The last threat that we're going to be talking
about in this skill is a spoofing or man
in the middle attack.
This is going to be a really, really popular one
in the hacker community too because this is where they're
trying to intercept your data as it's traveling across the wire.
So get ready.
We're going to talk about how spoofing really works
and what the man in the middle attack
accomplishes for the hacker.
Let's get going.
Our last attack that we're talking about in this skill
is the spoofing attack, which leads
to a man in the middle attack.
The idea is kind of straightforward.
You've got your end users who are accessing your resources. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
You've got your end users who are accessing your resources.
Maybe it's a file share.
Maybe it's a website.
Maybe they're just logging into their bank.
And the idea is that a bad actor wants to intercept that traffic
as it flows across the wire.
Now, this is really common when they're
trying to steal credit card or bank information.
So your end users think they're going
to be logging into their website site,
but really what they end up logging into
is they log into this hacker's website, which is
made to look identical to it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
made to look identical to it.
And then the hacker may forward the information
on to the server so that it gets all the responses.
Sometimes the purpose of this particular attack,
where the man is in the middle, is they just
want to get information.
Maybe they just want your username and password
and your current account balance or something like that.
So it could just be used to exfiltrate information.
But it could also be used to manipulate information
as it's going through.
So maybe you initiate a transfer of $50 from your checking WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So maybe you initiate a transfer of $50 from your checking
to your saving.
What the hacker may then end up doing is saying,
transfer $500 from your checking to his savings.
Then they forward that request onto the actual bank server,
who then replies that everything is OK.
And then they respond here with an OK.
And you think everything has gone smoothly and according
to plan when in fact, it hasn't.
So not only has your sensitive information been stolen, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So not only has your sensitive information been stolen,
but also the integrity of your request of your data
has been compromised too because your request was
changed as it was in motion.
And now we're kind of coming towards the end of this skill,
that kind of sets up three important things that you've
now seen throughout this journey.
The CIA security triad, confidentiality.
We've now seen many different ways
that an attacker can compromise and get into your system
and spy on you.
They've found ways to exfiltrate your data. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
They've found ways to exfiltrate your data.
Integrity, they've now found ways to change your data.
And availability, they've now found ways
to take your services down entirely through the denial
of service attack.
So I wanted to throw that little CA acronym at you
because it's very important when understanding your threats.
And now that we understand what the man in the middle attack
is really all about, how do they carry out this attack?
They do it by spoofing, or a fancy way of saying pretending
to be a different server.
In the case where you are trying to go to bank.com WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In the case where you are trying to go to bank.com
or whatever it was, you got sent to their server instead.
How?
Maybe they spoofed a DNS server.
And when they replied to the DNS resolution request of bank.com,
they replied with their IP address instead
of the actual bank.com address.
How did you get sent to the wrong DNS
server in the first place?
Maybe they spoofed the DHCP server
and handed out their name server as the correct DNS server
instead.
It's also possible that they spoofed the MAC address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's also possible that they spoofed the MAC address
of your default gateway.
So when you went to forward a packet
outside of your local LAN segment,
you sent that packet to their computer
instead of your router.
And they changed the IP addresses
along the way as well as the data as it exited the network.
So the whole idea behind spoofing
is that they're redirecting your traffic
by pretending to be a critical network service.
And now your traffic flows through them instead.
Of course you could mitigate these types
of things, which we'll talk about throughout the rest
of this course.
But we can use something like dynamic ARP inspection or DHCP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But we can use something like dynamic ARP inspection or DHCP
snooping, where we actually look for any type of misuse
of ARP or DHCP.
That way, we know where our trusted resources are.
And if anyone else tries to implement their resources
or their DHCP services within our network,
we can immediately shut down their resources
and their access to the network.
So that's been introducing spoofing and the man
in the middle attack.
I hope this has been informative for you.
And I'd like to thank you for viewing.