Spyware is almost exactly as it sounds, a spying program. This type of malware will record the users input and transmit it back to the hacker to access at his leisure. This type of spyware is called a key logger and can capture interesting information such as user names, passwords, credit card numbers and email addresses. The more advanced versions of spyware can siphon off network data that will allow the hacker access to files, encryption keys, and other sensitive information. The final malware I will cover is the zombie.
It will inform you on how hackers and system administrators used ping sweeps and port scans. While describing some of these notorious computer activities, these techniques will also be shown how system administrators can use to benefit the company. Two techniques that are used to attack a network is ping sweep and port scans. These activities can be used with malicious intent against, as well as, in effort to try to protect a network. Ping sweeps and port scans has been a notorious and yet a useful tool for hackers and system administrators.
Internal attacks can be more difficult to find as attackers have the potential to remove any evidence of the attack more easily as they have more knowledge or access rights on the system as opposed to an outside attack. Attacks can be administrated via removable devices such as a USB that could contain some form of malware on it such as a virus. Most internal attacks are conducted by unhappy employees who want to disrupt the organisation by using the knowledge they obtained in the organisation, against the organisation. Additionally, the employee may want to gain access to important data in order to infiltrate and sell the information onto another competing organisation. The
The fact that an attacker can strike remotely makes a Web server an appealing target. Understanding threats to a Web server and being able to identify appropriate countermeasures permits us to anticipate many attacks and prevent the ever-growing numbers of attackers. The main threats to a Web server are: * Profiling * Denial of service * Unauthorized access * Arbitrary code execution * Elevation of privileges * Viruses, worms, and Trojan horses 1) Profiling: Profiling, or host enumeration, is an exploratory process used to gather information about the Web site. An attacker uses this information to attack known weak points. Vulnerabilities: • Unnecessary protocols • Open ports •Web servers providing configuration information in banners Attacks: • Port scans • Ping sweeps • NetBIOS and server message block (SMB) enumeration Countermeasures: Include blocking all unnecessary ports, blocking Internet Control Message Protocol (ICMP) traffic, and disabling unnecessary protocols such as NetBIOS and SMB.
Attackers are always looking for devices and software that are newly added to a system and not updated correctly with the security measures in place already. This is the door they look for to get in. A method to avoid such opportunities is to deploy an automated asset inventory discovery tool and use it to build a preliminary asset inventory of systems connected to an organization's public and private network. This will help make the system capable of identifying any new unauthorized devices that are connected to the network within 24 hours, and of alerting or sending e-mail notification to a list of enterprise administrative personnel. Without such a tool in place an attacker will use the unpatched device or software to gain access and manipulate the network how they please.
• Imagine you are a CISO of a publically traded company and concerned about security when sending any message traffic over the Internet to your remote sites. Determine the security measures you would consider implementing to mitigate security risks when sending message traffic over the Internet. Explain your reasoning. Teardrop – a mangled packet sent in fragments via overlapping or overloading payloads which could cause the systems as it has in the past with older OS versions. Sequence number – hijacked or interrupted TCP/IP sessions via injected packets that disguises its origination from one of the two computers in a session.
Unit 9 Assignment 1: List Phases of a Computer Attack In this assignment I am a hacker who needs to protect my organization from a computer attack. I will list general phases of a computer attack. We have an organization that we need to protect from outside attacks by foreign parties. I am an ethical hackers who needs to take preventative measures in order to adequately secure the network against these attacks. Many attackers follow a general set of steps in order to gain the permissions necessary to break into a system.
To begin with, the definition of a port scan is, “The examination of TCP and UDP ports to determine which are open and what services are running. (Conklin 659) “The method used by intruders to discover the services running on the target machine. The intruder can then plan an attack on any vulnerable service that he or she finds for example, if the intruder finds that port 143 is open here she may proceed to find out what version of IMAP is running on the target machine if the version is vulnerable she may be able to gain superuser access to the machine using exploit (a program that exploits a security hole).” (Teo, 2000) To put the definition of the port scan into simpler terms it is a way for intruders to scan the network of the company for a way into the company records and programs. A port scan can tell an intruder what port is open, where it leads to, and what programs, files, passwords are on the machine that they have found access. Ping sweeps are used to identify the path a host ID uses in a given subnet.
And to feel more secure I would purchase a firewall so that the outside would have A hard time accessing the network. I would also do a complete background check on the person that is being interviewed and or hired for the system administer
Two basic approaches are used in deliberate attacks on computer systems: data tampering and programming attack. Data tampering is a common means of attack that refers to an attack when someone enters false, fabricated or fraudulent data into a computer or changes or deletes existing data. This is the method often used by insiders and fraudsters and is extremely serious because it may not be detected. Programming attacks are popular with computer criminals that use programming techniques to modify other computer programs. For these types of crimes, programming skill and knowledge of the targeted systems are needed.