- [Instructor] There are many types of evasion techniques
used by attackers nowadays,
that they use to avoid being detected
by technologies and security products.
Here I'm actually gonna cover some of the most popular ones.
So starting, the first one is the use of encryption.
And there are many use cases
where an attacker will actually breach a network
and then launch some type of form of VPN session
to encrypt the data.
Or encrypt the data that he's actually stealing.
Not only in transit but also at rest
so that will avoid being inspected or detected
by any security device like IPS
or other types of data loss prevention systems and so on.
They also use encryption for encrypting the communication
from a compromised system to a command and control system
so that he or she can actually use that connection
to manipulate and send instructions
to actually that compromised system.
Another type of evasion techniques,
is the use of resource exhaustion attacks,
so the denial of service attacks,
that can be used to evade detections and simply distract,
of course the administrator
and then of course, launch a more sophisticated attack
to potentially steal data and extra trade information.
A simple definition of a resource exhaustion
is actually consuming the resources necessary
to perform an action.
And in some cases actually,
it can be launched against a security technology
or a security product like an IPS device.
So if you can actually consume the resources
from that device, perhaps,
you can launch a successful attack,
other than just a denial service attack of course.
Now, another novation techniques is traffic fragmentation.
So network technologies expect traffic
to move in a certain way, known as the DCPIP suite.
So understanding how this works
can help identify when something is actually operating
in an unusual behavior.
So fragmenting traffic is actually a method
to avoid detection by breaking up a single internet protocol
or IP data gram into multiple smaller size packets.
And the actual goal
is to abuse the fragmentation protocol within IP
and then creating a situation
where the attackers intended traffic is actually ignored.
Or let through as trusted traffic
by a firewall or an IPS device
or any other security product.
So the good news is actually
that most modern intrusion detection
and intrusion prevention systems
are aware of this type of attacks,
and actually can prevent it fairly easily.
IPS products should be able to properly reassemble packets
to evaluate them
and to see if actually they're malicious or not.
So this actually includes understanding
the proper order of these packets.
Unfortunately attackers actually have various techniques
that they can actually use
to confuse an IPS solutions during the reassembly process.
An example of this is actually using a TCP segmentation
and reordering attack
designed to confuse the actual detection tool.
And they do that by actually sending traffic
in a non inspected method,
which actually hopes that it can properly reassemble
the traffic and identify it being as malicious
in some cases.
security devices that cannot perform traffic reassembly
will automatically fail to prevent this type of attacks.
So some security devices actually will fail
when the attacker reorders or fragments the traffic
with enough tweaks in order to accomplish this bypass.
Now, another type of evasion techniques
is a protocol level misinterpretation.
So a protocol as you know
is a set of rules or data structures
that actually governs how computers or the network devices
actually exchange information over a network.
So a protocol actually can be manipulated
to confuse security devices
from properly evaluating traffic.
And this is done because many devices and applications
expect network communications
to follow the industry defined rules
when the protocol is actually used.
So the key understanding on how the protocols should work
and attempting to see if the developer
of the receiving system, define defenses such as limitations
to what is actually accepted,
a method to actually validate what is actually received
and many others.
Now, the second key piece
is actually identifying what happens
when a receiving system encounters
something that doesn't understand seeing or inspecting.
And that of course, can cause a failure
and failures will cause traffic to be ignored
or be dropped or delayed,
which can all be used to an attacker's advantage
to then, of course, evade being detected
and also allow for him or she to actually steal information
from the corporate network.
Another type of attack that is used for evasion
is timing attacks.
So in cryptography actually a timing attack
is a site channel attack,
which the attacker actually attempts
to compromise a cryptosystem.
And he does that by analyzing the time
that is actually taken
to execute the cryptographic algorithms.
And they're very opportunistic attacks.
So every logical operation in a computer
takes actually time to execute.
And the time can actually be different
based on the input and different type of measurements,
or different type of environmental factors.
So if an attacker actually can work backwards to the input,
and predict and be able to actually do again,
just like the word says, very timely measures,
it actually can cause an evasion in a lot of situations.
How much such information actually can help attackers
depend on the many variables that actually are present.
So that includes the crypto system design,
the CPU actually running the system,
algorithms used, sorted implementation details,
the other type of countermeasures that may be in place.
Also the accuracy of the timing measurements and so on.
So timing attacks are actually often overlooked
in the design phase
because they're so dependent on the actual implementation.
So again, timing attacks
are yet another form of evasion techniques
actually used by attackers to avoid being detected.