WEBVTT

1
00:00.000 --> 00:00.060 align:middle line:84%


2
00:00.060 --> 00:01.470 align:middle line:90%
The last threat that
we're going to be talking

3
00:01.470 --> 00:03.570 align:middle line:90%
about in this skill
is a spoofing or man

4
00:03.570 --> 00:04.470 align:middle line:84%
in the middle attack.

5
00:04.470 --> 00:06.835 align:middle line:90%
This is going to be a
really, really popular one

6
00:06.835 --> 00:09.210 align:middle line:90%
in the hacker community too
because this is where they're

7
00:09.210 --> 00:12.988 align:middle line:90%
trying to intercept your data as
it's traveling across the wire.

8
00:12.988 --> 00:13.530 align:middle line:84%
So get ready.

9
00:13.530 --> 00:15.810 align:middle line:90%
We're going to talk about
how spoofing really works

10
00:15.810 --> 00:17.352 align:middle line:90%
and what the man in
the middle attack

11
00:17.352 --> 00:18.900 align:middle line:84%
accomplishes for the hacker.

12
00:18.900 --> 00:19.890 align:middle line:84%
Let's get going.

13
00:19.890 --> 00:22.260 align:middle line:90%
Our last attack that we're
talking about in this skill

14
00:22.260 --> 00:24.900 align:middle line:90%
is the spoofing
attack, which leads

15
00:24.900 --> 00:26.730 align:middle line:84%
to a man in the middle attack.

16
00:26.730 --> 00:28.750 align:middle line:90%
The idea is kind
of straightforward.

17
00:28.750 --> 00:32.130 align:middle line:90%
You've got your end users who
are accessing your resources.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:28.750 --> 00:32.130 align:middle line:90%
You've got your end users who
are accessing your resources.

18
00:32.130 --> 00:33.750 align:middle line:84%
Maybe it's a file share.

19
00:33.750 --> 00:35.610 align:middle line:84%
Maybe it's a website.

20
00:35.610 --> 00:37.870 align:middle line:90%
Maybe they're just
logging into their bank.

21
00:37.870 --> 00:42.600 align:middle line:90%
And the idea is that a bad actor
wants to intercept that traffic

22
00:42.600 --> 00:44.490 align:middle line:84%
as it flows across the wire.

23
00:44.490 --> 00:46.590 align:middle line:90%
Now, this is really
common when they're

24
00:46.590 --> 00:49.750 align:middle line:90%
trying to steal credit
card or bank information.

25
00:49.750 --> 00:51.370 align:middle line:90%
So your end users
think they're going

26
00:51.370 --> 00:53.100 align:middle line:90%
to be logging into
their website site,

27
00:53.100 --> 00:55.410 align:middle line:90%
but really what they
end up logging into

28
00:55.410 --> 00:58.530 align:middle line:90%
is they log into this
hacker's website, which is

29
00:58.530 --> 01:00.630 align:middle line:84%
made to look identical to it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:58.530 --> 01:00.630 align:middle line:84%
made to look identical to it.

30
01:00.630 --> 01:03.180 align:middle line:90%
And then the hacker may
forward the information

31
01:03.180 --> 01:07.200 align:middle line:90%
on to the server so that
it gets all the responses.

32
01:07.200 --> 01:09.300 align:middle line:90%
Sometimes the purpose of
this particular attack,

33
01:09.300 --> 01:12.120 align:middle line:90%
where the man is in the
middle, is they just

34
01:12.120 --> 01:13.870 align:middle line:84%
want to get information.

35
01:13.870 --> 01:16.140 align:middle line:90%
Maybe they just want your
username and password

36
01:16.140 --> 01:19.300 align:middle line:90%
and your current account
balance or something like that.

37
01:19.300 --> 01:23.160 align:middle line:90%
So it could just be used
to exfiltrate information.

