Attacks Flashcards
A packet containing a long string of NOP’s followed by a command is usually indicative of what?
A buffer overflow attack.
A series of the same control, hexidecimal, characters imbedded in the string is usually an indicator of a buffer overflow attack. A NOP is a instruction which does nothing (No Operation - the hexadecimal equivalent is 0x90)
The Intel x86 processors use the hexadecimal number 90 to represent NOP (no operation). Many buffer overflow attacks use long strings of control characters and this is representative of that type of attack.
A piece of malicious code that can take many forms and serve many purposes. Needs a host in which to live, and an action by the user to spread.
Virus
A type of malicious code that lays dormant until a logical event occurs (such as a specific person’s name is no longer in the payroll database)
Logic Bomb
Many small attacks add up to equal a large attack (Movie: Office Space: stealing a fraction of a penny)
Salami
Similar to a virus, but does not need a host and is self replicating
Worm
One program (usually some type of malicious code) masquerades as another. Common means of distributing Back Door Programs
Trojan Horse
Altering/Manipulating data, usually before entry (Taco Bell: charge 50-cents for a taco and pocket other $1.50)
Data Diddling
Capturing and Viewing packets through the use of a protocol analyzer. (Passive Man-in-the Middle attack) Best defense: Encryption
Sniffing
Where an attacker steps in between two hosts and either monitors the exchange, or often disconnects one.
Session Hijacking
Where an attacker steps in between two hosts and either monitors the exchange, or often disconnects one. Session hijacks are active types of Man-in-the Middle attacks. Encryption prevents sniffing and mutual authentication would prevent a session hijack
A Program that allows access (often administrative access) to a system that bypasses normal security controls. Examples are NetBus, Back Orifice, SubSeven
Back Door Programs
An attack on a RAS (Remote Access Server) where the attacker tries to find the phone number that accepts incoming calls. RAS should be set to use caller ID (can be spoofed), callback (best), and configured so that modem does not answer until after 4 calls.
Wardialing
The purpose of these attacks is to overwhelm a system and disrupt its availability
Denial of Service (DoS)
Characterized by the use of Control Machines (Handlers) and Zombies (Bots) An attacker uploads software to the control machines, which in turn commandeer unsuspecting machines to perform an attack on the victim. The idea is that if one machine initiating a denial of service attack, then having many machines perform the attack is better.
Distributed Denial of Service (DDoS)
Sending a Ping Packet that violates the Maximum Transmission Unit (MTU) size—a very large ping packet.
Ping of Death
Considered a DoS
Overwhelming a system with a multitude of pings
Ping Flooding
Considered a DoS
Sending Malformed packets which the Operating System does not know how to reassemble. Layer 3 attack
Tear Drop
Attacks that overwhelm a specific type of memory on a system—the buffers. Is best avoided with input validation
Buffer Overflow
