Tấn công mạng (Network Attack) là gì?
Là các hành vi cố ý nhằm xâm phạm tính bảo mật, toàn vẹn, sẵn sàng của hạ tầng mạng, hệ thống, dữ liệu. Phân loại chính: Passive (Thụ động) – quan sát, nghe lén; Active (Chủ động) – sửa đổi, phá hủy, từ chối dịch vụ.
Phân loại chi tiết theo MITRE ATT&CK & Kill Chain
1. Reconnaissance (Tìm kiếm thông tin) – Tactic: TA0043
- Active Scanning: Port scan (Nmap, Masscan, ZMap), Vulnerability scan (Nessus, OpenVAS).
- Passive Recon: OSINT (Shodan, Censys, FOFA, ZoomEye), DNS enumeration, Certificate Transparency logs, Social media, Job posting.
- Network Sniffing: ARP sniff, DHCP listen, mDNS/SSDP, BGP monitoring.
2. Initial Access (Truy cập ban đầu) – TA0001
- Phishing / Spearphishing: Email/SMS/Teams/Slack chứa link/file độc hại (Macro, ISO, LNK, HTML smuggling).
- Exploit Public-Facing Application: CVE trên Web Server, VPN, Firewall, Exchange, Citrix, FortiGate, Pulse Secure.
- External Remote Services: VPN, RDP, SSH, Citrix, VNC với credential yếu/leak/reuse.
- Drive-by Compromise / Watering Hole: Khách truy cập web bị inject malicious script.
- Supply Chain Compromise: SolarWinds, Kaseya, 3CX, Dependency confusion, Typosquatting (npm/PyPI).
- Trusted Relationship: Xâm nhập qua partner/vendor/managed service provider.
3. Execution / Persistence / Privilege Escalation / Defense Evasion
- Living off the Land (LOLBins): PowerShell, WMI, Certutil, Mshta, Regsvr32, Rundll32, Schtasks, Bitsadmin.
- Credential Access: LSASS dump (Mimikatz, ProcDump), DCSync, Kerberoasting, AS-REP Roasting, NTDS.dit, Browser credential store, Wi-Fi profile.
- Lateral Movement: Pass-the-Hash/Ticket, SMB/WinRM/SSH/RDP lateral, DCOM, WMI, SMB admin shares, SSH key reuse.
- Command & Control (C2): DNS tunneling, HTTPS/HTTP(S), Cloud API (GitHub, Azure, AWS), Domain Fronting, WebSocket, QUIC, Tor/I2P.
- Exfiltration: Compressed/Encrypted staging, Exfil over C2 channel, Cloud storage (OneDrive, GDrive, S3), DNS exfil, Physical media.
- Impact: Ransomware (Encrypt + Extort), Wiper, Data Destruction, Disk Wipe, Firmware Corruption, Resource Hijacking (Cryptojacking), Service Stop.
Top 10 Kỹ thuật tấn công mạng phổ biến nhất 2023-2024 (Theò MITRE ATT&CK / Verizon DBIR / IBM X-Force)
- T1566.001 – Phishing: Spearphishing Attachment/Link (Vector #1 initial access).
- T1190 – Exploit Public-Facing Application (Log4j, ProxyNotShell, CitrixBleed, FortiOS, MoveIT).
- T1078 – Valid Accounts (Credential stuffing, Password spray, Initial Access Broker, Infostealer log).
- T1021.004 – Lateral Movement: Pass the Hash (NTLM relay, PetitPotam, Shadow Credentials).
- T1003.001 – OS Credential Dumping: LSASS Memory (PPL bypass, Comsvcs.dll, WerFault).
- T1486 – Data Encrypted for Impact (Ransomware) (LockBit, BlackCat/ALPHV, Cl0p, Akira, RansomHub).
- T1059.001 – Command & Scripting: PowerShell (AMSI bypass, ScriptBlock logging bypass).
- T1071.001 – Application Layer Protocol: Web Protocols (C2 over HTTPS/HTTP).
- T1567.002 – Exfiltration to Cloud Storage (rclone, Azure Storage Explorer, AWS CLI).
- T1584.001 – Compromise Infrastructure: Domains (Typosquatting, Expired domains, DGAs).
Các lớp tấn công theo mô hình OSI/TCP-IP
| Layer | Tấn công điển hình |
|---|
| L1 Physical | Fiber tapping, Cable cutting, Hardware implant, TEMPEST, USB drop attack (BadUSB). |
| L2 Data Link | ARP Spoofing, MAC Flooding (CAM table overflow), VLAN Hopping (Double tag, Switch spoofing), STP Attack, DHCP Starvation/Rogue, LLDP/CDP Recon. |
| L3 Network | IP Spoofing, ICMP Redirect, BGP Hijacking, Route Injection, IP Fragmentation Attack, Smurf/Fraggle (DDoS). |
| L4 Transport | SYN Flood, TCP RST Injection, UDP Flood, Port Scan, Session Hijacking (TCP Sequence Prediction). |
| L5-7 Application | SQLi, XSS, CSRF, SSRF, RCE, Deserialization, API Abuse, Business Logic Flaw, DNS Tunneling, DoH/DoT Abuse. |
Phòng chống toàn diện (Defense in Depth cho Network)
| Lớp | Công nghệ / Biện pháp |
|---|
| Perimeter | Next-Gen FW (App-ID, SSL Decrypt, IPS, Anti-Virus, File Blocking, WildFire), DDoS Protection (Cloud/On-prem), WAF, DNS Security (RPZ, DNSSEC, DoH Block). |
| Network Segmentation | VLAN, Micro-segmentation (VMware NSX, Cisco ACI, Illumio, Guardicore), Zero Trust Network Access (ZTNA), East-West Firewall. |
| Detection | NDR (Zeek/Suricata + ML), NTA, Flow Analysis (NetFlow/IPFIX), IDS/IPS, Honeypot/Deception, TLS Inspection (Policy-based). |
| Endpoint | EDR/XDR (Behavioral, Memory scan, Kernel sensor), App Control, USB Control, Patch Management, Tanium/Osquery Live Query. |
| Identity | MFA (FIDO2/WebAuthn/Passkey), PAM (Session recording, JIT), Conditional Access, Identity Threat Detection (ITDR), Tiered Admin Model. |
| Data | DLP (Network/Endpoint/Cloud), Encryption (TLS 1.3, IPsec, S3 SSE-KMS, TDE), DSPM, Tokenization, Key Management (HSM). |
| Operations | SIEM/SOAR (Correlation, UEBA, MITRE ATT&CK Mapping), Threat Intel Platform (TIP), Threat Hunting Program, IR Playbook, Tabletop Exercise, Red/Purple Team. |
Kết luận
Tấn công mạng ngày càng tinh vi, tự động hóa, tận dụng lỗ hổng zero-day, supply chain, identity. Phòng thủ hiệu quả không phải "mua thêm firewall" mà là chiến lược Zero Trust + Defense in Depth + Visibility (Log/NDR/EDR) + Automation (SOAR) + Threat Intelligence + People (Training/Hunting). Giả định đã bị xâm nhập (Assume Breach) → Tối thiểu hóa tác động (Blast Radius) → Phát hiện sớm (Reduce Dwell Time) → Phản ứng tự động (Reduce MTTR).