38
01:23.160 --> 01:26.760 align:middle line:90%
But it could also be used
to manipulate information

39
01:26.760 --> 01:28.210 align:middle line:84%
as it's going through.

40
01:28.210 --> 01:33.690 align:middle line:90%
So maybe you initiate a transfer
of $50 from your checking
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:28.210 --> 01:33.690 align:middle line:90%
So maybe you initiate a transfer
of $50 from your checking

41
01:33.690 --> 01:34.650 align:middle line:84%
to your saving.

42
01:34.650 --> 01:37.860 align:middle line:90%
What the hacker may then
end up doing is saying,

43
01:37.860 --> 01:43.410 align:middle line:90%
transfer $500 from your
checking to his savings.

44
01:43.410 --> 01:47.250 align:middle line:90%
Then they forward that request
onto the actual bank server,

45
01:47.250 --> 01:50.280 align:middle line:90%
who then replies that
everything is OK.

46
01:50.280 --> 01:52.920 align:middle line:90%
And then they respond
here with an OK.

47
01:52.920 --> 01:55.530 align:middle line:90%
And you think everything has
gone smoothly and according

48
01:55.530 --> 01:57.450 align:middle line:84%
to plan when in fact, it hasn't.

49
01:57.450 --> 02:00.630 align:middle line:90%
So not only has your sensitive
information been stolen,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:57.450 --> 02:00.630 align:middle line:90%
So not only has your sensitive
information been stolen,

50
02:00.630 --> 02:04.710 align:middle line:90%
but also the integrity of
your request of your data

51
02:04.710 --> 02:07.800 align:middle line:90%
has been compromised too
because your request was

52
02:07.800 --> 02:09.780 align:middle line:84%
changed as it was in motion.

53
02:09.780 --> 02:12.360 align:middle line:90%
And now we're kind of coming
towards the end of this skill,

54
02:12.360 --> 02:15.510 align:middle line:90%
that kind of sets up three
important things that you've

55
02:15.510 --> 02:17.820 align:middle line:90%
now seen throughout
this journey.

56
02:17.820 --> 02:21.630 align:middle line:90%
The CIA security
triad, confidentiality.

57
02:21.630 --> 02:23.700 align:middle line:90%
We've now seen
many different ways

58
02:23.700 --> 02:26.730 align:middle line:90%
that an attacker can compromise
and get into your system

59
02:26.730 --> 02:27.990 align:middle line:84%
and spy on you.

60
02:27.990 --> 02:30.480 align:middle line:90%
They've found ways to
exfiltrate your data.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:27.990 --> 02:30.480 align:middle line:90%
They've found ways to
exfiltrate your data.

61
02:30.480 --> 02:34.290 align:middle line:90%
Integrity, they've now found
ways to change your data.

62
02:34.290 --> 02:36.900 align:middle line:90%
And availability,
they've now found ways

63
02:36.900 --> 02:40.710 align:middle line:90%
to take your services down
entirely through the denial

64
02:40.710 --> 02:41.640 align:middle line:84%
of service attack.

65
02:41.640 --> 02:44.190 align:middle line:90%
So I wanted to throw that
little CA acronym at you

66
02:44.190 --> 02:47.070 align:middle line:90%
because it's very important
when understanding your threats.

67
02:47.070 --> 02:50.040 align:middle line:90%
And now that we understand what
the man in the middle attack

68
02:50.040 --> 02:53.250 align:middle line:90%
is really all about, how do
they carry out this attack?

69
02:53.250 --> 02:57.210 align:middle line:90%
They do it by spoofing, or a
fancy way of saying pretending

70
02:57.210 --> 02:58.577 align:middle line:84%
to be a different server.

71
02:58.577 --> 03:00.660 align:middle line:90%
In the case where you are
trying to go to bank.com
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:58.577 --> 03:00.660 align:middle line:90%
In the case where you are
trying to go to bank.com

72
03:00.660 --> 03:06.000 align:middle line:90%
or whatever it was, you got
sent to their server instead.

