- [Instructor] A backdoor can be installed by an attacker
to either allow future access
or to collect information to use in further attacks.
So when the threat actor gains access to a system,
they usually want future access
so they can control the system
and they can carry other attacks.
And they want that access to be really easy.
Now, many backdoor are installed by users clicking something
without realizing that the link that they clicked
or the file that they opened is actually a threat.
A backdoor can be implemented as a result of a malware
or as a result of a virus or a worm.
And they're very popular nowadays
to be able to actually gain access
to a system and maintain persistence.
Now, let's cover what are man-in-the middle attacks.
Man-in-the-middle attack results when the attacker
place themselves in line between two devices
that are actually communicating.
So the reason that they do this
is they intend to perform reconnaissance
or to manipulate the data
that is actually being transferred
as it moves between those entities.
Now this can happen at layer two or at layer three.
The main purpose of this attack is actually to eavesdrop
so that attacker can actually see the traffic
and of course steal the traffic and manipulate it.
Now, if this happens at layer two,
the attacker spoof the layer two MAC address
to make the devices on the LAN or the local layer network
believe that the layer two address of the attacker
is the layer to address of its default gateway.
And this is often called ARP poisoning.
So this is an example of an ARP poisoning attack.
Now frames that are supposed to go through
the default gateway,
in that case, they're forwarded by the switch
to the layer two address of the attacker
on that same network.
And then as a courtesy,
the attacker can actually forward the frames
to the correct destination so that the client
will have connectivity that they need.
And the attacker now sees all the data
between the two devices.
Now to mitigate this risk,
you can use techniques like ARP inspection.
So ARP stands for Address Resolution Protocol.
So it's the ARP inspection functionality
on Cisco switches to actually prevent spoofing
of the layer two addresses.
Now the attacker could also implement the attack
by placing a switch into the network
and manipulating the Spanning Tree Protocol or STP
to become the root switch.
And then therefore gaining the ability
to actually see any traffic that needs to be sent
throughout the root switch.
A man-in-the-middle attack can also occur at layer three
like I mentioned before,
and this can be done by a rogue router
being placed in the network
and then tricking the other routers into believing
that the new router has a better path in the network.
So this could cause network traffic
to flow through the router, through this rogue router,
and again, allow the attacker to steal network data.
So you can mitigate this attack,
which many different ways,
many different features,
and some of them include
the Routing Authentication Protocols.
So that's a best practice that you should always implement.
You should implement the authentication
in routing protocol within the organization.
Also you can filter information from being advertised
or learned on a specific interface.
So all those best practices
will actually mitigate those type of layer three
rogue router attacks.
A man-in-the-middle attack can also occur
by compromising the victim's machine.
So the attacker can install malware
that can intercept the packets sent by the victim
and send them directly to the attacker.
So this type of malware can capture packets
before they're encrypted.
And if the victim,
of course, is using TLS or SSL or HTPS
or any other mechanisms,
actually those packets are stolen
or being sent to attacker
even before they're actually encrypted.
So think about that you're accessing a bank
through your browser
and then, of course the attacker can install malware
that before the browser actually encrypts the data
to the bank or vice versa
after the decryption is actually done,
that data can be sent to the attacker.
Now to safeguard data in motion,
one of the best things you can do
is to use of course encryption
for the confidentiality of the data in transit.
If you use plain text protocols for management
like Telnet or HTTP, definitely you're asking for it.
The attacker who has implemented
the man-in-the-middle attack can definitely see the contents
of those data packets,
the clear text data packets across the network.
So that's why management protocols
must have encryption built in.
So you should actually use things
like Secure Shell or SSH and HTTPS.
And definitely, consider that as a best practice.
And also for in transit traffic,
the use of VPN is definitely a given.
So you want to actually use a VPN
to protect and encrypt data, sensitive data,
that is actually transferred in an untrusted network
like the internet.