Network Attacks

Question 1

Virus

Answer 1

Infection of system that modifies behavior

Question 2

Worm

Answer 2

Code that propagates / replicates across network

Question 3

Worm Lifecycle

Answer 3

Scan for vulnerable hosts
Infect hosts
Remain undiscovered

Question 4

Famous Worms

Answer 4

Morris Worm
Code Red 1v2
Code Red 2
Nimda
Slammer Worm

Question 5

Model spread of worms

Answer 5

Random Constant Spread Model

Question 6

Spam

Answer 6

Work overhead (designing filters)
Storage (servers save mail)
Security (phishing emails)

Question 7

Spam filters

Answer 7

content
IP
behavior

Question 8

Dos Defense

Answer 8

Ingress filtering
Reverse Path Filtering check
Syn Cookies

Question 9

Backscatter

Answer 9

Assume source IPs are spoofed

Measure traffic going back to source IPs

Question 10

Why do defenses fail against crossfire DDoS?

Answer 10

Bots dont spoof IPs

Traffic is legitimate traffic

Low intensity flows dont trip sensors

Question 11

Why does crossfire attack dynamically change set of target links?

Answer 11

Conduct a rolling attack as to not trip router failure detection mechanisms