73
03:06.000 --> 03:06.720 align:middle line:84%
How?

74
03:06.720 --> 03:09.240 align:middle line:84%
Maybe they spoofed a DNS server.

75
03:09.240 --> 03:12.780 align:middle line:90%
And when they replied to the DNS
resolution request of bank.com,

76
03:12.780 --> 03:15.270 align:middle line:90%
they replied with their
IP address instead

77
03:15.270 --> 03:17.220 align:middle line:84%
of the actual bank.com address.

78
03:17.220 --> 03:18.810 align:middle line:90%
How did you get sent
to the wrong DNS

79
03:18.810 --> 03:20.190 align:middle line:84%
server in the first place?

80
03:20.190 --> 03:22.920 align:middle line:90%
Maybe they spoofed
the DHCP server

81
03:22.920 --> 03:26.460 align:middle line:90%
and handed out their name
server as the correct DNS server

82
03:26.460 --> 03:27.210 align:middle line:84%
instead.

83
03:27.210 --> 03:30.270 align:middle line:90%
It's also possible that
they spoofed the MAC address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:27.210 --> 03:30.270 align:middle line:90%
It's also possible that
they spoofed the MAC address

84
03:30.270 --> 03:31.930 align:middle line:84%
of your default gateway.

85
03:31.930 --> 03:33.660 align:middle line:90%
So when you went
to forward a packet

86
03:33.660 --> 03:36.030 align:middle line:90%
outside of your
local LAN segment,

87
03:36.030 --> 03:38.220 align:middle line:90%
you sent that packet
to their computer

88
03:38.220 --> 03:39.630 align:middle line:84%
instead of your router.

89
03:39.630 --> 03:41.460 align:middle line:90%
And they changed
the IP addresses

90
03:41.460 --> 03:46.340 align:middle line:90%
along the way as well as the
data as it exited the network.

91
03:46.340 --> 03:48.060 align:middle line:90%
So the whole idea
behind spoofing

92
03:48.060 --> 03:50.130 align:middle line:90%
is that they're
redirecting your traffic

93
03:50.130 --> 03:52.950 align:middle line:90%
by pretending to be a
critical network service.

94
03:52.950 --> 03:55.753 align:middle line:90%
And now your traffic flows
through them instead.

95
03:55.753 --> 03:57.420 align:middle line:90%
Of course you could
mitigate these types

96
03:57.420 --> 03:59.010 align:middle line:90%
of things, which we'll talk
about throughout the rest

97
03:59.010 --> 03:59.890 align:middle line:84%
of this course.

98
03:59.890 --> 04:04.280 align:middle line:90%
But we can use something like
dynamic ARP inspection or DHCP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:59.890 --> 04:04.280 align:middle line:90%
But we can use something like
dynamic ARP inspection or DHCP

99
04:04.280 --> 04:07.380 align:middle line:90%
snooping, where we actually
look for any type of misuse

100
04:07.380 --> 04:09.900 align:middle line:84%
of ARP or DHCP.

101
04:09.900 --> 04:12.330 align:middle line:90%
That way, we know where
our trusted resources are.

102
04:12.330 --> 04:15.450 align:middle line:90%
And if anyone else tries to
implement their resources

103
04:15.450 --> 04:18.120 align:middle line:90%
or their DHCP services
within our network,

104
04:18.120 --> 04:20.370 align:middle line:90%
we can immediately shut
down their resources

105
04:20.370 --> 04:22.029 align:middle line:84%
and their access to the network.

106
04:22.029 --> 04:24.090 align:middle line:90%
So that's been introducing
spoofing and the man

107
04:24.090 --> 04:25.080 align:middle line:84%
in the middle attack.

108
04:25.080 --> 04:26.788 align:middle line:90%
I hope this has been
informative for you.

109
04:26.788 --> 04:29.180 align:middle line:90%
And I'd like to thank
you for viewing.