U5 AQ5 With Answers
U5 AQ5 With Answers
i. Proxy user interface :-This module controls and manages the user interface and provides an easy to
use graphical interface, window and a menu to the end user. This menu offers the following
functionalities:
Start proxy
Stop proxy
Exit
Blocking URL
Blocking client
Manage log
Manage cache
Modify configuration
ii. Proxy Server Listener:-It is the port where new request from the client browser is listened. This
module also performs blocking of clients from the list given by the user.
iii. Connection Manager:- It contains the main functionality of the proxy server. It performs the
following functions:
It contains the main functionality of the proxy server. It performs the following functions:
Read request from header of the client.
Parse the URL and determine whether the URL is blocked or not.
Generate connection to the web server.
Read the reply from the web server.
If no copy of page is found in the cache then download the page from web server else will
check its last modified date from the reply header and accordingly will read from the cache or
server from the web.
Then it will also check whether caching is allowed or not and accordingly will cache the
page.
iv. Cache Manager:-This module is responsible for storing, deleting, clearing and searching of web
pages in the cache.
v. Log Manager:-This module is responsible for viewing, clearing and updating the logs.
vi. Configuration:-This module helps to create configuration settings which in turn let other modules to
perform desired configurations such as caching.
Purpose of Proxy Servers:-
1) Filter Requests
2) Keep system behind the curtain
3) Used as IP address multiplexer
4) Its Cache memory can serve all users
Following are the reasons to use proxy servers:
i. Monitoring and Filtering:- Proxy servers allow us to do several kind of filtering such as:
Content Filtering
Filtering encrypted data
Bypass filters
Logging and eavesdropping
ii. Improving performance:- It fasten the service by process of retrieving content from the
cache which was saved when previous request was made by the client.
iii. Translation:- It helps to customize the source site for local users by excluding source content
or substituting source content with original local content. In this the traffic from the global
users is routed to the source website through Translation proxy.
iv. Accessing Services Anonymously:- In this the destination server receives the request from
the anonymzing proxy server and thus does not receive information about the end user.
v. Security:-Since the proxy server hides the identity of the user hence it protects from spam
and the hacker attacks.
Q5. Why Anonymizers is used, explain with examples?
A5. An anonymizer or an anonymous proxy is a tool that attempts to make activity on the Internet
untraceable. It is a proxy server computer that acts as an intermediary and privacy shield between a
client computer and the rest of the Internet. It accesses the Internet on the user's behalf, protecting
personal information by hiding the client computer's identifying information.
5.1 Architecture of Anonymizer
6.1
Illustration of Phishing Process
6.2 Working of Phishing Attack
1. Planning- Phishers decide which business to target and determine how to get e-mail addresses for
the customers of that business. They often use the same mass-mailing and address collection
techniques as spammers.
2. Setup- Once they know which business to spoof and who their victims are, phishers create methods
for delivering the message and collecting the data. Most often, this involves e-mail addresses and a
Web page.
3. Attack- This is the step people are most familiar with -- the phisher sends a phony message that
appears to be from a reputable source.
4. Collection- Phishers record the information victims enter into Web pages or popup windows.
5. Identity Theft and Fraud- The phishers use the information they've gathered to make illegal
purchases or otherwise commit fraud. As many as a fourth of the victims never fully recover.
Q7. Define Cracking of Passwords, Discuss the various Password Cracking methods?
A7. Password cracking is the process of recovering passwords from data that have been stored in or
transmitted by a computer system. A common approach (brute-force attack) is to try guesses
repeatedly for the password and check them against an available cryptographic hash of the password.
Purpose of Password cracking :-
help a user recover a forgotten password
to gain unauthorized access to a system,
or as a preventive measure by System Administrators to check for easily crackable passwords
The various password cracking methods:-
1. Dictionary attack:- "This uses a simple file containing words that can, surprise surprise, be found in a
dictionary. In other words, if you will excuse the pun, this attack uses exactly the kind of words that many
people use as their password..."
2. Brute force attack:-"This method is similar to the dictionary attack but with the added bonus, for the
hacker, of being able to detect non-dictionary words by working through all possible alpha-numeric
combinations from aaa1 to zzz10..."
3. Rainbow table attack:-"A rainbow table is a list of pre-computed hashes - the numerical value of an
encrypted password, used by most systems today - and that’s the hashes of all possible password
combinations for any given hashing algorithm mind. The time it takes to crack a password using a rainbow
table is reduced to the time it takes to look it up in the list..."
4. Phishing:-"There's an easy way to hack: ask the user for his or her password. A phishing email leads the
unsuspecting reader to a faked online banking, payment or other site in order to login and put right some
terrible problem with their security..."
5. Social Engineering:- "A favourite of the social engineer is to telephone an office posing as an IT security
tech guy and simply ask for the network access password. You’d be amazed how often this works..."
