Yeah, yeah, well that's terrifying. But how do they actually
Speaker 1: do that.
Speaker 2: There's a few different techniques. One common one is exploiting
Speaker 2: weaknesses in how the session is managed. You know, like
Speaker 2: if a website doesn't properly validate those session IDs, an
Speaker 2: attacker might be able to guess or steal one and
Speaker 2: then use it to impersonate you.
Speaker 1: It sounds like they're stealing your digital identity in a way. Yeah, gosh,
Speaker 1: this is heavy stuff. It seems like everywhere you turn
Speaker 1: there's another vulnerability.
Speaker 2: It can seem that way. But don't worry. We're not
Speaker 2: done yet. We've got to talk about specific protocols like DNS, HTTP, HGTPS,
Speaker 2: even Wi Fi and Bluetooth. Lots more to uncover there.
Speaker 1: All right, let's do it, all right, let's dive into
Speaker 1: some of those specific protocols out DNS for starters, It's
Speaker 1: like the Internet's phone book. It translates those domain names
Speaker 1: into IP addresses exactly. But how is that vulnerable to attack?
Speaker 2: Well, it's actually pretty fascinating how such a you know,
Speaker 2: fundamental system can have these weaknesses. One really common attack
Speaker 2: is DNS spoofing. Imagine you're trying to go to your
Speaker 2: bank's website, right right. An attacker could intercept that DNS
Speaker 2: request that your computer sends out and send back a
Speaker 2: fake response, redirecting you to a malicious site that looks
Speaker 2: exactly like the real deal.
Speaker 1: So you could end up entering your login and password
Speaker 1: on a fake site and not even.
Speaker 2: Know it exactly. That's the whole danger there. Wow, And
Speaker 2: you know the book goes beyond just that basic DNS
Speaker 2: spoofing too, really Yeah, it gets into some lesser known
Speaker 2: but just as dangerous attacks. Oh like what, Well, there's
Speaker 2: one called DNS dictionary mapping, okay, and this is a
Speaker 2: way for attackers to basically, you know, gather intel on
Speaker 2: a network. They use DNS queries to scan for servers
Speaker 2: within an organization, almost like they're trying to map out
Speaker 2: the entire structure of the network.
Speaker 1: So they're like scoping out the play.
Speaker 2: Exactly like a digital burglar, you know, looking for potential targets,
Speaker 2: weak points.
Speaker 1: Wow, okay, and then.
Speaker 2: There's the zone transfer attack.
Speaker 1: What's that?
Speaker 2: This is where an attacker tries to actually download and
Speaker 2: entire domains DNS records so.
Speaker 1: They get like a blueprint of the whole infrastructure.
Speaker 2: Yeah, basically that's wild.
Speaker 1: Okay. Moving on to HTTP. Right, that's the protocol that
Speaker 1: powers the web. But I always hear about how it's
Speaker 1: transmitting data in plain text, which seems like a huge
Speaker 1: E security risk.
Speaker 2: Well, it definitely can be, especially when you're dealing with
Speaker 2: things like passwords and credit card numbers.
Speaker 1: Right.
Speaker 2: The book actually walks you through the anatomy of an
Speaker 2: HTTP request okay, breaks down the different methods like EET, post,
Speaker 2: and head, and it talks about those little text files
Speaker 2: that website store on your computer, you know, cookies.
Speaker 1: Cookies.
Speaker 2: A lot of people think they're totally harmless, but I mean,
Speaker 2: what's the risk. They can be used to track your
Speaker 2: browsing activity and they often store sensitive information like session IDs. Right,
Speaker 2: so an attacker who gets their hands on your cookies
Speaker 2: could do some damage. Like what, Well, they could manipulate
Speaker 2: the data, try to gain unauthorized access even hijack your
Speaker 2: entire session.
Speaker 1: Hold on session hijacking again, Yep, it's a big one.
Speaker 1: So like they could take over my online banking session.
Speaker 2: It's possible.
Speaker 1: Yeah, man, this is scary stuff.
Speaker 2: It is. And there's more. The book also covers things
Speaker 2: like directory traversal attacks, where attackers try to access files
Speaker 2: outside the web directory could be sensitive stuff in there.
Speaker 2: Then you got your sqel injection attacks, command injection attacks.
Speaker 1: So many ways to attack.
Speaker 2: Yeah, web developers have a lot to worry about. But hey,
Speaker 2: at least we have HTTPS now right right, A little padlock.
Speaker 1: In your browser that makes me feel safe.
Speaker 2: Definitely a huge improvement. It uses something called ssltls uh
Speaker 2: huh to encrypt that channel between your browser and the website.
Speaker 1: Okay, but here's the thing.
Speaker 2: Even HTTPS can be vulnerable.
Speaker 1: Wait seriously, So even that padlock is in a guarantee
Speaker 1: unfortunately not.
Speaker 2: It all comes down to how it's implemented. See the
Speaker 2: book talks about certificate a thought. Okay, those are the
Speaker 2: organizations that issue the digital certificate.
