Rookkit

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Whom Are You Trying to Catch?

Crackers

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Black-hat hacker: Tries to break IT security and gain access to systems with no authorization in order to prove technical prowess. Black-hat hackers generally develop and use special software tools to exploit vulnerabilities. May exploit holes in systems but generally do not attempt to disclose vulnerabilities they find to the administrators of those systems.

White-hat hacker: Also called an ethical hacker, is an information systems security professional who has authorization to identify vulnerabilities and perform penetration testing. Difference between white-hat hackers and black-hat hackers is that white-hat hackers will identify weaknesses for the purpose of fixing them, and black-hat hackers find weaknesses just for the fun of it or to exploit them.

Gray-hat hackers: A hacker who will identify but not exploit discovered vulnerabilities, yet may still expect a reward for not disclosing the vulnerability openly.

Cracker: Has a hostile intent, possesses sophisticated skills, and may be interested in financial gain. Crackers represent the greatest threat to networks and information resources.

9/3/2019

(c) ITT Educational Services, Inc.

7

Attack Tools

Protocol analyzers (sniffers)

Port scanners

OS fingerprint scanners

Vulnerability scanners

Exploit software

Wardialers

Password crackers

Keystroke loggers

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

9/3/2019

(c) ITT Educational Services, Inc.

8

What Is a Security Breach?

Any event that results in a violation of any of the C-I-A security tenets

Some security breaches disrupt system services on purpose

Some are accidental and may result from hardware or software failures

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

9/3/2019

(c) ITT Educational Services, Inc.

9

Activities that Cause Security Breaches

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

9/3/2019

(c) ITT Educational Services, Inc.

10

Denial of Service Attack

A coordinated attempt to deny service by occupying a computer to perform large amounts of unnecessary tasks

Logic attacks

Flooding attacks

Protect using

Intrusion prevention system (IPS)

Intrusion detection system (IDS)

Attacks launched using

SYN flood

Smurfing

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Distributed Denial of Service Attack

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Unacceptable Web Browsing

Define acceptable web browsing in an acceptable use policy (AUP)

Unacceptable use can include:

Unauthorized users searching files or storage directories

Users visiting prohibited websites

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Wiretapping

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Between-the-lines wiretapping: This type of wiretapping does not alter the messages sent by the legitimate user but inserts additional messages into the communication line when the legitimate user pauses.

Piggyback-entry wiretapping: This type of wiretapping intercepts and modifies the original message by breaking the communications line and routing the message

to another computer that acts as a host.

9/3/2019

(c) ITT Educational Services, Inc.

14

Backdoors

Hidden access included by developers

Attackers can use them to gain access

Data Modifications

Data that is:

Purposely or accidentally modified

Incomplete

Truncated

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Additional Security Challenges

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Risks, Threats, Vulnerabilities

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Threats exploit vulnerabilities, which creates risk.

You cannot eliminate risk.

You can minimize the impact of threats.

You can reduce the number of vulnerabilities.

Minimizing threats and reducing vulnerabilities lessens overall risk.

Threats, risks, and vulnerabilities negatively impact the CIA triad.

9/3/2019

(c) ITT Educational Services, Inc.

17

Most Common Threats

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Vulnerability covers a wide range of system and network weaknesses.

Insecure servers or services include outdated packages, poorly programmed software, and cleartext protocols where encrypted protocols should be used.

Exploitable applications and protocols include programming flaws that can be manipulated by attackers.

Unprotected systems or network resources include development servers left in the open.

Traffic interception and eavesdropping reveals private communications to snooping eyes.

Lack of preventive or protective measures allows malware to infiltrate the network.

9/3/2019

(c) ITT Educational Services, Inc.

18

Threat Types

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

9/3/2019

(c) ITT Educational Services, Inc.

19

What Is a Malicious Attack?

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Fabrications: Fabrications involve the creation of some deception in order to trick unsuspecting users.

Interceptions: An interception involves eavesdropping on transmissions and redirecting them for unauthorized use.

Interruptions: An interruption causes a break in a communication channel, which blocks the transmission of data.

Modifications: A modification is the alteration of data contained in transmissions or files.

9/3/2019

(c) ITT Educational Services, Inc.

20

Types of Active Threats

Birthday attacks

Brute-force password attacks

Dictionary password attacks

IP address spoofing

Hijacking

Replay attacks

Man-in-the-middle attacks

Masquerading

Social engineering

Phishing

Phreaking

Pharming

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

9/3/2019

(c) ITT Educational Services, Inc.

21

What Is Malicious Software?

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Virus

Attaches itself to or copies itself into another program on a computer

Tricks the computer into following instructions not intended by the original program developer

Infects a host program and may cause that host program to replicate itself to other computers

User who runs infected program authenticates the virus

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Worm

A self-contained program that replicates and sends copies of itself to other computers without user input or action

Does not need a host program to infect

Is a standalone program

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Trojan Horse

Malware that masquerades as a useful program

Trojans can:

Hide programs that collect sensitive information

Open backdoors into computers

Actively upload and download files

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Rootkit

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Spyware

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

What Are Common Types of Attacks?

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Attacks on availability: These attacks impact access or uptime to a critical system, application, or data.

Attacks on people: These attacks involve using coercion or deception to get another human to divulge information or to perform an action (e.g., clicking on a suspicious URL link or opening an email attachment from an unknown email address).

Attacks on IT assets: These attacks include penetration testing, unauthorized access, privileged escalation, stolen passwords, deletion of data, or performing a data breach.

9/3/2019

(c) ITT Educational Services, Inc.

28

Social Engineering Attacks

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Authority: Using a position of authority to coerce or persuade an individual to divulge information.

