An Introduction of SQL Injection, Buffer Overflow & Wireless Attack
Download as PPTX, PDF3 likes2,125 views
The document discusses the benefits of exercise for mental health. Regular physical activity can help reduce anxiety and depression and improve mood and cognitive functioning. Exercise causes chemical changes in the brain that may help boost feelings of calmness, happiness and focus.
An Introduction of SQL Injection, Buffer Overflow & Wireless Attack
- 1. Cyber Security An Introduction of SQL Injection, Buffer Overflow & Wireless Network Attack http://techsecit.com
- 2. SQL Injection • SQL injection is an attack technique that exploits a security vulnerability occurring in the database layer of an application . Hackers use injections to obtain unauthorized access to the underlying data, structure, and DBMS. It is one of the most common web application vulnerabilities. • A Database is the heart of many web-applications and is used to store information needed by the application, such as, credit card information, customer demographics, customer orders, client preferences, etc. Consequently, databases have become attractive and very lucrative targets for hackers to hack into. • SQL Injections happen when a developer accepts user input that is directly placed into a SQL Statement and doesn’t properly validate and filter out dangerous characters. This can allow an attacker to alter SQL statements passed to the database as parameters and enable her to not only steal data from your database, but also modify and delete it.
- 3. Contd... • Below are listed the main categories of SQL injection attacks. • Classic Attack • Most attacks rely on basic SQL manipulation and are considered to be classic attacks. It includes WHERE clause modification, UNION operator injection and query stacking. Those are by far the most popular kinds of SQLIA • Inference attack • Inference attacks involve a SQL manipulation that will provide the hacker the ability to verify a true/false condition. Depending on the database system reaction, it is possible to find out if the condition was realized or not.
- 4. Contd... • DBMS specific attack • This type of SQLIA is used as an alternative to classic SQL injection. It is especially useful when trying to fingerprint the database system, but it can also provide the ability to achieve a complete attack when some particular conditions are met. • The risk of SQL injection exploits is on the rise because of automated tools. In the past, the danger was somewhat limited because an exploit had to be carried out manually: an attacker had to actually type their SQL statement into a text box. However, automated SQL injection programs are now available, and as a result, both the likelihood and the potential damage of an exploit has increased enormously. • In an interview with Security Wire Perspectives, Caleb Sima, CTO of SPI Dynamics spoke of the potential danger: "This technology being publicly released by some black hat will give script-kiddies the ability to pick up a freeware tool, point it at a Web site and automatically download a database without any knowledge whatsoever. • I think that makes things a lot more critical and severe. The automation of SQL injection gives rise to the possibility of a SQL injection worm, which is very possible. In fact, I am surprised this hasn't occurred yet." Sima estimates that about 60% of Web applications that use dynamic content are vulnerable to SQL injection.
- 5. Contd... • According to security experts, the reason that SQL injection and many other exploits, such as cross-site scripting, are possible is that security is not sufficiently emphasized in development. To protect the integrity of Web sites and applications, experts recommend simple precautions during development such as controlling the types and numbers of characters accepted by input boxes. • <It is the vulnerability that results when you give an attacker the ability to influence the Structured Query Language (SQL) queries that an application passes to a back-end database. By being able to influence what is passed to the database, the attacker can leverage the syntax and capabilities of SQL itself, as well as the power and flexibility of supporting database functionality and operating system functionality available to the database. SQL injection is not a vulnerability that exclusively affects Web applications; any code that accepts input from an untrusted source and then uses that input to form dynamic SQL statements could be vulnerable >
- 6. Buffer Overflow • A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold or when a program attempts to put data in a memory area past a buffer. In this case, a buffer is a sequential section of memory allocated to contain anything from a character string to an array of integers. Writing outside the bounds of a block of allocated memory can corrupt data, crash the program, or cause the execution of malicious code. • Buffer overflow is probably the best known form of software security vulnerability. Most software developers know what a buffer overflow vulnerability is, but buffer overflow attacks against both legacy and newly- developed applications are still quite common. Part of the problem is due to the wide variety of ways buffer overflows can occur, and part is due to the error- prone techniques often used to prevent them.
- 7. Contd... • Exploiting a buffer overflow allows an attacker to control or crash the process or to modify its internal variables. Buffer overflow always ranks high in the Common Weakness Enumeration/SANS Top 25 Most Dangerous Software Errors and is specified as CWE-120 under the Common Weakness Enumeration dictionary of weakness types. Despite being well understood, buffer overflows continue to plague software from vendors both large and small. • A buffer overflow can occur inadvertently, but it can also be caused by a malicious actor sending carefully crafted input to a program that then attempts to store the input in a buffer that isn't large enough for that input. If the excess data is written to the adjacent buffer, it overwrites any data held there. If the original data includes the exploited Function’s return pointer -- the address to which the process should go next -- an attacker can set the new values to point to an address of his choosing. The attacker usually sets the new values to point to a location where the exploit Payload has been positioned. This alters the execution path of the process and effectively transfers control to the attacker's malicious code.
