The topics discussed in this chapter are botnets, more discussion on DoS attacks, cost of a DoS attacks, ICMP echo datagrams, TCP 3-way handshake, TCP SYNC flood attack. After studying this chapter you will be able to distinguish between different types of security attacks, identify and classify which security attacks leads to which security breach category. | Network Security Lecture 6 Presented by: Dr. Munam Ali Shah Summary of the previous lecture We discussed different types of security attacks We looked how viruses, worms and Trojan can be harmful for a computing environment. Outlines Botnets More discussion on DoS attacks Cost of a DoS attacks ICMP Echo Datagrams TCP 3-Way Handshake TCP SYNC Flood attack Objectives To be able to distinguish between different types of security attacks To identify and classify which security attacks leads to which security breach category Botnets A virus or worm often doesn’t do any immediate damage in order to stay invisible and spy on users (log keystrokes, steal serial numbers etc.) or add affected machine to a botnet (the machine becomes a bot) Botnet – a network of “owned” machines (bots) controlled usually via IRC protocol or P2P network used to send spam, launch DDoS attacks; also phishing, click fraud, further spread of viruses and worms etc. size: 100, 1000, 10k up to > 1M of nodes access . | Network Security Lecture 6 Presented by: Dr. Munam Ali Shah Summary of the previous lecture We discussed different types of security attacks We looked how viruses, worms and Trojan can be harmful for a computing environment. Outlines Botnets More discussion on DoS attacks Cost of a DoS attacks ICMP Echo Datagrams TCP 3-Way Handshake TCP SYNC Flood attack Objectives To be able to distinguish between different types of security attacks To identify and classify which security attacks leads to which security breach category Botnets A virus or worm often doesn’t do any immediate damage in order to stay invisible and spy on users (log keystrokes, steal serial numbers etc.) or add affected machine to a botnet (the machine becomes a bot) Botnet – a network of “owned” machines (bots) controlled usually via IRC protocol or P2P network used to send spam, launch DDoS attacks; also phishing, click fraud, further spread of viruses and worms etc. size: 100, 1000, 10k up to > 1M of nodes access to bots and botnets can be bought (from $ per bot) 5 Logic Bomb Logic Bomb Program that initiates a security incident under certain circumstances It waits for certain conditions to occur. Stack and Buffer Overflow Exploits a bug in a program (overflow either the stack or memory buffers) Failure to check bounds on inputs, arguments Write pass arguments on the stack into the return address on stack When routine returns from call, returns to hacked address Pointed to code loaded onto stack that executes malicious code Unauthorized user or privilege escalation Virus Dropper Virus dropper inserts virus onto the system Many categories of viruses, literally many thousands of viruses File / parasitic Boot / memory Macro Source code Polymorphic to avoid having a virus signature Encrypted Stealth Tunneling Multipartite Armored 7 Keystroke logger Attacks still common, still occurring Attacks moved over time from science experiments to tools of organized crime Targeting specific companies .
