Email-based attacks

 EMAIL ATTACKS

Phishing

• Email based

• Prevented by DMARC

Spear phishing

• Email based

• Multiple people in the same department/company

• Prevented by DMARC

Whaling

• Email based

• C-Level (CEO, CFO, etc) Board of Directors

• Specific to the person it targets

 WHOIS COMMAND

Whois

·         Too much information

·         The correct amount of information

SQL Injection Attack

 SQLi

SQLi (SQL Injection)

·         Server-side attack

·         A query formatted: ‘ or ‘1’=’1’ -- is a SQL injection attack.

·         SELECT * FROM

·         Prevented by

o   Input validation

o   Removing semi-colons, dashes, quotations, & commas

o   Stored procedures

XSS (Cross-Site Scripting) Attack

 XSS (Cross-Site Scripting)

XSS (Cross-Site Scripting)

• Client-side attack
• JavaScript
• HTML iFrame
• URL ends in .js
• Percent encoding %C (<) & %3E (>)

HTTP Strict Transport Security (HSTS): Protecting Your Website with HTTPS

 HSTS

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that forces web browsers to interact with a website using only HTTPS (secure HTTP) connections, preventing man-in-the-middle attacks and protocol downgrade attacks. It achieves this by sending a "Strict-Transport-Security" HTTP response header from the server to the browser, instructing it to always use HTTPS for future visits to that site and its subdomains (if specified). 

Here's a more detailed explanation:

How HSTS Works:

1. Initial HTTPS Connection: The first time a user accesses a website with HSTS enabled, they must connect using HTTPS, and the server sends back an HSTS header. 

2. HSTS Header: The header includes a max-age directive, specifying how long (in seconds) the browser should remember to use HTTPS for that domain. It may also include includeSubDomains to apply the rule to all subdomains, and preload to allow the site to be included in a browser's built-in list of HSTS sites. 

3. Browser Enforcement: For the duration specified by max-age, the browser will automatically convert any HTTP requests for that domain (even if typed as HTTP or accessed via an HTTP link) into HTTPS requests before sending them. 

4. Preventing Browser Warnings: HSTS also prevents users from bypassing browser warnings about invalid or self-signed certificates, ensuring that secure connections are maintained. 

Benefits of HSTS:

Protection against downgrade attacks: HSTS prevents attackers from forcing a browser to use the insecure HTTP protocol, protecting against attacks that try to intercept or manipulate communication. 

Protection against cookie hijacking: By enforcing HTTPS, HSTS helps protect sensitive data like session cookies from being intercepted and misused by attackers. 

Improved user experience: By automatically upgrading to HTTPS, HSTS eliminates the need for users to manually type "https://" or deal with browser security warnings. 

Enhanced security posture: HSTS strengthens the overall security of a website by reducing the attack surface and preventing potential vulnerabilities. 

Key Directives:

• max-age: Specifies the duration (in seconds) for which the browser should enforce HTTPS. 
• includeSubDomains: Applies the HSTS policy to all subdomains of the domain. 
• preload: Allows a website to be included in a browser's built-in list of HSTS websites, ensuring that HTTPS is enforced from the very first visit. 

Limitations:

Initial HTTPS requirement: HSTS relies on the user agent receiving the HSTS header during an HTTPS connection, meaning the first connection to the website is still vulnerable. 

Potential for site unavailability: If a website is not accessible over HTTPS, users will be unable to access it if they have HSTS enabled. 

Complexities with subdomains and CDNs: Configuring HSTS correctly, especially with subdomains and content delivery networks (CDNs), can be complex. 

Example Header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload 

This example sets the HSTS policy for one year, includes all subdomains, and allows for preloading.

USB Data Blockers: Safeguarding Your Devices Against Juice Jacking

 USB Data Blocker / Prevent Juice Jacking

A USB data blocker, often referred to as a "USB condom," is a small device designed to protect your devices from potential security threats when charging via public USB ports. Here's a detailed explanation:

What is a USB Data Blocker?

A USB data blocker is a device that connects between your device (like a smartphone or tablet) and a USB charging port. Its primary function is to block data transfer while allowing power to pass through, ensuring that your device charges safely without the risk of data theft or malware infection.

