chapter 3 classes of attack. introduction network attacks come from both inside and outside...
TRANSCRIPT
![Page 1: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/1.jpg)
CHAPTER 3
Classes of Attack
![Page 2: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/2.jpg)
INTRODUCTION
Network attacks come from both inside and outside firewall.
Kinds of attacks: 1. Denial-of-service 2. Information Leakage 3. File Alteration 4. Misinformation 5. Database Access
![Page 3: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/3.jpg)
DENIAL-OF-SERVICE (DoS)
This kind of attack unauthorized the availability of the resource to its regular authorized users.
Types of DoS: 1. Degrading Processes 2. Degrading Storage Capability 3. Destroying Files 4. Shutting Down
![Page 4: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/4.jpg)
DENIAL-OF-SERVICE (DoS)
Degrading Processes 1. The attacker reduces performance by
overloading the target system, either by spawning multiple processes to eat up all available resources or spawning enough processes to overload CPU. Example: A simple UNIX fork bomb.
2. The attacker attack a network application such as File Transfer protocol (FTP) or Simple Mal Transfer Protocol (SMTP) by sending a flood of network.
![Page 5: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/5.jpg)
DENIAL-OF-SERVICE (DoS)
3. The attacker attack a network service such as Internet protocol (IP) or the Internet Control Message Protocol (ICMP) also by sending a flood of network.
Examples of DoS attacks that degrade processes are:
1. Snork 2. Chargen 3. Smurf 4. SYN flood
![Page 6: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/6.jpg)
DENIAL-OF-SERVICE (DoS)
Snork and Chargen affect Windows NT. Snork enables the attacker to send spoofed
Remote Procedure Call (RPC) datagrams to the User Datagram Protocol (UDP) destination port 135.
Chargen enables attacker sent a flood of UDP datagrams from a spoofed source IP to port 19.
Smurf performs a network-level against the target host.
SYN flood is accomplished by sending TCP connection request faster than a system can process them.
![Page 7: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/7.jpg)
DENIAL-OF-SERVICE (DoS)
Degrading Storage Capability Attacker uses all of the given storage resources on
the target machine, such as spamming a mail server. For example: The Love Letter worm that use Windows and Exchange Server as their mail platform.
Destroying Files This type of DoS attack is a less often occur. The attacker delete files on the target server to
render it unusable. For example: A strain of Love Bug worm that overwrites all .bat, .com and .sys files on the system.
![Page 8: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/8.jpg)
DENIAL-OF-SERVICE (DoS)
Shut Down Systems This kind of DoS enable attacker shutting down
the computer systems. For example: Ping of Death caused a great many windows NT machines to face the blue screen of death.
Distributed Denial-of-Service (DDoS) This is the newest threat of DoS and depends on
the use of a client, masters and daemons. The attackers use the client to initiate the attack
by using masters, which are compromised hosts that have a special programs running on them.
![Page 9: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/9.jpg)
DENIAL-OF-SERVICE (DoS)
Some of the DDoS tools includes: 1. Trinoo 2. Tribe Flood Network 3. Stacheldraht 4. Shaft 5. Mstream
![Page 10: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/10.jpg)
INFORMATION LEAKAGE
The attacker enable to get much information on the target as possible.
This class of attack can occur in many ways: 1. The attacker may use finger or Domain
Name System (DNS) to gather information about the users on your network.
2. The advertising of search engine can help attacker determine the type of web server being used.
![Page 11: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/11.jpg)
INFORMATION LEAKAGE
3. It also can occur in SMTP or application banners (from telnet) because these items can give a piece of information about network.
Some tools used by individuals to gain information about network include port scanners and operating system detection software. For example, one of the best tool is nmap by Fyodor.
![Page 12: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/12.jpg)
FILE ALTERATION
The attacker have capability to alter file includes create, read, modify and remove files from systems on the network.
In the past, attacker can create and remove files on systems utilizing Network File System (NFS) by utilizing vulnerabilities in statd (NFS file-locking status monitor).
![Page 13: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/13.jpg)
MISINFORMATION
The attacker erase all their tracks to the system.
Bad logs The attacker go to the log files (after gaining root
server) to remove all traces of themselves. Attack noise It can be designed as simply diversionary tactic.
It means while user concentrate on defending area that being attacked, the reality is the attacker comes from the area which the defense are low.
![Page 14: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/14.jpg)
DATABASE ACCESS
The attacker may try to gain access to a special file or database.
There are some area concerned by attackers to attack:
1. Use system’s operating system. For example: Attacker attack Registry (use to store operating parameters in Windows NT). By default, it can be controlled by Service Pack.
2. Attacker use the database user permission to gain the access.
![Page 15: CHAPTER 3 Classes of Attack. INTRODUCTION Network attacks come from both inside and outside firewall. Kinds of attacks: 1. Denial-of-service 2. Information](https://reader036.vdocument.in/reader036/viewer/2022072017/56649f035503460f94c1771e/html5/thumbnails/15.jpg)
To be continued…