CND (312-38) Network Defense Simulation

In this simulation, you will analyze suspicious network authentication traffic. You will learn to identify automated attack signatures from system logs and determine the appropriate defensive controls.

Network Scenario

You are monitoring a DMZ segment containing a Linux Bastion host (Jump Server). The server is configured to accept SSH connections from external networks. Over the past five minutes, the perimeter firewall and the host-based Intrusion Detection System (HIDS) have registered an anomalous spike in traffic destined for TCP port 22.

Traffic & Logs

Source: /var/log/auth.log & Snort IDS Alerts

[**] [1:1000001:1] ALERT: Suspicious SSH Connection Rate [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] 11/04-09:14:21.054322 198.51.100.45:49152 -> 10.0.50.10:22 Nov 4 09:14:21 bastion-host sshd[14522]: Failed password for invalid user admin from 198.51.100.45 port 49152 ssh2 Nov 4 09:14:22 bastion-host sshd[14524]: Failed password for invalid user root from 198.51.100.45 port 49154 ssh2 Nov 4 09:14:23 bastion-host sshd[14526]: Failed password for invalid user test from 198.51.100.45 port 49156 ssh2 Nov 4 09:14:24 bastion-host sshd[14528]: Failed password for sysadmin from 198.51.100.45 port 49158 ssh2 Nov 4 09:14:25 bastion-host sshd[14530]: Failed password for invalid user oracle from 198.51.100.45 port 49160 ssh2

Question

In which of the following attacks does an attacker use software that tries a large number of key combinations in order to get a password?
Hint: Notice the rapid, automated succession of failed login attempts guessing different common usernames in the logs. What term describes methodically "forcing" an entry by exhausting all possible combinations or dictionary lists?

Expert Analysis

1. What is happening in the network

An external IP address (198.51.100.45) is initiating automated, rapid, and sequential TCP connections to the Bastion host on port 22 (SSH). The system's authentication logs show continuous failure events with different, common administrative usernames. The speed (one attempt per second) strongly indicates automated software.

2. Identify attack or behavior

This is a classic Brute Force Attack (specifically, a dictionary attack variation where the software systematically iterates through lists of usernames and password combinations).

3. Why correct answer is correct

B. Brute force attack is correct. By definition, a brute force attack relies on automated tools to try every possible combination of letters, numbers, and symbols (or wordlists) until the correct password is discovered.

4. Why others are wrong

  • A. Buffer overflow: This involves sending more data to an application's memory buffer than it can handle, causing memory corruption to execute arbitrary code. It is not related to password guessing.
  • C. Zero-day attack: This refers to exploiting a previously unknown software vulnerability for which no patch currently exists. The SSH protocol itself is not being exploited here; weak credentials are.
  • D. Smurf attack: A type of Distributed Denial of Service (DDoS) attack involving IP spoofing and ICMP echo requests (ping) broadcasted to a network to overwhelm a target. It is a volumetric attack, not an authentication attack.

5. Defensive action

To defend against this, a Network Defender should implement:

  • Account Lockout Policies: Lock the account after 3-5 failed attempts.
  • Dynamic Filtering / Rate Limiting: Use tools like fail2ban or firewall rate limiting to temporarily drop IP addresses that generate excessive failed logins.
  • Authentication Hardening: Disable password authentication for SSH and enforce Public Key Infrastructure (PKI/SSH Keys) and Multi-Factor Authentication (MFA).
  • Disable Default Accounts: Ensure PermitRootLogin no is set in sshd_config.
MINI LESSON: Detection vs Prevention
In network defense, relying solely on IDS alerts (Detection) is insufficient because a single weak password can compromise the system before an analyst reacts. Prevention requires altering the network architecture or host configuration. Moving SSH off default port 22 reduces log noise from automated scanners, but cryptographic keys combined with dynamic IP blocking (e.g., Fail2Ban) provides the actual defensive barrier against Brute Force behavior.

Ready for the next scenario?

Master network defense analysis and prepare for your CND certification.

Explore more CND simulations