Midterm - CH 1,3,4,5,6,7, 10, 11, 12 Flashcards
Defensive or Secure Programming
the process of designing and implementing software so that it continues to function even when under attack
injection attack
wide variety of program flaws related to invalid handling of input data
This problem occurs when program input data can accidentally or deliberately influence the flow of execution of the program
command injection
the input is used in the construction of a command that is subsequently executed by the system with the privileges of the Web server
SQL injection
The user-supplied input is used to construct a SQL request to retrieve information from a database
code injection
the input includes code that is then executed by the attacked system
cross-site scripting (XSS) attacks
concerns input provided to a program by one user that is subsequently output to another user.
XSS reflection vulnerability
The attacker includes the malicious script content in data supplied to a site
Malware propagation mechanisms include those used by…(3)
viruses, worms and Trojans
The principal objectives of computer security are to
prevent unauthorized users from gaining access to resources,
to prevent legitimate users from accessing resources in an unauthorized manner,
and to enable legitimate users to access resources in an authorized manner
A consequence of a buffer overflow error is
corruption data used by the program,
unexpected transfer of control in the program,
possible memory access violation
To defend against database inference attacks we can apply
perturbation, de-identification, anonymization
Presenting or generating authentication information that corroborates the binding between the entity and the identifier is the
verification step
‘No write down’ is also referred to as the
‘*-property’
_____ is a process that ensures a system is developed and operated as intended by the system’s security policy
Assurance
____ data are data that may be derived from corporate data but that cannot be used to discover the corporation’s identity
Sanitized
Presenting or generating authentication information that corroborates the binding between the entity and the identifier is the
verification step
The most important changes needed to improve system security are to ____
disable remotely accessible services that are not required,
ensure that applications and services that are needed are appropriately configured,
disable services and applications that are not required
The following steps should be used to secure an OS:
test the security of the basic OS,
remove unnecessary services,
install and patch the OS
form of buffer overflow attack
heap overflows, return to system call, replacement stack frame
a set of automated tools designed to detect unauthorized access to a host system
intrusion detection system (IDS)
A multilevel secure system for confidentiality must enforce:
No read up: A subject can only read an object of less or equal security level. This is referred to in the literature as the simple security property (ss-property).
No write down: A subject can only write into an object of greater or equal security level. This is referred to in the literature as the *-property1 (pronounced star property).
_____ will integrate with the operating system of a host computer and monitor program behavior in real-time for malicious action
behavior blocking software
intrusion management encompasses
intrusion detection, prevention and response
Which of the following need to be taken into consideration during the system security planning process
how users are authenticated, the categories of users of the system, what access the system has to information
______ include system corruption, bots, phishing, spyware, and rootkits.
Payloads
Virus Propagation Phase
The virus places a copy of itself into other programs or
into certain system areas on the disk.
Virus Triggering Phase
The virus is activated to perform the function for which it was intended.
Virus Execution Phase
The function is performed. The function may be harmless, such as a message on the screen, or damaging, such as the destruction of
programs and data files.
Infects files that the operating system or shell consider to be executable.
File Infector Virus
An attack, that exploits social engineering to leverage user’s trust by masquerading as communications from a trusted source
Phishing Attack
Is a set of programs installed on a system to maintain covert access to that
system with administrator (or root) privileges, while hiding evidence of its presence
to the greatest extent possible.
Rootkit
An attempt to compromise availability
by hindering or blocking completely the provision of some service.
Denial-of-service (DoS) attack
DDoS Flooding attack targets…(3)
Network BW, System resources, Application resources
The ICMP echo response
packets generated in response to a ping flood using randomly spoofed source addresses is a good example.
Backscatter traffic
This attacks the ability of a network server to respond to TCP connection requests by overflowing the tables used to manage such connections.
DoS attach, SYN Spoofing Attack
The attacker sends packets to a known service on the intermediary with a spoofed source address
of the actual target system. When the intermediary responds, the response is sent to
the target.
Reflection Attack
Involve sending a<br></br>packet with a spoofed source address for the target system to intermediaries. They<br></br>differ in generating multiple response packets for each original packet sent. This can<br></br>be achieved by directing the original request to the broadcast address for some network.