6. Malware:-"A key logger or screen scraper can be installed by malware which records everything you
type or takes screen shots during a login process, and then forwards a copy of this file to hacker central..."
7. Offline cracking:-"Often the target in question has been compromised via an hack on a third party,
which then provides access to the system servers and those all-important user password hash files. The
password cracker can then take as long as they need to try and crack the code without alerting the target
system or individual user..."
8. Shoulder surfing:-"The service personnel ‘uniform’ provides a kind of free pass to wander around
unhindered, and make note of passwords being entered by genuine members of staff. It also provides an
excellent opportunity to eyeball all those post-it notes stuck to the front of LCD screens with logins
scribbled upon them..."
9. Spidering:-"Savvy hackers have realised that many corporate passwords are made up of words that are
connected to the business itself. Studying corporate literature, website sales material and even the websites
of competitors and listed customers can provide the ammunition to build a custom word list to use in a brute
force attack..."
10. Guess:-"The password crackers best friend, of course, is the predictability of the user. Unless a truly
random password has been created using software dedicated to the task, a user generated ‘random’ password
is unlikely to be anything of the sort..."
Q8. Write a Password Cracking Alogorithm.
A8. START
Step 1 : Find a valid user
Step2 : Create a list of possible passwords
Step3 : Rank the passwords from high probability to low
Step4 : Key in each password
Step5 : If the system allows you in - Success
Step6 : Else try till success
END
2. Offline attacks - Are performed from a location other than the target where these passwords
reside or are used require physical access to the computer and copying the password.
3. Non-electronic attacks
◦ Social engineering
◦ Shoulder surfing
◦ Dumpster diving
Q12. How many types of password attacks are there, discuss weak password?
A12. To understand how to protect yourself from a password attack, you should become familiar with the
most commonly used types of attacks.
The most widely used types of attacks:-
Password Guessing
◦ Attackers can guess passwords locally or remotely using either a manual or automated
approach
Dictionary attacks
◦ work on the assumption that most passwords consist of whole words, dates, or numbers taken
from a dictionary.
Hybrid password
◦ assume that network administrators push users to make their passwords at least slightly
different from a word that appears in a dictionary.
The example of weak password are as under :-
The password contains less than eight characters
The password is a word found in a dictionary (English or foreign)
The password is a common usage word such as:
Names of family, pets, friends, co-workers, fantasy characters, etc.
Computer terms and names, commands, sites, companies, hardware, software.
The words "<Company Name>", "sanjose", "sanfran" or any derivation.
Birthdays and other personal information such as addresses and phone numbers.
Word or number patterns like aaabbb, qwerty, zyxwvuts, 123321, etc.
Any of the above spelled backwards.
Any of the above preceded or followed by a digit (e.g., secret1,1secret
1. 12 Characters or More
The longer the password, the more secure it would be. We recommend that your password be at least 12
characters or more. The myth of complexity says that you need the most mixed-up possible password, but
really length protects you much better than complexity. 12 sounds like a large number, but stretching out
passwords can be easy. Three or four words will easily meet this quota. Here’s an example:
iLOST$400ysterdai
3. No Obvious Substitutions
Common substitutions for letters include @ for a, 3 for e, $ for s, and () for o. Be a little more creative in
working symbols into your password.
10. Unique
The best practice would be never to reuse passwords. This makes sense because if one password is stolen,
shared, or cracked, then all of your accounts are compromised. However, there are so many sites that require
logins these days, and it really is too many passwords. What we recommend is to use unique passwords for
important accounts, like email, social networks, bank accounts, but for more frivolous and less important
logins, you can use similar passwords. Just keep in mind that if any of those accounts is compromised, they
are all vulnerable.
Q14. Differentiate between VIRUS and WORMS.
A14.
Q15. Explain keyloggers, Software-based keyloggers, hardware keyloggers, Acoustic
keylogging.
A15. A) Keyloggers :-
Keystroke logging, often referred to as keylogging or keyboard capturing, is the action of
recording (or logging) the keys struck on a keyboard, typically in a covert manner so that the person
using the keyboard is unaware that their actions are being monitored.
It has uses in the study of human–computer interaction.
There are numerous keylogging methods, ranging from hardware and software-based approaches to
acoustic analysis.
B). Software- based Keyloggers :-
Software-based keyloggers use the target computer’s operating system in various ways, including:
imitating a virtual machine, acting as the keyboard driver (kernel-based), using the application
programming interface to watch keyboard strokes (API-based), recording information submitted on
web-based forms (Form Grabber based) or capturing network traffic associated with HTTP POST
events to steal passwords (Packet analyzers).
Usually consists of two files DLL and EXE
C) Hardware keyloggers:-
Installing a hardware circuit between the keyboard and the computer that logs keyboard stroke
activity (keyboard hardware).
