(see also Q1 and Q2 Topics) ECE6612 Quiz 2 -> Exam Topics (see also Q1 and Q2 Topics) Fall 2006

Chapter 9 - Viruses, Worms Prevention, Detection, Phases (Dor.,Prop,Trig.,Exec.), Types, How fast can they spread. Virus - code that copies itself into other programs. A Bacteria replicates until it fills all disk space, or CPU cycles. Payload - harmful things the malicious program does, after it has had time to spread. Worm - a program that replicates itself across the network (usually riding on email messages or attached documents (e.g., macro viruses). Email “viruses” are technically “worms”. Trojan Horse - instructions in an otherwise good program that cause bad things to happen (sending your data or password to an attacker over the net). Logic Bomb - malicious code that activates on an event (e.g., date). Trap Door (or Back Door) - undocumented entry point written into code for debugging that can allow unwanted users. Vulnerability - a program defect that permits Intrusions. Easter Egg - extraneous code that does something “cool.” A way for programmers to show that they control the product. 2

Simple Firewall - drops packets based on IP, port Chapter 10a - Firewalls Simple Firewall - drops packets based on IP, port Stateful - Keeps track of connections, set up inside or outside. NAT - Network Address Translation, Private Address ranges (10. ) Proxy Server - checks application header and data. Attacks - how does Firewall protect against scanning, bad-fragments, bad TCP flags, Smuft attack, ... Host-based Firewalls - xinetd (/etc/hosts.allow), iptables, Zone Alarm, Black Ice (now ISS Desktop Proventia) 3

Chapter 10b - Trusted Systems Subject, Object, Access Rights (permissions) Policy - Access matrix or ACL (access control list) Basic Security Rules: No read up (simple security property) No write down (do not widen accessibility) Need to Know. Reference Monitor, audit file, security kernel database. Requirements to be a “Trusted System”: Complete Mediation, Isolation, Verifiability “Common Criteria” Security Specifications - multinational trust ratings 4

Use of bad fragments to crash Operating System (OS). Chapter 11 - TCP/IP Use of bad fragments to crash Operating System (OS). Use of ICMP packets (ping, “unreachable”, “time-out”) Smuft attack (packet multiplication, use of broadcast address). “Spoofed” addresses. TCP Flags - bad combinations to map OS, cause crashes. TCP - Highjacked connection. 5

Chapter 12 - Traffic Visualization Not covered. 6

Chapter 13 - NetSec Utilities What do they do? Tripwire Saint and Satan Nessus Ethereal and “tcpdump” Security Organizations: US-CERT (U.S. Computer Emergency Response Team) SANS NIPC (FBI - Nat. Infrastructure Protection Center) What to do if a host is compromised. Evidence - chain of custody 7

Slide Set 14 - Wireless Security WEP is weak security, but far better than nothing. WPA is better, but needs long passphases (22 characters) Use longest key-length possible. Enable use of “allowed list” of MAC addresses. Use higher-layer security - IPsec or SSL. Use a firewall and IDS to isolate wireless access points (WAP’s) just like you do for the Internet. Search for “Rogue” WAP’s. 8

Hidden Files (on UNIX, name starts with “.”) Slide set 15 - Hidden Data Hidden Files (on UNIX, name starts with “.”) Startup scripts (great place to hide a Trojan Horse) Covert channels (hide in “Ping” packets, SSH, port 80, FTP) Steganography (hiding data in an image file) Watch for new processes ( use 'ps aux')., new files (particularly “suid” files), open Internet TCP and UDP ports ('netstat -lp' or 'sockstat -4') 9

(The 1st rule is "No security without physical security.") Slide Set 16 - Safe Computing Buffer Overflow(what is it, what does it do) How to code to prevent possibility of a “Buffer Overflow” Eliminate unneeded daemons, “suid programs,” open ports, and user accounts (to "harden" the computer). Enforce long, mixed-character passwords. Explain “Once root, always root” (Copeland's 2nd rule*) (The 1st rule is "No security without physical security.") (The 3rd rule is "Layers of protection and detection are needed ... .") Good Luck! and Best Wishes for 2007 10