Unfortunately attackers have many ways to infiltrate a network undetected.
Which can obviously make it that much easier for them to succeed and that much harder for us to catch
them in the act.
In this section we're going to take a look at some of the techniques that hackers can use to bypass
network security.
Encryption is the most obvious way to bypass security devices.
If an attacker gained access to a network and wanted to upload sensitive data to an external device
encrypted protocols like S-sh ipe sac and HTP ass could be used HTP inspection is becoming a major requirement
for Enterprise Networks to prevent these types of evasions.
When you are investigating a security event the source IP address of the attacker is important to know
network address translations can also be used to avoid detection.
If an attacker nattered their IP then it could be difficult to detect the real source of the attack.
One way to combat against attackers using that is stealth watches not stitching feature that stitching
can be used to identify IP changes from Nat to track the original source IP to help prevent Nat changes
from affecting security monitoring.
One of the slickest methods I've seen used to hide from security devices is DNS tunneling DNS tunneling
is when an attacker leaks data outside of a network via DNS packets since the DNS protocol ports are
pretty much guaranteed to be allowed on firewalls and IP addresses.
It's an easy way to leak data Tor is a technique used by many to anonymously browse the Internet by
routing traffic through Tor relays.
This way victim networks cannot see the real public source addresses and therefore cannot track down
attackers.
For example if you use the Tor browser to go to Google and I was in San Jose California my traffic could
be relayed through Europe before it was sent to the actual destination and Google would think I was
actually in Europe.
Based on the IP information here I have a tor browser that I downloaded just so you could see what it
looks like.
If you check the resources for the section I'll have a link so you can download this Tor browser.
So if you want to see what public IP address your computer is being nattered to.
You can do what's my IP
so this shows that my IP address is 176 31 39 to 49 which I can assure you is not the IP address that
I'm connecting to the Internet with from my home network so this clearly shows me that my traffic is
definitely being tunneled through a torch relay.
So if I wanted to be hidden from the internet I could use this Tor browser to surf the web which I'm
not going to because I do not do any thing malicious.
But again like you may have heard me say before.
The more tools you can see that malicious users might use the better it is to understand what type of
things you need to look out for and protect your network against
our last monitoring challenge.
We're going to talk about is peer to peer traffic network resources are typically shared with a client
server model P2P networks allow clients to transfer data directly between each other.
This becomes a monitoring challenge because traffic becomes decentralized and increases the potential
for vulnerable sources.