How Does a USB Data Blocker Work?

USB cables have multiple pins that serve different functions, including data transfer and power delivery. A USB data blocker disables the pins responsible for data transfer, allowing only the power pins to function. This means that while your device can still receive power and charge, no data can be transferred to or from the device.

Why Do You Need a USB Data Blocker?

Public USB charging ports, such as those found in airports, cafes, and other public places, can be compromised by hackers. This type of attack is known as juice jacking. Hackers can use these ports to install malware on your device or steal your data. A USB data blocker prevents this by ensuring only power is transmitted, not data.

Types of USB Data Blockers

USB data blockers come in various forms, primarily distinguished by the type of USB connection they support:

• USB-A Data Blockers: These have a USB-A socket on one side and a USB-A plug on the other.
• USB-C Data Blockers: These are designed for devices that use USB-C connections.
• Micro-USB Data Blockers: These are less common but still available for devices that use micro-USB connections.

Advantages of USB Data Blockers

• Security: Protects your device from data theft and malware.
• Portability: Small and easy to carry, making them convenient for travel.
• Ease of Use: Simple to use; just plug it in between your device and the charging port.

Disadvantages of USB Data Blockers

• Reduced Charging Speed: Some USB data blockers may slightly reduce the charging speed.
• Compatibility: Not all USB data blockers are compatible with every device or charging port.

Conclusion

USB data blockers are essential for anyone who frequently charges their devices in public places. They provide a simple yet effective way to protect data and devices from potential security threats. By blocking data transfer and allowing only power to pass through, they ensure that your device can be charged safely and securely.

This is covered in CompTIA Security+.

Juice Jacking: Understanding the Threat of Public USB Charging

 Juice Jacking

Juice jacking is a type of cyber-attack that targets devices like smartphones and tablets when they are charged via public USB ports. Here's a detailed explanation:

What is Juice Jacking?

Juice jacking occurs when a malicious actor uses a compromised USB charging port or cable to either install malware on a device or steal data from it. This attack exploits the fact that USB cables can transfer both power and data.

How Does Juice Jacking Work?

When you plug your device into a public USB charging station, such as those found in airports, cafes, or other public places, you might unknowingly connect to a compromised port. The attacker can use this connection to:

• Install Malware: Malicious software can be installed on your device, which can then be used to steal data, track your activities, or even take control of your device.
• Steal Data: Sensitive information such as contacts, emails, photos, and passwords can be copied from your device without your knowledge.

Types of Juice Jacking Attacks:

• Data Theft: The attacker copies data from your device while it is charging.
• Malware Installation: The attacker installs malicious software on your device, which can then be used for various nefarious purposes.

Examples of Juice Jacking:

• Public Charging Stations: Airports, hotels, and cafes often provide USB charging stations. These can be compromised by attackers to carry out juice-jacking attacks.
• Infected USB Cables: Attackers can distribute infected USB cables that look like regular charging cables but are designed to steal data or install malware.

Repercussions of Juice Jacking:

• Data Theft: Sensitive information can be stolen, leading to identity theft or financial loss.
• Device Compromise: Malware can take control of your device, track your activities, or lock you out of your own device.
• Privacy Invasion: Personal data and activities can be monitored without your consent.

Ways to Avoid Juice Jacking:

• Use AC Power Outlets: Always prefer using an AC power outlet with your own charger and USB cable.
• Carry a Power Bank: Use a portable power bank to charge your devices on the go.
• Use a USB Data Blocker: A USB data blocker, also known as a "USB condom," prevents data transfer while allowing power to pass through.
• Avoid Public USB Ports: Refrain from using public USB charging stations whenever possible.
• Use Charging-Only Cables: These cables are designed to only transfer power and not data.

Conclusion:

Juice jacking is a real threat that can compromise your device and steal your data. By being aware of the risks and taking preventive measures, you can protect your devices from this type of cyber attack. Always be cautious when using public USB charging stations and consider using tools like USB data blockers to ensure your device's safety.

This is covered in CompTIA Security+.