- 8. Contd... • The heap is a memory structure used to manage dynamic memory. Programmers often use the heap to allocate memory whose size is not known at compile time, where the amount of memory required is too large to fit on the stack or where the memory is intended to be used across function calls. • Other buffer-related attacks include integer overflow, which is when a number is used in an operation, the result of which requires more memory to store. For example, 8 bits of memory are required to store the number 192. If the process adds 64 to this number, the answer 256 will not fit in the allocated memory, as it requires 9 bits. • Format strings attacks alter the flow of an application by using string formatting library functions like printf and sprintf to access other memory space.
- 9. Contd... • Finally, a Unicode overflow exploits the greater memory required to store a string in Unicode format than in ASCII characters. • The most common reason why buffer overflow attacks work is because applications fail to manage memory allocations and validate input from the client or other processes. Applications developed in C or C++ should avoid dangerous standard Library functions that are not bounds checked, such as gets, scanf and strcpy, and instead use libraries or classes explicitly created to perform string and other memory operations securely. User input and data from untrusted sources should always be validated to ensure that they are within the bounds of what's expected and to prevent overly long input values. • Vendors issue patches and updates for their software to fix buffer overflow vulnerabilities that have been discovered, but there is still a period of risk between the vulnerability being discovered and the patch being created and deployed.
- 10. Contd... • Most operating systems have introduced runtime protections to make it harder for overflow buffer attacks to succeed. Address Space layout randomization randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries. This makes it difficult for an attacker to reliably jump to a particular function in memory. • Data Execution Prevention marks areas of memory as either executable or non- executable. This prevents an attacker from being able to execute instructions written to a data area via a buffer overflow.
- 11. Contd... • Recently revived, this formerly obsolete term gained currency in its day (1500) from a work by Johannes Trithemius, Steganographia, ostensibly a system of angel magic but also claiming to include a synthesis of how to learn and know things contained within a system of cryptography. The book was privately circulated but never published by the author because those who read it found it rather fearsome.
- 12. Wireless Network Attack • Access Control Attacks • Integrity Attacks • Confidentiality Attacks • Availability Attacks • Authentication Attacks
- 13. Access Control Attacks • War driving • In a wardriving attack, wireless LANS are detected either by sending probe requests over a connection or by listening to web beacons. Once a penetration point is discovered, further attacks can be launched on the LAN. Some of the tools that can be used to perform wardriving are KisMAC, NetStumbler, and WaveStumber. • Rogue Access Points • In order to create a backdoor into a trusted network, an unsecured access point or fake access point is installed inside a firewall. Any software or hardware access points can be used to perform this kind of attack. • MAC Spoofing • Using the MAC spoofing technique, the attacker can reconfigure the MAC address to appear as an authorized access point to a host on a trusted network. The tools for carrying out this kind of attack are: changemac.sh, SMAC, and Wicontrol.
- 14. Contd... • Ad Hoc Associations • This kind of attack can be carried out by using any USB adapter or wireless card. In this method, the host is connected to an unsecured station to attack a particular station or to avoid access point security. • AP Misconfiguration • If any of the critical security settings is improperly configured at any of the access points, the entire network could be open to vulnerabilities and attacks. The AP can't trigger alerts in most intrusion-detection systems, as it is authorized as a legitimate device on the network. • Client Misassociation • The client may connect or associate with an AP outside the legitimate network either intentionally or accidentally. This is because the WLAN signals travel through walls in the air. This kind of client misassociation thus can be lead to access control attacks.
- 15. Contd... • Unauthorized Association • Unauthorized association is the major threat to wireless network. Prevention of this kind of attack depends on the method or technique that the attacker uses in order to get associated with the network. • Promiscuous Client • The promiscuous client offers an irresistibly strong signal intentionally for malicious purposes. Wireless cards often look for a stronger signal to connect to a network. In this way the promiscuous client grabs the attention of the users towards it by sending strong signal.
- 16. Integrity Attacks • In integrity attacks, attackers send forged control, management, or data frames over a wireless network to misdirect the wireless devices in order to perform another type of attack (e.g., DoS). Type of Attack Description Method and Tools Data Frame Injection Crafting and sending forged 802.11 frames. Airpwn, File2air, libradiate, voidll, WEPWedgie, wnet dinject/reinject WEP Injection Crafting and sending forged WEP encryption keys WEP cracking + injection tools Data Replay Capturing 802.11 data frames for later (modified) replay. Capture + injection tools
- 17. Contd... Initialization Vector Replay Attacks The key stream is derived by sending the plain-text message. Bit-Flipping Attacks Captures the frame and flips random bits in the data payload, modifies ICV, and sends to the user Extensible AP Replay Capturing 802.IX Extensible Authentication Protocols (e.g., EAP Identity, Success, Failure) for later replay. Wireless capture + injection tools between station and AP RADIUS Replay Capturing RADIUS Access-Accept or Reject messages for later replay Ethernet capture + injection tools between AP and authentication server Wireless Network Viruses Viruses have their impact on the wireless network to a great extent. It allows the attacker with simplest ways for attacking on APs.