Target- ATMs
D) Acoustic keylogging:-
Acoustic keylogging monitors the sound created by each individual keystroke and uses the subtly
different acoustic signature that each key emits to analyze and determine what the target computer’s
user is typing.
Q16. What is AntiKeylogger and its benefits.
A16. An anti-keylogger (or anti–keystroke logger) is a type of software specifically designed for the
detection of keystroke logger software; often, such software will also incorporate the ability to delete or
at least immobilize hidden keystroke logger software on your computer.
Benefits of AntiKeyLoggers :-
Q17. Discuss the types of Wireless Network attacks.
A17. Wireless Attacks can come at you through different methods. For the most part you need to worry
about WiFi. Some methods rely on tricking users, others use brute force, and some look for people who
don’t bother to secure their network. Many of these attacks are intertwined with each other in real world use.
Here are some of the kinds of attacks you could encounter:
a) Packet Sniffing: When information is sent back and forth over a network, it is sent in what we call
packets. Since wireless traffic is sent over the air, it’s very easy to capture. Quite a lot of
traffic (FTP, HTTP, SNMP, ect.) is sent in the clear, meaning that there is no encryption and files are
in plain text for anyone to read. So using a tool like Wireshark allows you to read data transfers in
plain text! This can lead to stolen passwords or leaks of sensitive information quite easily. Encrypted
data can be captured as well, but it’s obviously much harder for an attacker to decipher the encrypted
data packets.
b) Rouge Access Point: When an unauthorized access point (AP) appears on a network, it is refereed to
as a rouge access point. These can pop up from an employee who doesn’t know better, or a person
with ill intent. These APs represent a vulnerability to the network because they leave it open to a
variety of attacks. These include vulnerability scans for attack preparation, ARP poisoning, packet
captures, and Denial of Service attacks.
c) Password Theft: When communicating over wireless networks, think of how often you log into a
website. You send passwords out over the network, and if the site doesn’t use SSL or TLS, that
password is sitting in plain text for an attacker to read. There are even ways to get around those
encryption methods to steal the password. I’ll talk about this with man in the middle attacks.
d) Man in the Middle Attack: It’s possible for hackers to trick communicating devices into sending
their transmissions to the attacker’s system. Here they can record the traffic to view later (like in
packet sniffing) and even change the contents of files. Various types of malware can be inserted into
these packets, e-mail content could be changed, or the traffic could be dropped so that
communication is blocked.
e) Jamming: There are a number of ways to jam a wireless network. One method is flooding an AP
with deauthentication frames. This effectively overwhelms the network and prevents legitimate
transmissions from getting through. This attack is a little unusual because there probably isn’t
anything in it for the hacker. One of the few examples of how this could benefit someone is through
a business jamming their competitors WiFi signal. This is highly illegal (as are all these attacks), so
businesses would tend to shy away from it. If they got caught they would be facing serious charges.
f) War Driving: War driving comes from an old term called war dialing, where people would dial
random phone numbers in search of modems. War driving is basically people driving around looking
for vulnerable APs to attack. People will even use drones to try and hack APs on higher floors of a
building. A company that owns multiple floors around ten stories up might assume nobody is even in
range to hack their wireless, but there is no end to the creativity of hackers!
g) Blueooth Attacks: There are a variety of Bluetooth exploits out there. These range from annoying
pop up messages, to full control over the a victims Bluetooth enabled device. Check out this
blog post on hacking bluetooth for an in depth look.
h) WEP/WPA Attacks: Attacks on wireless routers can be a huge problem. Older encryption standards
are extremely vulnerable, and it’s pretty easy to gain the access code in this case. Once someones on
your network, you’ve lost a significant layer of security. APs and routers are hiding your IP address
from the broader Internet using Network Address Translation(unless you use IPv6 but that’s a topic
for another day). This effectively hides your private IP address from those outside your subnet, and
helps prevent outsiders from being able to directly attack you. The keyword there is that
it helps prevent the attacks, but doesn’t stop it completely.
v. Multipartite Virus
A multipartite virus is a fast-moving virus that uses file infectors or boot infectors to attack the boot
sector and executable files simultaneously.
Most viruses either affect the boot sector, the system or the program files.
The multipartite virus can affect both the boot sector and the program files at the same time, thus
causing more damage than any other kind of virus.
When the boot sector is infected, simply turning on the computer will trigger a boot sector virus
because it latches on to the hard drive that contains the data that is needed to start the computer.
Once the virus has been triggered, destructive payloads are launched throughout the program files.
A multipartite virus infects computer systems multiple times and at different times. In order for it to
be eradicated, the entire virus must be removed from the system.
A multipartite virus is also known as a hybrid virus.
(Satendra Sonare)
November-2018