1. Attack Methods  Attacks  DoS (Denial of Service)  Malware

2. Attacks  Collect information (mapping)  Break-In  Complete the Attack

3. Attack – Collect Information  Uncover the network (the active hosts) - ping-scan ( ping-sweep ) reverse nslookup  Eg. IpAngry  Uncover the application running - port-scanning ( nmap ) - fingerprints ( SW and version ) active & passive  Stealth scanning ( reduce, selective.. )  Packet Sniffering ( Eg. Ethereal )

4. Attack – Break-in  Password guessing  Known security holes ( bb/group )  Session Hijacking ( Seq# guess, relay )

5. Attack - Complete  What to do when a hacker is in  Downloads diff. tools ( sniffer,cracker,… )  Clear logs ( no tracks )  Setup backdoors ( accounts, applications, … ) spyware, Back Orifice, ….

6. Denial of Service  Single message DoS ( poor implementation of protocols Ping of Death )  Flooding Syn, smurf ( IP-spoofing )  Distributed DoS 1)zombies 2)attack ( e.g.one of above )

7. Malware  Virus  Worm  Protection

8. Malware - Overview Malware Needs Host Programs Independent * Trap doors* Worm * Logic Bombs* Zombie * Trojan Horse * Virus

9. Malware - Virus  Types of viruses  Parasitic (old fashion)  Memory-resident (even in Bios)  Boot sector  Stealth (tries to look uninfected)  Polymorphic (change ‘signature’)

10. Malware – virus - nature  Lifecycle 4 phases:  Dormant (idle)  Propagation (spreading)  Triggering (activated)  Execution (doing some kind of damage)  Where  E-mail  Macro to word  Programs  And the latest – in mobile phones

11. Malware – Worms ( Zombies )  Lifecycle:  Search new ’host’ – security holes  Connect to new host  Make a copy  Most famous worm (and the first one)  Morris 1988  The fastest spreading worm  Nimda 2001 in 22 minutes number 1 of most active viruses/worms

12. Protection  Antivirus programs  Detect, identification, removal  The battle virus vs. antivirus  Antivirus - Scanning for Signature - Try Generic Decryption - Still the time from a new Virus to get the antivirus become more critical ( e.g. caused this Nimda-worm )