- 18. Confidentiality Attacks • These attacks attempt to intercept confidential information sent over wireless associations, whether sent in the clear text or encrypted by Wi-Fi protocols. Type of Attack Description Method and Tools Eavesdropping Capturing and decoding unprotected application traffic to obtain potentially sensitive information. bsd-airtools, Ethereal, Ettercap, Kismet, commercial analyzers Traffic Analysis Implication of information from the observation of external traffic characteristics. Cracking WEP Key Capturing data to recover a WEP key using brute force or Fluhrer-Mantin- Shamir (FMS) cryptanalysis. Aircrack, AirSnort, chopchop, dwepcrack, WepAttack, WepDecrypt, WepLab
- 19. Contd... Evil Twin AP Masquerading as an authorized AP by beaconing the WLAN's service set identifier (SSID) to lure users. qureAP, HermesAP, HostAP, OpenAP, Quetec, WifiBSD Man-in-the- Middle Attack Running traditional man-in-the- middle attack tools on an evil twin AP to intercept TCP sessions or SSL/SSH tunnels. dsniff, Ettercap Masquerading Pretends to be an authorized user of a system in order to gain access to it. Stealing login IDs and passwords, bypassing authentication mechanisms Session Hijacking Manipulating the network so the attacker's host appears to be the desired destination. Manipulating Honeypot Access Point Setting its service identifier (SSID) to be the same as an access point at the local hotspot assumes the attacker as the legitimate hotspot. Manipulating SSID
- 20. Availability Attack • These attacks aim at obstructing the delivery of wireless services to legitimate users, either by crippling those resources or by denying them access to WLAN resources. There are many attacks using which an attacker can obstruct the availability of wireless networks. The availability attacks include: Type of Attack Description Method and Tools Access Point Theft Physically removing an AP from a public space. Five finger discount Denial of Service Exploiting the CSMA/CA Clear Channel Assessment (CCA) mechanism to make a channel appear busy An adapter that supports CW Tx mode, with a low- level utility to invoke continuous transmit Beacon Flood Generating thousands of counterfeit 802.11 beacons to make it hard for stations to find a legitimate AP. FakeAP
- 21. Contd... Authenticate Flood Sending forged Authenticates or Associates from random MACs to fill a target AP's association table. Airjack, File2air, Macfld, voidll Disassociation Attacks Causes the target unavailable to other wireless devices by destroying the connectivity between station and the client. Destroys the connectivity De-authenticate Flood Flooding station(s) with forged Deauthenticates or Disassociates to disconnecting users from an AP. Destroys the connectivity TKIP MIC Exploit Generating invalid TKIP data to exceed the target AP's MIC error threshold, suspending WLAN service. File2air, wnet dinject ARP Cache Poisoning Attack Provides attackers with many attack vectors
- 22. Contd... EAP-Failure Observing a valid 802.IX EAP exchange, and then sending the station a forged EAP-Failure message. QACafe, File2air, libradiate Routing Attacks Routing information is distributed within the network RIP protocol Power Saving Attacks Transmitting a spoofed TIM or DTIM to the client while in power saving mode causes the DoS attack
- 23. Authentication Attacks • The objective of authentication attacks is to steal the identity of Wi-Fi clients, their personal information, login credentials, etc. to gain unauthorized access to network resources. Type of Attack Description Method and Tools Application Login Theft Capturing user credentials (e.g., email address and password) from clear text application protocols. Ace Password Sniffer, Dsniff, PHoss, WinSniffer PSK Cracking Recovering a WPA PSK from captured key handshake frames using a dictionary attack tool. coWPAtty, KisMAC, wpa_crack, wpa-psk-bf Shared Key Guessing Attempting 802.11 Shared Key Authentication with guessed vendor default or cracked WEP keys. WEP cracking tools
- 24. Contd... Domain Login Cracking Recovering user credentials (e.g., Windows login and password) by cracking NetBIOS password hashes, using a brute-force or dictionary attack tool. John the Ripper, LOphtCrack, Cain Identity Theft Capturing user identities from cleartext 802.IX Identity Response packets Capture tools VPN Login Cracking Recovering user credentials (e.g., PPTP password or IPSec Preshared Secret Key) by running brute-force attacks on VPN authentication protocols. ike_scan and ike_crack (IPsec), anger and THC- pptp- bruter (PPTP Password Speculation Using a captured identity, repeatedly attempting 802.IX authentication to guess the user's password. Password dictionary
- 25. Contd... LEAP Cracking Recovering user credentials from captured 802.IX Lightweight EAP (LEAP) packets using a dictionary attack tool to crack the NT password hash. Anwrap, Asleap, THC- LEAPcracker