Principles of Information Security: Cryptographic Attacks (Brute Force, Man‑in‑the‑Middle, Replay)

Cryptographic Attacks (Brute Force, Man‑in‑the‑Middle, Replay)

Cryptographic Attacks Study Guide: Brute Force, Man-in-the-Middle (MitM), Replay

For CISSP, Security+, CEH, and Real-World Security Roles

What This Is

Cryptographic attacks exploit weaknesses in encryption, key management, or authentication to steal data, impersonate users, or disrupt systems. These attacks are critical because they bypass security controls that protect confidentiality, integrity, and availability (CIA Triad). For example: - Brute Force: In 2012, LinkedIn suffered a breach where attackers used brute force to crack 6.5 million hashed passwords, leading to credential stuffing attacks.
- Man-in-the-Middle (MitM): In 2017, the KRACK attack exploited Wi-Fi WPA2 vulnerabilities to intercept and decrypt traffic between devices and routers.
- Replay: In 2018, attackers exploited replay vulnerabilities in Tesla’s key fob system to clone signals and unlock cars.

Understanding these attacks helps you design defenses, detect intrusions, and respond to incidents—key skills for certifications and real-world roles.

Key Terms & Concepts

• Brute Force Attack: A trial-and-error method to guess passwords, encryption keys, or session tokens by systematically trying all possible combinations. Tools: John the Ripper, Hashcat, Hydra.

• Example: Cracking an 8-character password with uppercase, lowercase, and numbers (~218 trillion combinations) using a GPU cluster.

• Dictionary Attack: A subset of brute force that uses a precomputed list of common passwords (e.g., "password123") or leaked credentials. Tools: RockYou.txt wordlist, CeWL.

• Standard: NIST SP 800-63B recommends banning common passwords to mitigate this.

• Rainbow Table Attack: Uses precomputed tables of hash values (e.g., MD5, SHA-1) to reverse-engineer passwords. Defenses: Salting (adding random data to hashes) and peppering (secret key).

• Example: Cracking unsalted Windows NTLM hashes with Ophcrack.

• Man-in-the-Middle (MitM) Attack: An attacker secretly intercepts and possibly alters communications between two parties who believe they are directly communicating. Variants:

• ARP Spoofing: Poisons ARP caches to redirect traffic (Layer 2).
• DNS Spoofing: Redirects users to malicious sites (e.g., phishing).
• SSL Stripping: Downgrades HTTPS to HTTP (e.g., SSLstrip tool).

• Standard: MITRE ATT&CK T1557 (Adversary-in-the-Middle).

• Replay Attack: Captures and retransmits valid data (e.g., authentication tokens, session IDs) to gain unauthorized access. Defenses: Timestamps, nonces (one-time random numbers), sequence numbers.

• Example: Replaying a captured RFID badge signal to unlock a door.

• Downgrade Attack: Forces a system to use weaker encryption (e.g., TLS 1.0 instead of TLS 1.3) to exploit known vulnerabilities. Example: POODLE attack (SSL 3.0).

• Defense: Disable weak protocols (e.g., SSLv3, TLS 1.0/1.1) via NIST SP 800-52.

• Side-Channel Attack: Exploits physical implementation flaws (e.g., timing, power consumption, electromagnetic leaks) to extract keys. Example: Spectre/Meltdown (CPU cache attacks).

• Defense: Constant-time algorithms, hardware security modules (HSMs).

• Birthday Attack: Exploits the birthday paradox to find hash collisions (two inputs with the same hash) faster than brute force. Affects MD5, SHA-1.

• Example: Creating a malicious file with the same hash as a legitimate one to bypass integrity checks.

• Kerberos Golden Ticket Attack: Forges a Kerberos Ticket Granting Ticket (TGT) to impersonate any user (e.g., domain admin). Tool: Mimikatz.

• Defense: Monitor for unusual TGT lifetimes (default: 10 hours) and abnormal authentication patterns.

• Pass-the-Hash (PtH): Uses stolen password hashes (e.g., NTLM) to authenticate without cracking them. Tool: Impacket.

• Defense: Enforce credential hygiene (e.g., LAPS for local admin passwords).

• Padding Oracle Attack: Exploits error messages in block cipher modes (e.g., CBC) to decrypt data. Example: POODLE, BEAST attacks.

• Defense: Use authenticated encryption (e.g., AES-GCM).

• Cryptographic Agility: The ability to quickly switch algorithms or key lengths (e.g., from RSA-2048 to RSA-4096) in response to new threats. Required by NIST SP 800-131A.

Step-by-Step: Defending Against Cryptographic Attacks

1. Assess Vulnerabilities (Risk Assessment)

• Identify weak algorithms: Audit systems for DES, 3DES, MD5, SHA-1, RC4, or RSA < 2048-bit.
• Tool: Nmap (--script ssl-enum-ciphers), OpenSSL (openssl s_client -connect example.com:443).
• Check for missing controls:
• Brute Force: Account lockout policies, rate limiting.
• MitM: Certificate pinning, HSTS (HTTP Strict Transport Security).
• Replay: Session timeouts, nonces, timestamps.

2. Harden Cryptographic Systems

• Brute Force Defenses:
• Enforce complex passwords (NIST SP 800-63B: 8+ chars, no complexity rules).
• Use multi-factor authentication (MFA) (e.g., TOTP, FIDO2).
• Implement account lockout (e.g., 5 failed attempts → 30-minute lockout).
• Deploy rate limiting (e.g., fail2ban, Cloudflare WAF).
• MitM Defenses:
• Encrypt all traffic: Enforce TLS 1.2+ (disable SSLv3, TLS 1.0/1.1).
• Certificate pinning: Hardcode expected certificate hashes (e.g., HPKP, Android apps).
• ARP/DNS protection: Use static ARP entries, DNSSEC.
• HSTS: Force HTTPS via Strict-Transport-Security header.
• Replay Defenses:
• Timestamps: Reject requests older than 5 minutes.
• Nonces: Use one-time random values (e.g., OAuth 2.0 state parameter).
• Sequence numbers: Track and reject duplicate packets (e.g., IPSec).

