Virus 18/11/2018
Memory-resident virus Runs whenever certain interrupts occur. 18/11/2018
Encrypted virus To conceal signature. 18/11/2018
Unix address space Low address Program Statically allocated data Stack High address 18/11/2018
Procedure call E.g., finger aabbcc aa bb cc Buffer area allocated by called fingerd (512 bytes) [PC] ret Return address para2 para1 Stack High address 18/11/2018
Buffer overflow E.g., finger aabb…zz zz aa bb cc … Malicious program (binary) [PC] zz Return address para2 para1 Stack 18/11/2018
Epidemic Worm Bootstrap proper Worm proper New victim Infested machine rsh attack Worm proper Bootstrap finger attack sendmail attack Upload request Worm proper New victim Infested machine 18/11/2018
Firewall location Internet Intranet Intranet Packet filter and/or - Application gateway 18/11/2018
Typical configurations DMZ 18/11/2018
(a) Filtering router Mail server (port=25) Filtering router Internet Intranet 18/11/2018
Filtering router implementation Action Our host Port Their host Block * SPIGOT Allow Our-MailServ 25 Our-WebServ 80 18/11/2018
(b) Filtering router and Bastion host Internet Protected Intranet Router only permits traffic to/from bastion host 18/11/2018
(c) Demilitarized Zone (DMZ) Modem access Bastion host Protected intranet inside router Internet outside router Web server DMZ 18/11/2018
HTTP proxy 18/11/2018
Local HTTP proxy Proxy Server Internet (B) HTTP (A) Proxy HTTP www.company.com:80 Client is configured to use proxy HTTP via (B). (B) Sends GET page.html to http://www.company.com/ on behalf of (A). 18/11/2018
RMI thru firewall HTTP server Internet RMI server client_stub port POST “data” to www.company.com:80/cgi-bin/ java-rmi.cgi?forward=<rmiServerPort> 18/11/2018
Private network 18/11/2018
Hybrid network 18/11/2018
Virtual private network 18/11/2018
Addressing in a VPN 18/11/2018
Tunneling 18/11/2018
Virtual Private Network (VPN) Internet Intranet B Intranet A Tunneling Router RA Router RB RB 200 Data Station 200 Station 100 encrypted 18/11/2018