1. Threats in Networks Jagdish S. Gangolly School of Business
State University of New York at Albany
NOTE: These notes are based on the book Security in Computing, by Charles & Shari Pfleeger, and are prepared solely for the students in the course Acc 661 at SUNY Albany. They are not to be used by others without the permission of the instructor.
1/11/2019
acc 661 Auditing of Adv Acctg Systems

2. acc 661 Auditing of Adv Acctg Systems
Threats in Networks I
Protocols (Guessing sequence numbers)
Impersonation
Authentication foiled by guessing
Authentication thwarted by eavesdropping or wiretapping
Authentication foiled by avoidance
Nonexistent authentication (trusted hosts: .rlogin, .rhosts)
Well-known authentication (default passwords)
Trusted authentication
1/11/2019
acc 661 Auditing of Adv Acctg Systems

3. acc 661 Auditing of Adv Acctg Systems
Threats in Networks II
Spoofing
Masquerade
Session hijacking
Man-in-the-middle attack
Message confidentiality threats
Misdelivery
Exposure
Traffic flow analysis
1/11/2019
acc 661 Auditing of Adv Acctg Systems

4. Threats in Networks III
Message integrity threats
Falsification of messages
Website defacement
Buffer overflows
Dot-Dot and address problems
Application code errors (users can change context encoded in URL request)
Server-side includes
1/11/2019
acc 661 Auditing of Adv Acctg Systems

5. Threats in Networks III
Denial of service
Transmission failure
Connection flooding
ICMP protocols (ping, echo, destination unreachable, source quench)
Smurf attack
Syn flood (spoof return address in initial SYN packet, and not responding with ACKs, thus flooding SYN-RECV queue)
1/11/2019
acc 661 Auditing of Adv Acctg Systems