Cryptography and Network security # Lecture 3

Cryptography and Network security # Lecture 3

• 1.
  Lec-3: Cryptography &Network Security Mr. Islahuddin Jalal MS (Cyber Security) – UKM Malaysia Research Title – 3C-CSIRT Model for Afghanistan BAKHTAR UNIVERSITY ‫باخترپوهنتون‬ ‫د‬ Bakhtar University 1
• 2.
  Outlines to bediscussed…. Today • Different types of Attacks and Threats • Virus • Worms • Trojan Horse • Botnet • Trap doors • Logic Bomb • Spyware Bakhtar University 2
• 3.
  Virus • Infects Executableprogram by appending its own code so that it is run every time the program runs • Viruses may be destructive (by destroying/altering data) may be designed to “spread” only. • Although they do not carry a dangerous “payload”, • they consume resources and may cause malfunctions in programs if they are badly written and should therefore be considered dangerous!. • Viruses have been a major threat in the past decades but have nowadays been replaced by self-replicating worms, spyware and adware as the no. 1 threat! Bakhtar University 3
• 4.
  Types of Virus •Boot Sector Virus : Spreads by passing of floppy disks. Substitutes its code for DOS boot sector or Master Boot Record. Used to be very common in 1980ies and 1990ies. • Polymorphic Virus: Virus that has the ability to “change” its own code to avoid detection by signature scanners. • Macro Virus: Is based on a macro programming language of a popular application (e.g. MS Word/Excel, etc.). • Stealth Virus: Virus that has the ability to hide its presence from the user. The virus may maintain a copy of the original, uninfected data and monitor system activity Bakhtar University 4
• 5.
  Trap Door • Alsocalled Backdoors • Bits of code embedded in programs by the programmer(s) to quickly gain access at a later time. • A programmer may purposely leaves this code in or simply forgets to remove it, a potential security hole is introduced. • Hackers often plant a backdoor on previously compromised systems to gain later access Bakhtar University 5
• 6.
  Worms • A Wormis a piece of software that uses computer networks (and security flaws) to create copies of itself. • First Worm in 1988: “Internet Worm“. propagated via exploitation of several BSD and send mail-bugs. • Infected large number of computers on the Internet. • Some “successful“ Worms, Code Red in 2001. Infected hundreds of thousands of systems by exploiting a vulnerability in Microsoft‘s Internet Information Server. • Another example is Blaster in 2003 which infected hundreds of thousands of systems by exploiting a vulnerability in Microsoft‘s RPC service Bakhtar University 6
• 7.
  Trojan Horse • ATrojan is (non-self-replicating program) that appears to perform a desirable function for the user but instead facilitates unauthorized access to the user's computer system. • It is embedded within or disguised as legitimate software. • Trojan Horses do not operate autonomously. • Trojans may look interesting to the unsuspecting user, but are harmful when actually executed. • Two types of Trojan Horses. • 1-Useful software that has been corrupted by an attacker to execute malicious code when the program is run • 2- Standalone program that masquerades as something else (like a game, or a neat little utility) to trick the user into running it. Bakhtar University 7
• 8.
  Types of TrojanHorses • Remote Access Trojans /Remote Control Trojans: Enable the attacker to read every keystroke of the victim, recover passwords • Proxy Trojans: Provide a relay for an attacker so that he is able to disguise the origin of his activities. • Data-Sending Trojans: Are used by attackers to gather certain data, e.g., Passwords, E-banking credentials, Gathered data is often transferred to a location on the Internet where the attacker can harvest the data later on. • Destructive Trojans: Trojans that perform directly harmful activity, Altering data, Encrypting files, Bakhtar University 8
• 9.
  Phishing • It isprocess of attempting to acquire sensitive information • such as • usernames, • password • credit card details by masquerading as a trustworthy entity in an electronic communication. Bakhtar University 9
• 10.
  BotNets • A virusor worm often doesn’t do any immediate damage in order to stay invisible and spy on users (log keystrokes, steal serial numbers etc.) or add affected machine to a botnet (the machine becomes a bot) • Botnet – a network of “owned” machines (bots) controlled usually via IRC protocol or P2P network used to send spam, launch DDoS attacks; also phishing, click fraud, further spread of viruses and worms etc. size: 100, 1000, 10k … up to > 1M of nodes access to bots and botnets can be bought (from $0.01 per bot). Bakhtar University 10
• 11.
  Logic Bombs • Programthat initiates a security incident under certain circumstances • It waits for certain conditions to occur. • Stack and Buffer Overflow. • Exploits a bug in a program (overflow either the stack or memory buffers). Failure to check bounds on inputs, arguments. • Write pass arguments on the stack into the return address on stack. • When routine returns from call, returns to hacked address. Pointed to code loaded onto stack that executes malicious code. • Unauthorized user or privilege escalation. Bakhtar University 11
• 12.
