Scribd
Upload
17 views40 pages

W8 - Network Security Fundamentals-S22

Uploaded by

rahul1121838
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
17 views40 pages

W8 - Network Security Fundamentals-S22

Uploaded by

rahul1121838
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 40

COMP 1161

Networking Security
Fundamentals
Learning Objectives
 Explain denial-of-service (DoS)
attacks
 Explain and discuss ping-of-death
attacks
 Identify major components used in
a DDoS attack and how they are
installed
 Understand major types of
spoofing attacks continued…
Learning Objectives (cont.)
 Discuss man-in-the-middle attacks,
replay attacks, and TCP session
hijacking
 Detail three types of social-
engineering attacks and explain
why they can be incredibly
damaging
 List major types of attacks used
against encrypted data continued…
Learning Objectives (cont.)
 List major types of malicious
software and identify a
countermeasure for each one
Denial-of-Service Attacks
 Any malicious act that causes a
system to be unusable by its real
user(s)
 Take numerous forms
 Are very common
 Can be very costly
 Major types
 SYN flood
 Smurf attack
SYN Flood
 Exploits the TCP three-way
handshake
 Inhibits server’s ability to accept
new TCP connections
Smurf
 Non-OS specific attack that uses
the network to amplify its effect on
the victim
 Floods a host with ICMP
 Saturates Internet connection with
bogus traffic and delays/prevents
legitimate traffic from reaching its
destination
IP Fragmentation Attacks:
Ping of Death
 Uses IP packet fragmentation
techniques to crash remote
systems
Ping of Death
Distributed Denial-of-
Service Attacks
 Use hundreds of hosts on the
Internet to attack the victim by
flooding its link to the Internet or
depriving it of resources
 Used by hackers to target
government and business Internet
sites
Spoofing
 Act of falsely identifying a packet’s
IP address, MAC address, etc
 Four primary types
 IP address spoofing
 ARP poisoning
 Web spoofing
 DNS spoofing
IP Address Spoofing
 Used to exploit trust relationships
between two hosts
 Involves creating an IP address
with a forged source address
ARP Poisoning
 Used in man-in-the-middle and
session hijacking attacks; attacker
takes over victim’s IP address by
corrupting ARP caches of directly
connected machines
 Attack tools
 ARPoison
 Ettercap
 Parasite
Web Spoofing
 Convinces victim that he or she is
visiting a real and legitimate site
 Considered both a man-in-the-
middle attack and a denial-of-
service attack
Web Spoofing
DNS Spoofing
 Attacker poses as the victim’s
legitimate DNS server
 Can direct users to a compromised
server
 Can redirect corporate e-mail
through a hacker’s server where it
can be copied or modified before
sending mail to final destination
Man in the Middle
 Class of attacks in which the attacker places himself
between two communicating hosts and listens their
session

 Man-in-the-Middle Methods
 ARP poisoning
 ICMP redirects
 DNS poisoning

 To protect against
 Configure routers to ignore ICMP redirect packets
 Thoroughly secure DNS servers
 Deploy anti-IP address spoofing measures
 Use network switches that have MAC binding features
Man-in-the-Middle Attacks
Replay Attacks
 Attempts to circumvent
authentication mechanisms by:
 Recording authentication messages
from a legitimate user
 Reissuing those messages in order to
impersonate the user and gain access
to systems
Replay Attack
TCP Session Hijacking
 Attacker uses techniques to make
the victim believe he or she is
connected to a trusted host, when
in fact the victim is communicating
with the attacker
 Well-known tool
 Hunt (Linux)
Social Engineering
 Class of attacks that uses trickery
on people instead of computers
Social Engineering (cont.)
 Goals
 Fraud
 Network intrusion
 Industrial spy
 Identity theft
 Desire to disrupt the system or
network
Dumpster Diving
Online Attacks
 Use chat and e-mails venues to
exploit trust relationships
Mathematical Attack
 Attempts to decrypt encrypted
data using mathematics to find
weaknesses in the encryption
algorithm
 Categories of cryptanalysis
 Cyphertext-only analysis
 Known plaintext attack
 Chosen plaintext attack
Password Guessing
 Tricks authentication mechanisms
by determining a user’s password
using techniques such as brute
force or dictionary attacks
Brute Force
 Method of breaking passwords that
involves computation of every
possible combination of characters
for a password of a given character
length
Dictionary
 Method of breaking passwords by
using a predetermined list of words
as input to the password hash
 Only works against poorly chosen
passwords
Software Exploitation
 Utilizes software vulnerabilities to
gain access and compromise
systems
 Example
 Buffer overflow attach
 To stop software exploits
 Stay appraised of latest security
patches provided by software vendors
Malicious Software
Viruses
 Self-replicating programs that
spread by “infecting” other
programs
 Damaging and costly
Backdoor
 Remote access program
surreptitiously installed on user
computers that allows attacker to
control behavior of victim’s
computer
 Also known as remote access
Trojans
Trojan Horses
 Class of malware that uses social
engineering to spread
 Types of methods
 Sending copies of itself to all
recipients in user’s address book
 Deleting or modifying files
 Installing backdoor/remote control
programs
Logic Bombs
 Set of computer instructions that lie
dormant until triggered by a specific
event
 Once triggered, the logic bomb
performs a malicious task
Worms

 Self-contained program that uses security


flaws such as buffer overflows to remotely
compromise a victim and replicate itself to
that system
 Do not infect other executable programs
 Account for 80% of all malicious activity on
Internet
 Examples: Code Red, Code Red II, Nimda
Ransomware
Attacks
 Ransom malware, or ransomware, is a type of malware
that prevents users from accessing their system or
personal files and demands a sum of money in order to
regain access.
 Ransomware attackers/authors order that payment be
sent via cryptocurrency or credit card, and attackers
target individuals, businesses, and organizations of all
kinds.
 Some ransomware authors sell the service to other
cybercriminals, which is known as Ransomware-as-a-
Service or RaaS.
 Best practices:
• Backup your data.
• Patch and update your software.
• Educate your end users on malspam and creating
strong passwords.
• cybersecurity technology: Detection, Prevention
Summary
 Mechanisms, countermeasures,
and best practices for:
 Malicious software
 Denial-of-service attacks
 Software exploits
 Social engineering
 Attacks on encrypted data

You might also like