3. Monitor and Detect Attacks

• Brute Force:
• SIEM alerts: Multiple failed logins from the same IP (e.g., Splunk query: sourcetype=authentication action=failure | stats count by src_ip).
• Tools: Fail2ban, OSSEC, CrowdStrike.
• MitM:
• Network anomalies: Unusual ARP/DNS responses, unexpected certificate warnings.
• Tools: Wireshark (ARP spoofing detection), Zeek (Bro), Darktrace.
• Replay:
• Log analysis: Duplicate session IDs or timestamps.
• Tools: ELK Stack, Graylog.

4. Respond to Incidents

• Brute Force:
• Contain: Block the attacker’s IP (firewall rule, WAF).
• Eradicate: Reset compromised passwords, enable MFA.
• Recover: Review logs for lateral movement (e.g., Pass-the-Hash).
• MitM:
• Contain: Isolate affected systems, revoke compromised certificates.
• Eradicate: Patch vulnerable software (e.g., OpenSSL, Wi-Fi drivers).
• Recover: Reissue certificates, enforce HSTS.
• Replay:
• Contain: Invalidate stolen tokens/sessions.
• Eradicate: Rotate keys, update nonces.
• Recover: Audit for unauthorized access.

5. Test Defenses (Red Teaming)

• Brute Force: Use Hydra to test password policies.
• MitM: Simulate ARP spoofing with Ettercap or Bettercap.
• Replay: Capture and replay traffic with Burp Suite or Scapy.
• Compliance: Validate against NIST SP 800-53 (AC-7, SC-12), ISO 27001 (A.10.1.1).

Common Mistakes

Certification Exam Tips

CISSP

• Management vs. Technical: CISSP focuses on risk management, governance, and cryptographic lifecycle (e.g., key rotation, algorithm selection) rather than hands-on tools.
• Example Question: "Which NIST standard guides cryptographic key management?" → NIST SP 800-57.
• Tricky Distinctions:
• Brute Force vs. Dictionary Attack: Brute force tries all combinations; dictionary uses wordlists.
• MitM vs. Replay: MitM intercepts/alters traffic; replay retransmits valid data.

Security+

• Ports and Protocols: Know which attacks target which layers:
• ARP Spoofing (Layer 2), DNS Spoofing (Layer 7), SSL Stripping (Layer 7).
• Tools: Be familiar with Wireshark (MitM), John the Ripper (brute force), Burp Suite (replay).

CEH

• Hands-On Focus: CEH tests attack tools and techniques:
• Brute Force: Hydra, Medusa.
• MitM: Ettercap, Bettercap, SSLstrip.
• Replay: Scapy, Burp Suite.
• Countermeasures: Know specific defenses (e.g., HSTS for SSL stripping, nonces for replay).

General Tips

• ⚠️ "Best Defense" Traps: Exams often ask for the most effective defense. For brute force, MFA > password complexity.
• Algorithm Lifespans: Know which algorithms are deprecated (e.g., MD5, SHA-1, DES) vs. recommended (e.g., AES-256, SHA-3, RSA-4096).

Quick Check Questions

1. An attacker intercepts and retransmits a valid authentication token to gain access to a web application. Which attack is this?

A) Brute Force B) Man-in-the-Middle C) Replay D) Downgrade ✅ Answer: C) Replay
Explanation: Replay attacks involve retransmitting valid data (e.g., tokens, session IDs) to impersonate a user.

2. A security analyst notices multiple failed login attempts from the same IP address. Which of the following is the BEST immediate action to mitigate this attack?

A) Disable the account B) Implement account lockout after 5 failed attempts C) Block the IP address at the firewall D) Enforce password complexity ✅ Answer: C) Block the IP address at the firewall
Explanation: Blocking the IP is the fastest way to stop a brute force attack in progress. Account lockout (B) is a good long-term control but doesn’t stop the current attack.

3. During a penetration test, an attacker downgrades a TLS 1.3 connection to TLS 1.0 to exploit a known vulnerability. Which attack is this?

A) Replay B) Downgrade C) Side-Channel D) Birthday ✅ Answer: B) Downgrade
Explanation: Downgrade attacks force systems to use weaker encryption (e.g., TLS 1.0) to exploit vulnerabilities (e.g., POODLE).

Last-Minute Cram Sheet

1. Brute Force: Guess passwords/keys via trial-and-error. Defense: MFA, rate limiting, account lockout.
2. Dictionary Attack: Brute force using wordlists (e.g., RockYou.txt). Defense: Ban common passwords (NIST SP 800-63B).
3. Rainbow Table: Precomputed hash tables. Defense: Salting + peppering.
4. MitM: Intercept/alter traffic. Variants: ARP spoofing, DNS spoofing, SSL stripping. Defense: HSTS, certificate pinning.
5. Replay: Retransmit valid data. Defense: Timestamps, nonces, sequence numbers.
6. Downgrade: Force weak encryption (e.g., TLS 1.0). Defense: Disable weak protocols (NIST SP 800-52).
7. ⚠️ MD5/SHA-1 are broken – Use SHA-256/SHA-3 for hashing.
8. ⚠️ DES/3DES are insecure – Use AES-256 for encryption.
9. ⚠️ RSA < 2048-bit is weak – Use RSA-4096 or ECC (e.g., secp256r1).
10. ⚠️ Self-signed certs = MitM risk – Use internal CAs or Let’s Encrypt.