Karteikarten
System attacks: brute force, DoS, buffer overflow, injection
Karten in diesem Stapel (5)
- 1Name some of the possible attacks• Brute force on crypto or passwords
• Denial of Service
• Buffer overflow
• Code injection and fault injection
• Type confusion
• Timing
• Hardware: power analysis and probing - 2Explain the concept of Brute force on crypto or passwords• As the name suggests, iterating over all
possible keys / passwords trying to guess
• Can be very effective for weak passwords
• Guest/guest accounts (happened to me),
empty passwords, default factory usernames
and passwords that are never changed
• Scripts and computer programs take on the
job of trying one by one
• Defence: strong keys/passwords, failure delays - 3Explain the concept of Denial of ServiceAlso a kind of brute force attack
• But with different purpose – disable or disrupt
the functionality of the system, rather than
gain access
• Attack on availability mostly
• Method: overload the system with work /
requests
• A single source DoS is easy to detect,
Distributed DoS (DDoS) more difficult
• Sometimes can be inadvertent
• Example: buying tickets on-line for a hot show,
game, or any other event on a release date
• Defence: detection and access limitation,
failure delays
• DoS is particularly dangerous for safety critical
systems with real-time requirements
• That is, a lot of embedded systems - 4Explain the concept of Buffer Overflow• Generally a scenario where a program is asked
to either read or write beyond the boundary
of the prescribed or allocated memory
• See the Heartbleed attack we discussed
previously, this is for reading
• A writing one can be used to disrupt the
system or take it over, by injecting some code
• How and if it works depends on the memory
map of the device that the code is run on - 5Explain the concept of Code injection and fault injection
Informationen
- Beschreibung
- Karteikarten am Ohne Titel, erstellt von Stina Berg am 07/03/2019.
- Erstellt von
- Stina Berg
- Aufrufe
- 0
- Bewertung