How a Hacker can Infiltrate your Network and What can be Done About it?

Introduction

During the late 20th century, the term hacker was used to refer to a skilled person who is an expert in machine code and computer operating system. Currently, the term is commonly used in the media for criminals who performs some or other form of computer sabotage. Basically, hackers need to be experts in accessing password-protected computers, files, and networks. They misuse their skills and expertise for criminal gains. In addition, hackers develop software and "hacking tools" which can be used to exploit bugs and weaknesses in computer systems and distributes these tools to other cyber criminals for executing nefarious activities and generates revenue out of it.Dissecting out the modus operandi of criminal hackers is vital for protecting ourselves and organizations from damages caused by network infiltrations. In this article I am not going to explain how to hack something, but rather I would like to give an overview of how attackers exploit the weaknesses and mistakes to gain entry into unauthorized networks. This can help to avoid some of the common mistakes that criminal hackers utilize.

Article at a glance

In this article, we will discuss the following

• Techniques and routes which  hackers use to infiltrate networks
• What do software versions and patches mean to a hacker?
• SQL injection attacks
• Software vulnerabilities and attacks against Web Servers (IIS, Apache, Nginx)
• The dangers of elevated privileges

See best practices in Cyber Security - https://securereading.com/cyber-attacks-everywhere-can-ensure-right-security-organizational-assets/

Techniques and routes which hackers use to infiltrate networks

There are several ways with which hackers gets entry into your networks. A list of most popular techniques are explained below:

1.Buffer Overflow

This is a technique in which when a computer program is supplied with more data than it expects, the program will attempt to put data in a memory area past a buffer (allocated storage area). This extra content gets written outside the bounds of a block of allocated memory and can result in corrupted data, a crash of the program (denial of service), or can be used to execute a piece of malicious code to gain unauthorized access.

2.Phishing

Phishing is a popular technique in which the hacker will try to obtain sensitive information such as usernames, passwords, and credit card details, by imitating as if the request is from a trustworthy entity in an electronic communication. They then use this information to get unauthorized access and network infiltration. In some cases, they trick the user into installing malicious software to gain entry into their network systems.

3.Password hacking

Usage of extremely simple passwords consisting dictionary words and usage of default usernames and passwords in for example network routers is another area for gaining unauthorized access to networks. Reuse of password for different services can be another source of attack especially if one of the services gets hacked and the attacker could use those passwords to access other services.

4.Downloading free and pirated software

Using shareware and buggy free software can introduce new areas of weaknesses in the network security of a business. Some of this software may contain embedded malware such as keyloggers and remote administration tools which can be used by an attacker to gain entry into a business system

5.Fuzzing aka fault injection

Fuzzing is a popular technique used by hackers to probe for software vulnerabilities in a network service. This is a random testing in which the target is fed with random data. Hackers often use automated or semi-automated tools which provide invalid, unexpected, or random data to the inputs of a network service such as a web server and monitor its output. They look for exceptions such as crashes and other responses from the target system and exploits the vulnerabilities in the system for gaining unauthorized access.  

Software versions and patches

Hackers are always looking for holes to gain entry into the target systems. Many software and web applications have some kind of banner message that is returned to the user as soon as he/she connects to the system. Most web servers are configured to do this. In addition, there will be details on software patches. These fine details on a target system help an attacker to develop or choose specific exploits and vulnerabilities to gain entry to a system. This is exactly the same system as used by vulnerability scanners to look for denial of service attacks. Similarly, an attacker can fire off an exploit to launch a service denial attack or can send a cleverly crafted payload to get unauthorized access to the network system.

SQL injection attacks and cross-site scripting

SQL injection (SQLi) attack is another important technique used by hackers to attack database servers. It  consists of the insertion of a nefarious SQL statement through the input data from the client to the application. A successful SQL injection exploit can be used to pull sensitive data from the database, modify a database, perform administrative operations on the database and even in some cases it can be used to execute commands on the underlying operating system. Key defenses against SQLi are (from Open Web Application Security Project, OWASP):

• Use of Prepared Statements (Parameterized Queries)
• Use of Stored Procedures
• Escaping all User Supplied Input
• Enforce Least Privilege
• Implementing Whitelist Input Validation

      Cross-Site Scripting (XSS) attacks are another common type of vulnerability found in web applications in which malicious scripts are inserted into otherwise trusted web sites. In XSS attacks, the attacker use a web application usually in the form of a browser side script and is used to distribute malicious code to a different end user. Proper input validation is a crucial element in preventing XSS attacks. It is important that you never allow insertion of untrusted data except in locations where it is allowed or expected.

Software vulnerabilities and attacks against Web Servers

Vulnerabilities within web server itself can be another target for attack and can be exploited for gaining access to sensitive information. This could be an unpatched server or misconfiguration in the web server settings. It should be kept in mind that security depends on securing all of the layers and not just the web server. So a proper configuration of a web server and associated components are crucial. This includes for e.g scripting supports (PHP, ASP, etc) and database components.

The dangers of elevated privileges

Another important area which makes a hacker's job easier is elevated privileges among normal users in an organization or a business. This is a common scenario found in many cases where organizations are creating excessive numbers of domain administrator accounts without any valid reasons. This allows direct execution of privileged commands from exploiting a simple application flaw. Otherwise, hackers need to find an alternative solution to gain elevated privileges through some other exploits. In the presence of higher privileges, even social engineering attacks or any other similar attacks can produce more damages at a system level.

Conclusion

In this article, I've briefly covered some of the common techniques used by hackers to gain access to a network. It is far from complete and there are several techniques which are skipped in this article. Many of these attacks are well known, minor modifications to the techniques and new tool sets and existence of unknown vulnerabilities will make the network systems hackable and  hence there is always a need for being vigilant. All networks are exploitable if they are not configured and constructed properly and careful planning and right processes within an organization can help in improving the immunity against security breaches. A poor implementation and lack of a good security policy can render even the best systems vulnerable to hackers attacks.