Network Threats

Network Threats

1. Malware

   • viruses
     • attactes itself to programs or files on a computer server
       • infecting
       • replicating itself
         • difficult to get rid of
           • a sinlge infected file will evenetually reinfect other files
       • designed to corrupt or delete data
     • installed withour your knowledge
     • spread easily
       • if a user sends an infected file to someone else
   • trojan horses
     • designed to be misleading
     • example
       • email sent from a bank asking to download software
         • to give unauthrised access to a system
       • harmless application
         • running real itent in the background
           • allowing someone elses access to your system
   • worms
     • a standalone program
       • does not need to attach itself to an existing program
         • in order to spread
     • replicates itself in order to spread
       • to other computers using a computer network
         • exploiting vunerabilites
       • until the server crashes
   • malicious software
     • software which is damaging ormalicios to a computer
   • browser malware
     • adware
       • displays unwanted pop-up ads
         • taking you to unwanted websites
     • clikc fruad
       • directing to a website
         • send a mouse click to adverts
           • every click makes them money
           • activity in the backgorund
     • pharming
       • infects your browser
         • redirecting you to a fake website
           • giving your computer a differnet IP address
           • recording details given to the website
             • username and credit card details
   • other malware
     • spyware
       • spies on your computer
         • looking for personal data
           • using a key logger
             • records every key pressed
     • randsomeware
       • ecypts data
         • making it unable to use
           • demanding a randsom to unlock it
     • scareware
       • scares people
         • into downloading software
         • "you have a virus"
     • rootkits
       • give other people permission to access you computer
         • access remotely
           • runs in the backgroud

2. SQL injections

   • taking advantage of web input forms
     • to access or destroy data
       • by inputting SQL commands
         • on a database that uses SQL
         • malicious code
   • access systems containing sensitive data
     • then they could:
       • bypass authentication procedures
         • pretend to be specific users
       • execute queries
       • expose, alter or delete data

3. distributed denial of service attacks

   • DDOS
   • preventing legitimate users from connecting to a server
     • by flooding the server with millions of bogus requests
       • so many requests that the CPU cycles are used up
         • the server crashes
       • an ISP or data centre will try to block these requests
         • difficult
           • requests sent from random computers
       • crimals may use it:
         • as a punishement
           • for unethical behnaviour
         • to demand money
           • to stop
   • often involves thousands of computers
     • infected with botnet malware

4. brute force attacks

   • hacker goes through a list of passwords
     • until access is gained
   • tries every combination of characters
     • until the correct password is found
   • used for gaining access to password based entry systems
     • dictionary method
       • uses the most popular words in the dictionary
       • words can be applied quickly

5. social engingeering

   • relies on human interation and weaknesses
     • involve tricking users
     • phising
       • attempt to gain sensitive information
         • mostly done by email
           • signs
             • greetings
               • are not personalised
               • sender doesnt know your name
             • senders address
               • not genuine
               • often a variation of a genuine address
             • request for personal information
               • genuine organisations wouldnt do this
             • sence of urgency
               • criminals use persuation
               • make you feel like something bad will happen
                 • if you dont act quickly
             • poor spelling and grammar
             • forged link
               • link is not secure
               • may look genuine but not for the website given
                 • can be checked by rolling your mouse over the link
           • presumably legitamate email is sent
             • however it urgers you to a bogus website
             • urging personal details
       • 5% success rate
         • phishers send hundreds of thousands of emails
       • Telephone Phising
         • IVR
           • interactive Voice Response
         • direct phone ca;;s that pretend to be an offical service
           • request similar things to a bank
             • to gain banking details
           • ask for personal details
             • bank number or PIN
     • sholder surfing
       • involving observing a user entering their security details

6. cyber crime

   • takes advantages of human weaknesses
     • as well as technical weaknesses in computer systems and networks

7. eavesdropping

   • used to intercept data packets
     • as they move across a network
     • by inspecting then for useful data
       • that could be misued or sold
     • without damagingthe data
     • users is unaware the data has been extracted
   • carried out by some security angencgies
     • to gather information
   • man in the middle attack
     • extra server or router is places in the network
       • to redirect packets
         • before sending them on and copying them
     • passive attack