Understanding Network Attacks, Cyber Threat Intelligence (CTI)
MAC Flooding
As a graduate am a dedicated computer science graduate with a strong foundation in technology and innovation. With a passion for problem-solving and a keen interest in advancing his technical knowledge, Stephen is equipped with the skills and drive needed to tackle complex challenges in the tech world. His academic journey has laid the groundwork for a promising career in computer science, making him a valuable asset in any tech-driven environment.
MAC flooding involves the flooding of the CAM table with fake MAC address and IP pairs until it is full.
The Switch then acts as a hub by broadcasting packets to all machines on the network, and therefore, the attackers can sniff the traffic easily.
macof is a network attack tool included in the d sniff suite, primarily used for flooding a network switch with fake MAC addresses. Generates a massive number of fake MAC addresses and sends them to a network switch. This can overflow the switch’s MAC address table (CAM table), which is where the switch stores the mapping between MAC addresses and physical ports.
Cyber Threat Intelligence (CTI) is defined as the collection and analysis of information about threats and adversaries and drawing patterns that provide an ability to make knowledgeable decisions for the preparedness, for the preparedness, prevention, and response actions against various cyber- attacks.
Cyber threat intelligence helps the organisation to identify and mitigate various business risk by converting unknown threats into threats, and helps in implementing various advanced and proactive defence strategies.
Types of Threat Intelligence
(1) Strategic: High level information on changing risks. Consumed by High-Level Executives and Management.
(2) Tactical: Information on attacker’s tactics, techniques and procedure (TTP’s) mostly consumed by IT Service and SOC Managers, Administration.
(3) Operational: Information on specific incoming attacks. Consumed by Security Managers, Network Defenders.
(4) Technical: Information on specific indicators of compromise. Consumed by SOC Staff, IR Teams.
Threat Intelligence Sources (Cont’d)
Social Media Intelligence (SOCMINT)
(1) Facebook
(2) Linkedin
(3) Twitter now (X)
(4) Whatsapp
(5) Instagram
(6) Telegram
Cyber Counterintelligence (CCI)
Information is collected from proactively established security infrastructure or by employing various threat manipulation techniques to lure and trap threats.
CCI Sources:
(1) Honeypots
(2) Passive DNS Monitors
(3) Online web trackers
(4) Sock puppets (Fake profiling) on online forums.
(5) Publishing false reports.
