In this lesson,
we will learn about Attack Patterns.
Attack patterns are tactics and techniques
that threat actors use to exploit vulnerabilities
in a system.
In threat modeling, attack patterns may be modeled
to include injection, authentication and authorization,
and on-path attacks.
Injection attacks involve inserting malicious code
or commands into a system through vulnerable input points.
Authentication and authorization attacks
target the mechanisms that control user access.
And on-path attacks,
formerly known as man-in-the-middle attacks,
occur when an attacker intercepts
and potentially alters communications between two parties.
Let's learn more about injection,
authentication and authorization, and on-path attacks.
First, we have injection attacks.
Injection attacks occur when an attacker
inserts malicious code or commands into a system
via vulnerable input points,
manipulating the application's behavior.
One of the most common forms of injection attacks
is structured query language or SQL injection,
where an attacker sends harmful SQL statements
through web application input fields.
This type of attack can give unauthorized access
to a database, allowing an attacker to view,
modify, create, or delete sensitive information.
Other injection types include command injection,
where operating system commands are injected
to gain control over the system's execution,
code injection, which introduces other code
directly into the application's code base
to manipulate its functionality, and cross-site scripting,
which targets user side script injections
to manipulate content displayed to users
or to steal session data.
In SQL, sometimes called SQL injection,
the attacker leverages poorly sanitized input fields
to insert commands directly into SQL queries.
For instance, in a vulnerable login form,
an attacker might enter the string,
'OR1=1;--
They might enter that in the username or password fields,
tricking the system into granting access
without valid credentials.
This exploit works
because the application fails to properly sanitize input.
So, the database interprets
the injected structured query language
as part of the query logic.
Similar injection techniques can be used
in command injection to manipulate system commands
or in cross-site scripting to inject malicious scripts
that run in other users' browsers.
Mitigating injection attacks
involves a validating and sanitizing
all user input rigorously.
Parameterized queries,
also known as prepared statements,
are especially effective against SQL injection
as they separate code from data inputs.
Meaning that the attacker cannot change the structure
of the SQL statement
through the web application input fields.
Additionally, using web application firewalls
can help detect and block suspicious requests,
adding a layer of security
to prevent injection vulnerabilities from being exploited.
Second, we have authentication and authorization attacks.
Authentication and authorization attacks
focus on exploiting weaknesses in user access controls,
allowing attackers to bypass login systems
or gain unauthorized permissions.
A common form of attack
involves exploiting weak password reset mechanisms,
where an attacker manipulates the reset process
to gain access to user accounts.
Other tactics include
exploiting insecure access control lists
or leveraging broken authentication flows,
such as session hijacking to impersonate legitimate users.
For example, a password reset attack on a system
may take advantage of a password reset process
with inadequate verification steps.
Let's say the password reset process
relies on easily accessible information,
like a user's email address
or basic knowledge based questions
like birthday, location, or any other data
that can be seen on social media accounts
or found through open source intelligence.
In this case, the attacker could bypass
the intended security measures to gain access to the account
by simply looking up the information online.
Once in control of the account,
the attacker could change the password,
lock out the legitimate user,
and access sensitive information
or misuse account features.
Or in the context of authorization,
an attacker might then exploit
flawed role-based access controls
to elevate their privileges,
gaining unauthorized access to restricted data
or functionalities in an enterprise network.
So to defend authentication and authorization attacks,
administrators should employ multi-factor authentication
not only for logins,
but also for the password reset process,
or adding additional complexity to the reset process
by requiring unique verification codes
sent to registered devices
helps ensure only the legitimate user
can reset their password.
Finally, enforcing secure session management,
strong session ID generation,
and effectively configuring role-based permissions
can also mitigate unauthorized actions within the system.
Third and last, we have on-path attacks.
On-path attacks,
formerly known as man-in-the-middle attacks,
occur when an attacker intercepts communications
between two parties, such as a client and a server.
By positioning themselves in the middle of these exchanges,
attackers can eavesdrop on or alter data being sent
and received, leading to data theft
or malicious content injection.
Common on-path attack types include packet sniffing,
where attackers capture network traffic
and session hijacking,
where attackers take control of an active session
between a user and an application.
A typical on-path attack involves an attacker
intercepting an altering network packets
in an unprotected wifi network.
For example, if a victim accesses their bank account
over public wifi without encryption
or with weak encryption, and the attacker positioned
within the network or monitoring network communication,
can intercept session tokens or login credentials.
By capturing credentials, an attacker
can then hijack the victim's session, view sensitive data,
and even initiate unauthorized actions
such as transferring funds or changing account details,
all while appearing as the legitimate user.
In some cases, attackers may also modify network packets
to inject malicious content,
further compromising the target device.
So to prevent on-path attacks,
encryption protocols such as transport layer security
should be used to secure communications,
ensuring data is encrypted
and less of vulnerable to interception.
Additionally, implementing certificates
into the authentication process
helps verify the authenticity of the parties involved.
Finally, regular network monitoring
and anomaly detection systems
can also be used to identify unusual patterns
that may indicate on-path attacks,
enabling quicker response and mitigation.
So remember, attack patterns are techniques
that threat actors use to exploit system vulnerabilities.
Commonly modeled in threat analysis to identify risks,
like injection, authentication and authorization,
and on-path attacks.
Injection attacks involve inserting malicious code
into vulnerable input fields to manipulate system behavior,
often giving unauthorized access to sensitive data.
Next, authentication and authorization attacks
exploit weaknesses in user access controls,
allowing attackers to bypass login systems
or elevate privileges.
In particular, password reset mechanisms
and broken authentication flows
are often targeted to gain unauthorized account access.
Finally, on-path attacks,
previously known as man-in-the-middle attacks,
occur when an attacker intercepts
and possibly alters communication between two parties,
enabling data theft or malicious content injection.
Preventative measures for these patterns
include input validation, multi-factor authentication,
encryption protocols, and anomaly detection systems
such as Splunk.