1.5Attack techniques (2): network and targeted attacks

Unlike a one-shot attack, a targeted attack proceeds through stages from reconnaissance to achieving its objective. By understanding this staged model, a CSIRT member or security analyst can judge "what stage the attack is currently at" and anticipate which stage it is likely to advance to next, enabling proactive countermeasures. This section covers network-based attacks (DoS/DDoS), staged targeted attacks against organizations, and social engineering that exploits human psychology.

1.5.1DoS/DDoS attacks

• A DoS attack overloads a server or network from a single attack source, rendering the service unavailable. A DDoS (distributed) attack launches the attack simultaneously from many compromised devices (e.g., a botnet), achieving a scale that blocking a single source cannot defend against.
• A SYN flood attack exploits TCP's three-way handshake by sending a flood of SYN packets alone, leaving the server holding a huge number of connections awaiting a response (SYN/ACK) and exhausting its resources. Countermeasures include SYN cookies (a mechanism that verifies connections without holding state).
• A reflection attack sends requests with a spoofed source IP (the victim's IP) to third-party servers, causing their responses to reflect onto and concentrate on the victim. An amplification attack abuses protocols such as DNS where the response is larger than the request, flooding the victim with large traffic from a small amount sent by the attacker; it is often combined with reflection.

1.5.2Targeted attacks, APT, and the cyber kill chain

• A targeted attack aims at a specific organization or individual, attempting intrusion via, for example, an email disguised as related to the target's business or a business partner. APT (Advanced Persistent Threat) refers to a sustained targeted attack in which a sophisticated, well-resourced attacker lurks for an extended period while working toward an objective such as information theft.
• The cyber kill chain decomposes a targeted attack into the stages "reconnaissance -> weaponization -> delivery -> exploitation -> installation -> C&C (command and control) -> actions on objectives." The idea is that the stage at which detection/blocking occurs changes the extent of the damage, and detection at an earlier stage (reconnaissance, delivery) is considered more desirable.
• MITRE ATT&CK is a knowledge base that systematically catalogs observed attacker Tactics, Techniques, and Procedures, used by defenders as a common language for assessing the coverage of their own detection and response capabilities. MITRE CAPEC is a catalog of Attack Patterns, used to categorize how a vulnerability can be exploited.

1.5.3Social engineering, BEC, and side-channel attacks

• Social engineering is a general term for techniques that exploit not technical means but psychological gaps in people (deference to authority, manufactured urgency, abuse of trust) to extract confidential information or induce unauthorized actions. It includes phone impersonation and shoulder surfing.
• BEC (business email compromise) is fraud that sends email impersonating an executive or business partner to induce an accounting staff member to make a fraudulent wire transfer. As with a targeted attack, it is often conducted after researching the organization's workflow and business relationships in advance, and verification via a channel other than email (e.g., a phone call) is an effective countermeasure.
• A side-channel attack infers key material or similar not by exploiting a mathematical weakness in the cryptographic algorithm but by observing physical incidental information tied to the implementation, such as processing time, power consumption, or electromagnetic emissions. Countermeasures involve implementations with higher tamper resistance, such as equalizing processing time.

Suppose a manufacturing company's CSIRT is investigating a suspected compromise triggered by a targeted email. First, it is found that an accounting employee received and opened an email with an attachment disguised as coming from a business partner. Against the cyber kill chain, this indicates the delivery stage occurred with a weaponized attachment, and opening it likely achieved exploitation. Next, if the device is found to be periodically communicating with an unfamiliar external IP, this is a sign the attack has progressed to the C&C stage, under the attacker's remote control. At this point, the CSIRT classifies the observed behavior (the initial-access method, the C&C communication pattern) against the MITRE ATT&CK framework to determine which tactics and techniques it corresponds to, and evaluates whether its own detection rules covered that tactic. If detection and blocking had occurred at this stage, the damage could likely have been stopped before the attacker reached actions on objectives (stealing confidential data, demanding money), underscoring the importance of detecting early in the kill chain. In parallel, suppose the accounting department separately received an email impersonating an executive, urgently instructing a wire transfer. This is BEC (business email compromise), involving neither an attachment nor malware, and the effective countermeasure is enforcing a verification procedure via a channel other than email (e.g., a phone call) directly with the executive before transferring funds. If this verification were skipped and the transfer made simply because "the email's wording seemed plausible," that would amount to falling for social engineering (manufactured urgency and abuse of deference to authority). Responding to targeted attacks thus centers on identifying where in the staged model the attack currently sits and combining detection and verification procedures suited to each stage and technique.

1.5.4Section summary

• SYN flood = piles up incomplete handshakes; reflection = reflects traffic via source-IP spoofing; amplification = abuses a larger response size
• The cyber kill chain is a staged model; early-stage detection limits damage. MITRE ATT&CK is a common language for attacker tactics and techniques
• BEC is a form of social engineering that can succeed via email alone; verification through a non-email channel is the core countermeasure. Side-channel attacks exploit physical incidental information tied to an implementation