Network Security

 

A ping flood DDoS attack, also known as a Ping flood attack, is a common Denial-of-Service (DoS) attack in which an intruder tries to overcome a targeted device with ICMP echo requests. Typically, ICMP echo-request and echo-reply messages are used to ping a network device to diagnose the device's health and connectivity and the link between the sender and the device. 

The network is forced to respond with an equal number of reply packets by flooding the target with request packets. This causes the target to become unavailable to regular traffic. A ping attack demands that the intruder knows the IP address of the destination. Attacks can be divided into three kinds, arranged by the target and how the IP address is resolved:

• Blind ping – This involves using an external program to reveal the IP address of the target computer or router before launching a DDoS attack.

• Router disclosed – the ping flood targets routers to obstruct information between computers on a network. In this type of DDoS attack, the attacker must have the internal IP address of a local router. 

• Targeted local disclosed – In this type of DDoS attack, a ping flood targets a specific computer on a local network. In this case, the attacker must collect the IP address of the target already. 

 

Phishing:

Scammers use email or text information to deceive you into providing them your data. They may try to steal your passwords, account numbers, or Social Security numbers. If they get that data, they could obtain your email, bank, or other accounts. Phishing emails and text communications may look like they're from a business you know or trust. 

They may look like they're from a bank, a credit card company, a social networking site, an online payment website or app, or an online store. Phishing emails and text messages often tell a tale to deceive you into clicking on a link or opening an attachment. 

They may say they've noticed some suspicious activity or log-in attempts, claim there's a problem with your account or your payment information, say you must confirm some personal data, include a fake invoice, want you to click on a link to make a payment, say you're qualified to register for a government refund, offer a coupon for free goods.

 

Password Cracking:

Password cracking means obtaining passwords from a computer or data that a computer broadcasts. This doesn't have to be a sophisticated method. A brute-force attack where all potential combinations are examined is also password cracking. If the password is saved as plaintext, hacking the database gives the attacker all account data. 

However, now most passwords are stored using a key derivation function (KDF). This takes a password and runs it through a one-way encryption cipher, creating what's known as a "hash." The server stores the hash-version of the password. It's easy to try different hashed passwords at a high rate when using a GPU or botnet. 

That's why most password hash functions use key stretching algorithms, which increase the resources (and, therefore, time) needed for a brute-force attack. Some methods of password cracking become significantly more complicated if your password uses salting or key stretching. Unfortunately, there are still some services that store unencrypted or poorly encrypted passwords on their servers. The best practices for passwords are long lengths, combining letters, numbers, and special characters. Never re-use. Avoid easy-to-guess words.