Speaker 1: Right to verify that a website is legitimate.
Speaker 2: Exactly, and if one of those CAAs gets compromised, they
Speaker 2: can issue fake certificates.
Speaker 1: So you can have a padlock, think everything's safe, and
Speaker 1: still be vulnerable exactly.
Speaker 2: And that's how man in the middle attacks can still
Speaker 2: happen even with https.
Speaker 1: Gosh, that's unsettling. Is it even possible to stay safe online?
Speaker 2: Well, it takes vigilance, for sure, keeping your browser, your
Speaker 2: operating system up to date with those security patches, right,
Speaker 2: being careful about what websites you visit, what information you
Speaker 2: share online, okay, and of course using strong, unique passwords
Speaker 2: for every account makes sense.
Speaker 1: It sounds like it's this constant arms race.
Speaker 2: You know it is in a way. Wow, the attackers
Speaker 2: are always trying to find new exploits and the defenders, well,
Speaker 2: we got to stay one step ahead, all right.
Speaker 1: So we've covered wired networks the web. What about Wi Fi?
Speaker 2: Ah? Wi Fi?
Speaker 1: I use it all the time, but I gotta admit
Speaker 1: I don't really understand how it works.
Speaker 2: Well. Wi Fi uses the ATO two two point one
Speaker 2: one protocol, okay, and the book digs into how that works,
Speaker 2: explores the different ways it can be attacked. Well, there's
Speaker 2: those probe requests and responses. It's basically how devices discover
Speaker 2: Wi Fi networks and connect to them.
Speaker 1: So like a little digital handshake.
Speaker 2: Yeah exactly, but attackers can actually set up these fake
Speaker 2: access points oh wow, mimic legitimate networks to try and
Speaker 2: trick your device into connecting.
Speaker 1: So how do you know if a network is the
Speaker 1: real deal?
Speaker 2: It can be tough, you know, look for strong passwords,
Speaker 2: make sure encryption is enabled, right, and be extra careful
Speaker 2: on those public Wi Fi networks, especially the ones that
Speaker 2: don't have any password protection.
Speaker 1: Yeah, that makes sense.
Speaker 2: And speaking of passwords, remember those different Wi Fi security protocols.
Speaker 1: Oh we got like WEPWPA two right, The book talks
Speaker 1: about how Wi Fi security has evolved over time.
Speaker 2: WEP is totally outdated, easy to crack. Okay, WPA was
Speaker 2: a step up, and WPA two with AES encryption is
Speaker 2: the most secure right now. But even WPA two has
Speaker 2: its vulnerabilities seriously, especially if it's not configured properly.
Speaker 1: So keeping my routers firm where updated is important.
Speaker 2: Absolutely and definitely disable WPS if you can ws. Yeah,
Speaker 2: WiFi protect it setup. It's supposed to make things easier,
Speaker 2: but it can actually make your network easier to hack.
Speaker 1: Gotcha, okay, last one Bluetooth Okay, it's short range, right,
Speaker 1: so are there really any serious security.
Speaker 2: Risks, you'd be surprised. Bluetooth has its own set of vulnerabilities.
Speaker 2: The book breaks down that whole Bluetooth protocol stack, explains
Speaker 2: how attackers can sniff those communications, exploit weaknesses and things
Speaker 2: like the obx protocol, which is used for file transfers
Speaker 2: a lot.
Speaker 1: Wait, so even my wireless headphones could be a security risk.
Speaker 2: They could be. Yeah, there's attacks like bluejacking where someone
Speaker 2: sends you spam messages. Oh yeah, blue snarfing where they
Speaker 2: try to steal your information, and even more advanced attacks
Speaker 2: like bias, knob and blueborn that target specific vulnerabilities and
Speaker 2: how Bluetooth is implemented.
Speaker 1: Wow, so much to think about. It really seems like
Speaker 1: every aspect of networking has its own unique set of challenges.
Speaker 2: It's true, but hey, knowledge is power, right, That's what
Speaker 2: they say. Understanding these attack techniques is the first step
Speaker 2: in defending yourself.
Speaker 1: I feel like I've learned so much in this deep dive.
Speaker 1: It's really been eye opening.
Speaker 2: I'm glad to hear that. And remember this is just
Speaker 2: scratching the surface, I know, right, There's always more to learn,
Speaker 2: and things are always changing in the world. Of cybersecurity,
Speaker 2: that's for sure, So stay curious, stay informed, and most importantly,
Speaker 2: stay safe.
Speaker 1: Great advice and for our listeners, if any of this
Speaker 1: sparked your interest, I highly recommend checking out Understanding Network Hacks,
Speaker 1: Attack and Defense with Python three great book. It's really
Speaker 1: a fascinating read for anyone who wants to delve deeper
Speaker 1: into this world of network security. Definitely, until next time,
Speaker 1: happy hacking the ethical kind of course.