1_ATTACK & THREATS

1_ATTACK & THREATS

1. MALICIOUS CODE

   • viruses
     • replicates by attaching itself to an authorized piece of executable code
     • it has oppurtunity to infect other files & performs any other nefarious actions
   • Macro Viruses
     • spread of software programming language resulted in a new breed of virus
   • File infectors
   • System or boot-record infectors
   • Stealth & polymorphic viruses
     • techniques have made it more difficult to antivirus software to do their job
     • stealth : to evade being detected by antivirus software that uses checksums or other techniques
     • polymorphic : evade actions by changing the virus itself
   • Trojan Horses
     • piece of software that appears to do one thing but hide another functions
     • stand alone program that must be copied or installed by the user
     • challenge for the attacker is enticing the user to copy and run program
       • the program must be disguised as something that the user would want to run
   • logic Bomb
     • deliberately installed by an authorized user
     • sit dormant until some event invokes its often malicious payload
       • if the trigger some event such as not finding a specific name in the personnel file, code referred as a logic bomb
       • if the event is a specific date/time, the program will referred as time bomb
       • difficult to detect
       • how to prevent?
         • countermeasures - separation of duties
         • countermeasure-periodic review all program and services that running
         • countermeasure : an active backup program
   • Worms
     • code attempts to penetrate networks and computer system
       • once occurs, the work create a copy itself on the penetrated system
     • worm does not rely on attachment of the virus to another piece of code or file
     • Type of Worms
       • The Morris Worm
       • Code Red
       • Slammer
     • protection
       • avoid worm that attach & propagate through email by following guidelines
       • protecting against Morris worm involves securing system and networks against penetration
       • Install Patches
       • eliminate unused & unnecessary services
       • enforce good password
       • use firewalls and ids
   • Droppers

2. Four Categories attack

   • modifcation attack- unauthorize alteration of information
   • repudiation attack - denial that an event or transaction ever occured
   • DoS attack - actions resulting in the unavailability of network resources and services
   • access Attack - unauthorized access to networks resources and information

3. Commoon Attacks

   • DOS
     • attacker attempts to deny authorized users access either to specific information or to the computer or network
       • may prevent access to the target system
       • can be used with other actions to gain authorized access to a computer/network
       • DOS Attack
         • SYN Flood Attack
           • temporarily prevents service to a system to take advantage of a trusted relationship that exist between that system and another
           • take advantage of TCP/IP
           • used to illustrate the principle of any DOS attack
           • how it works?
             • exploit TCP three way handshake used to establish connection between two system
             • attacker send fake communication request to the targeted system
             • non existent IP address is used to request
             • target system drop these connections after a specific time-out period
             • number of connection system can support finite
         • Ping of Death
           • illustrate other type of attack
         • DDoS
           • multiple attacking system
           • network agents is created by the attacker upon receiving the attack command, the attack agents commence sending a specific type of traffic against target
   • Back Door
     • Trapdoor : hardcoded password to gain access the program if administrator forget the system password
     • backdoor: ensure that they have unrestricted access to the system even if initial access method is discovered and blocked
   • Spoofing
     • when a message is sent in your name from an address different than your own
   • Man In the middle
     • when attackers place themselves in the middle two other hosts that are communicating to view/ modify traffic
   • Replay
     • attacker capture a portion of a communication between two parties and transmit it
   • TCP Hijaclking
     • process of taking control of an already existing client between a client and a server.
   • Fragmentation Attacks
   • Weak Keys
     • certain encryption algorithm may have specific keys that yield poor or easily decrypted, ciphertxt
   • Mathematical Attacks
   • Social Engineering
     • depends on lies and misrepresentation that attacker tried authorized users to obtain information or access to which they would not be entitled
   • Port Scanning
   • Dumpster Diving
   • Birthday Attacks
     • special type of brute force attack and get its name from birthday paradox and quite larger
   • Password Guessing
     • the most common form of authentication is userid and password combination
     • Dictionary attack
       • a method of determining password is to use a password cracking program
     • Brute-Force Attack
       • entails the password cracking program attempting all possible password combincation
       • 2 level of attack
         • an attack on system with attacker attempting to guess the oassword at the login prompt
         • an attack against the list of password contained in a password file
   • Software Exploitation
     • an attack that takes advantages of bugs or weakness in software
     • Buffer OverFlow
   • Inappropriate System use
   • Eavesdropping
   • War Driving
     • wardriving refers to the activity where attackers wander throughout an area with a computer with wireless capability searching for wireess networks they can access
   • TCP Sequence number attack
   • War dialing/demon-dialing attack
     • wardialing is an attacker's attempt to discover unprotected modem connections to computer system and networks
   • Sniffing
     • software/hardware to observe traffic as it passes trough a network on shared media
     • network device connect a computer to a network is designed to ignored all traffic that is not destine for that computer