Amplification Attacks
Can be deployed as operating systems updates to provide some protection for existing vulnerable programs. These defenses involve changes to the memory management of the virtual address space of processes.
Run_time Defenses
Most commonly<br></br>the address of a standard library function is chosen, such as the system() function. The attacker specifies an overflow that fills the buffer, replaces the saved<br></br>frame pointer with a suitable address, replaces the return address with the address of the desired library function, writes a placeholder value that the library function will believe is a return address, and then writes the values of one (or more) parameters to this library function.
return to system call attack
If the allocated space includes a pointer to a
function, which the code then subsequently calls, an attacker can arrange for this address to be modified to point to shellcode in the overwritten buffer.
Heap Buffer Overflow
The process of designing and implementing
software so that it continues to function even when under attack. Software written using this process is able to detect erroneous conditions resulting from
some attack, and to either continue executing safely, or to fail gracefully.
Defensive Programming
This problem occurs when program input data can accidentally or deliberately influence the flow of execution of the program.
Injection Attack
When the input is used in the
construction of a command that is subsequently executed by the system with the
privileges of the Web server.
Command Injection Attack
In this attack, the user-supplied input is used to construct a SQL request to retrieve information
from a database.
SQL Injection Attack
This is a software testing technique that uses randomly generated data as inputs to a program. The intent is to determine whether the program or function
correctly handles all such abnormal inputs or whether it crashes or otherwise fails to respond appropriately.
Input Fuzzing
This strongly suggests that programs should execute with the least amount of privileges needed to complete their function.
Principle of Least Privilege
A process that includes planning, installation, configuration, update, and maintenance
of the operating system and the key applications in use,
Hardening a System
3 Steps to hardening a base OS
- Removing unnecessary services, applications, and protocols.
- Configuring users, groups, and permissions.
- Configuring resource controls.
Which restricts the server’s view of the file system to just a specified portion. Files in directories
outside the __________ are not visible or reachable at all.
Chroot Jail
Refers to a technology that provides an abstraction of the computing resources used by some software, which thus runs in a simulated environment
called a virtual machine (VM).
Virtualization
A bot is a computer compromised by malware and under the control of a bot master (attacker).
TRUE
Characteristics of APT include _(3)_____.
Advanced Persistent Threats
A. Using zero-day exploit
B. Low-and-slow
C. Targeting high-value data
The best defense against being an unwitting participant in a DDoS attack
prevent your systems from being compromised
Both static and dynamic analyses are needed in order to fully understand malware behaviors
True
A Botnet can use _______ for command-and-control.
A. Email
B. HTTP
C. IRC
In a ______ attack the attacker creates a series of DNS requests containing the spoofed source address for the target system.
DNS amplification
APT attacks
Boy in the middle–covertly changes a computer’s network routing
Clickjacking–web users unknowingly click on something that is not as it is portrayed.
Man in the Browser–Modifies web pages covertly
Man in the middle–Eavesdrops
Keyloggers–covertly records keystrokes
Takes advantage of a previously unknown weakness or vulnerability in a system.
Zero-Day Exploit
APT Lifecycle
- -Define target
- -Research target infrastructure/employees
- -Test for detection
- -deployment
- -establish outbound connections
- -exfiltrate data
- -remain undetected
- -Repeat
Advanced Persistent Threat (APT)
Advanced: Use special malware
Persistent: Long-term presence, multi-step, low-and-slow
Threat: Data targeted is high value
Tend to target specific organizations
Examples of Attacks/Frauds by botnets
- -Spam
- -DDOS
- -Click fraud
- -Phishing and Pharming
- -Keylogging and data/ID theft
- -Key/password cracking
- -Anonymized terrorist and criminal communication
- -Cheat in online games and polls
Why DDoS attack?
Why DDoS attack?
- -Attacker does not need to use his own computer
- -So many computers involved in the attack, it is difficult to distinguish legitimate from malicious traffic
C&C design
- -Must be efficient and reliable
- -Stealthy
- -Resilient
T/F: The botmasters prefer dynamic DNS servers
True: Because of the frequent change between domain name and IP address.
Anomaly detection
The way the bots look up a domain suggest the domain is most likely used for C&C.
What can be done when the anomaly is detected?
Map the domain name to a sinkhole
What is the advantage of the sinkhole?
Researchers can discover where the bots are in the net.
