csis 343 Module_4_MindTap.docx lab 2018.pdf

Module 4 MindTap Lab

Attackers use programs referred to as Trojans to stealthily enter a target system with the intent

Trojan horse attacks take many forms each with a specific but equally damaging outcome.

Remote access Trojans seek to give an attacker control over a victim system. Trojans that can send data

back to the attacker collect sensitive information such as usernames, passwords, e-mail addresses, and

credit card information. Not all Trojans are as passive as the ones mentioned above. Some Trojans serve

no other purpose than to destroy the systems they are installed. Famously in 2010 the Trojan horse

attack that installed the computer worm known as Stuxnet was delivered via an infected USB drive. The

Stuxnet virus systematically destroyed Windows based devices and specifically attacked the Iranian

nuclear program.

To combat the use of Trojans, system security experts must utilize Trojan detectors. The first step

in detecting Trojans is to avoid an infection in the first place. In a business environment employees must

be trained not to open or download any e-mails or files that look suspicious or are not from a trusted

source. This type of training can be implemented via web-based training where the users can see first

hand what types of things to avoid. If a Trojan has already made its way onto a system that the only way

to detect its presence is to actively monitor the system for any abnormal data flows. Using a tool like

NetStat, security professionals can view TCP connections, IP routing tables, and what ports are active on

the network. By know the parameters of the security policies in place, traffic being utilized by a Trojan

can be isolated and shutdown. Ny tracing back source and destination information, the attackers can be

identified, and the target device can be quarantined and either replaced or repaired.

Panther2 is a tool that allows an attacker to perform a Denial of Service attack on a victim by

identifying the target IP address. Once the application has been installed on the attacker’s system

starting the DoS is simple. In the application the attacker only has to enter the victim IP address and

select the type of data for the DoS Attack. For this Lab I chose to use the data labeled “PING 127.0.0.1.”

are incrementing multiple times a second. Having the packet sniffer open on the victim device shows

thousands of packets trying to be processing. While the attack is being performed no noticeable

performance change is noticed on the victim computer. I can see all the incoming packets but it seems as

though it is not enough to affect the operation of the victim pc. I a realistic application of this attack the

data attacking the victim device would be coming from a bot net of attacking computers. In this lab you

ports on a network. Leaving them open only opens the system up to an attack. As with most of these

labs the network defender is at the mercy of the attacker. All the attacker needs to do is find one

oversight, one flaw in the system, while the defenders must try and account for all known, and unknown

vulnerabilities and risks.