Consensus/social proof: Using a position that “everyone else has been doing it” as proof that it is okay or acceptable to do.

Dumpster diving: Finding unshredded pieces of paper that may contain sensitive data or private data for identity theft.

Familiarity/liking: Interacting with the victim in a frequent way that creates a comfort and familiarity and liking for an individual (e.g., a delivery person may become familiar to office workers over time) that might encourage the victim to want to help the familiar person.

Hoax: Creating a con or a false perception in order to get an individual to do something or divulge information.

Impersonation: Pretending to be someone else (e.g., an IT help desk support person, a delivery person, a bank representative).

Intimidation: Using force to extort or pressure an individual into doing something or divulging information.

Trust: Building a human trust bond over time and then using that trust to get the individual to do something or divulge information.

Scarcity: Pressuring another individual into doing something or divulging information for fear of not having something or losing access to something.

Shoulder surfing: Looking over the shoulder of a person typing into a computer screen.

Tailgating: Following an individual closely enough to sneak past a secure door or access area.

Urgency: Using urgency or an emergency stress situation to get someone to do something or divulge information (e.g., claiming that there’s a fire in the hallway might get the front desk security guard to leave their her desk).

Vishing: Performing a phishing attack by telephone in order to elicit personal information; using verbal coercion and persuasion (“sweet talking”) the individual under attack.

Whaling: Targeting the executive user or most valuable employees, otherwise considered the “whale” or “big fish” (often called spear phishing).

9/3/2019

(c) ITT Educational Services, Inc.

29

Wireless Network Attacks

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Bluejacking: Hacking and gaining control of the Bluetooth wireless communication link between a user’s earphone and smartphone device.

Bluesnarfing: Packet sniffing communications traffic between Bluetooth devices.

Evil twin: Faking an open or public wireless network to use a packet sniffer on any user who connects to it.

IV attack: Modifying the initialization vector of an encrypted IP packet in transmission in hopes of decrypting a common encryption key over time.

Jamming/Interference: Sending radio frequencies in the same frequency as wireless network access points to jam and interfere with wireless communications and disrupting availability for legitimate users.

Near field communication attack: Intercepting, at close range (a few inches), communications between two mobile operating system devices.

Packet sniffing: Capturing IP packets off a wireless network and analyzing the TCP/IP packet data using a tool such as Wireshark.

Replay attacks: Replaying an IP packet stream to fool a server into thinking you are authenticating to it.

Rogue access points: Using an unauthorized network device to offer wireless availability to unsuspecting users.

War chalking: Creating a map of the physical or geographic location of any wireless access points and networks.

War driving: Physically driving around neighborhoods or business complexes looking for wireless access points and networks that broadcast an open or public network connection.

9/3/2019

(c) ITT Educational Services, Inc.

30

Web Application Attacks

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Arbitrary/remote code execution: Having gained privileged access or sys admin rights access, the attacker can run commands or execute a command at will on the remote system.

Buffer overflow: Attempting to push more data than the buffer can handle, thus creating a condition where further compromise might be possible.

Client-side attack: Using malware on a user’s workstation or laptop, within an internal network, acting in tandem with a malicious server or application on the Internet (outside the protected network).

Cookies and attachments: Using cookies or other attachments (or the information they contain) to compromise security.

Cross-site scripting (XSS): Injecting scripts into a web application server to redirect attacks back to the client. This is not an attack on the web application but rather on users of the server to launch attacks on other computers that access it.

Directory traversal /command injection: Exploiting a web application server, gaining root file directory access from outside the protected network, and executing commands, including data dumps.

Header manipulation: Stealing cookies and browser URL information and manipulating the header with invalid or false commands to create an insecure communication or action.

Integer overflow: Creating a mathematical overflow which exceeds the maximum size allowed. This can cause a financial or mathematical application to freeze or create a vulnerability and opening.

Lightweight Directory Access Protocol (LDAP) injection: Creating fake or bogus ID and authentication LDAP commands and packets to falsely ID and authenticate to a web application.

Local shared objects (LSO): Using Flash cookies (named after the Adobe Flash player), which cannot be deleted through the browser’s normal configuration settings. Flash cookies can also be used to reinstate regular cookies that a user has deleted or blocked.

• Malicious add-ons: Using software plug-ins or add-ons that run additional malicious software on legitimate programs or applications.

• SQL injection: Injecting Structured Query Language (SQL) commands to obtain information and data in the back-end SQL database.

• Watering-hole attack: Luring a targeted user to a commonly visited website on which has been planted the malicious code or malware, in hopes that the user will trigger the attack with a unknowing click.

• XML injection: Injecting XML tags and data into a database in an attempt to retrieve data.

• Zero-day: Exploiting a new vulnerability or software bug for which no specific defenses yet exist.

9/3/2019

(c) ITT Educational Services, Inc.

31

What Is a Countermeasure?

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Countering Malware

Create a user education program

Post regular bulletins about malware problems

Never transfer files from an unknown or untrusted source (unless anti-malware is installed)

Test new programs or open suspect files on a quarantine computer

Install anti-malware software, make sure it remains current, and schedule regular malware scans

Use a secure logon and authentication process

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Countering Malware (cont.)

Stay abreast of developments in malware

National Cyber Security Alliance (NCSA) www.staysafeonline.org

United States Computer Emergency Readiness Team (US-CERT) http://us-cert.gov

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Protecting Your System with Firewalls

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.

Summary

Malicious software and countermeasures

Common attacks and countermeasures

Social engineering and how to reduce risks

Threats and types of attacks on wireless networks

Threats and types of attacks on web applications

Page ‹#›

Fundamentals of Information Systems Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com

All rights reserved.