  Denial of Service(DoS) • Denial of Service attacks are an attempt to make computer resources unavailable to their intended users • DoS attacks are (normally) not highly sophisticated, but merely bothersome which can force administrator to restart service or reboot machine. • DoS attacks are dangerous for businesses that rely on availability (e.g. Webshops, eGovernment platforms, etc.). Bakhtar University 12
• 13.
  Categories of DoSattacks • DoS: Stopping Service (locally) • DoS: Stopping Service (Remotely) • DoS: Exhausting Resources (locally) • DoS: Exhausting Resources (Remotely) • DoS: Bandwidth Consumption • DoS: Programming Flaws (failure of applications or OS components) Bakhtar University 13
• 14.
  DDoS • DDoS aredistributed Denial of Service attacks that achieve larger magnitude by launching coordinated attacks by using a framework of “handlers” and “agents”. Bakhtar University 14
• 15.
  DDoS Attack Terminology •Daemons: Attacking machines • Zombies or Agents: poorly secured machine or attacked machine • Master or Handlers: Machines that control zombies • Stepping stone: to hide trace Bakhtar University 15
• 16.
  Classification of DoSAttacks • Bandwidth Consumption: Attacks will consume all available network bandwidth • Resource Starvation: Attacks will consume system resources (mainly CPU, memory, storage space) • Programming flaws: failures of application or OS components to handle exceptional conditions (i.e. unintended or unexpected data is sent to a vulnerable component) OS components’ crash. Bakhtar University 16
• 17.
  Modes of DosAttacks • Network Connectivity attacks : Flooding Malformed traffic • Consumption of resources: • Ping of death • In the IP specification, the maximum datagram size is 64 KB. Some systems react in an unpredictable fashion when receiving oversized (>64 KB) IP datagrams, causing systems crashing, freezing or rebooting, and resulting in a denial of service • Yet another simple form of DoS: ICMP (ping) flood Attackers flood a network link with ICMP ECHO_REQUEST messages using the “ping” command. Exploits a characteristic of the IP layer, that answers with ICMP ECHO_REPLY messages upon reception of ICMP ECHO_REQUEST messages Bakhtar University 17
• 18.
  Smurf attack • Ina Smurf attack, the attacker sends ping requests to a broadcast address, with the source address of the IP datagram set to the address of the target system under attack (spoofed source address). • All systems within the broadcast domain will answer back to the target address, thus flooding the target system with ICMP traffic and causing network congestion => little or no bandwidth left for legitimate users Bakhtar University 18
• 19.
  Protection from smurfattack • Hosts can be configured not to respond to ICMP datagrams directed to IP broadcast addresses. • Most OS have specific network settings to enable/disable the response to a broadcast ICMP ping message. • Disable IP-directed broadcasts at your leaf routers: to deny IP broadcast traffic onto your network from other networks (in particular from the Internet). • A forged source is required for the attack to succeed. • Routers must filter outgoing packets that contain source addresses not belonging to local subnetworks. Bakhtar University 19
• 20.
  TCP’s three-way-handshake • The"three-way handshake" is the procedure used to establish a connection. • TCP SYN flood • A TCP SYN flood is an attack based on bogus TCP connection requests, created with a spoofed source IP address, sent to the attacked system. • Connections are not completed, thus soon it will fill up the connection request table of the attacked system, preventing it from accepting any further valid connection request. • The source host for the attack sends a SYN packet to the target host. • The target hosts replies with a SYN/ACK back to the legitimate user of the forged IP source address. • Since the spoofed source IP address is unreachable, the attacked system will never receive the corresponding ACK packets in return, and the connection request table on the attacked system will soon be filled up. Bakhtar University 20
• 21.
  Continued… • The attackworks if the spoofed source IP address is not reachable by the attacked system. • If the spoofed source IP address is reachable by the attacked system, then the legitimate owner of the source IP address would respond with a RST packet back to the target host, closing the connection and defeating the attack. • TCP SYN flood is a denial of service attack that sends a host more TCP SYN packets than the protocol implementation can handle. • This is a resource starvation DoS attack because once the connection table is full, the server is unable to service legitimate requests. Bakhtar University 21
• 22.
  Spyware • A malwarethat is installed on a computer without the knowledge of the owner in order to collect the owner's private information. • Spyware is often hidden from the user in order to gather information about internet interaction, keystrokes (also known as keylogging), passwords, and other valuable data. • Remover: SpyBot Bakhtar University 22
• 23.
  Thank You For YourPatience Bakhtar University 23