Please enable JavaScript.

Coggle requires JavaScript to display documents.

Computer Security: Attacks, NUR ADLI BIN NASIR CE190156 - Coggle Diagram

- - - - DDOS/DOS
        
        A denial-of-service (DoS) attack is a type of cyber attack in which a malicious actor aims to render a computer or other device unavailable to its intended users by interrupting the device's normal functioning. DoS attacks typically function by overwhelming or flooding a targeted machine with requests until normal traffic is unable to be processed, resulting in denial-of-service to addition users.
        
        DDOS Attacks
        
        Client: The control software used by the hacker to launch attacks.The client directs command strings to its subordinate hosts.
        
        Daemon: Software programs running on a zombie that receive
        incoming client command strings and act on them accordingly.
        
        Master:A computer that runs the client software.
        
        Zombie: A subordinate host that runs the daemon process.
        
        Target:The recipient of the attack.
        
        Man in the Middle Attacks
        
        A man in the middle (MITM) attack is a general term for when a perpetrator positions himself in a conversation between a user and an application. The goal of an attack is to steal personal information, such as login credentials, account details and credit card numbers.
        
        Targets are typically the users of financial applications, SaaS businesses, e-commerce sites and other websites where logging in is required. Information obtained during an attack could be used for many purposes, including identity theft, unapproved fund transfers or an illicit password change.
        
        Spoofing
        
        Blink Spoofingattacks in which the attacker can only send and has to make assumptions or guesses about replies
        
        Spoofing means providing false information about your identity in order to gain unauthorized access to systems, or, in even simpler terms, pretending to be someone you are not. The most classic example of spoofing is IP spoofing.
        
        Informed Attacks in which the attacker can monitor, and
        therefore participate in, bidirectional communications.
        
        Spoofing is not always malicious. Some network redundancy schemes rely on automated spoofing in order to take over the identity of a downed server
        
        Social Engineering
        
        Social engineering is often overlooked in security plans and scenarios, which is unfortunate because it is one of the most dangerous and easily used methods to infiltrate a victim network.The concept is nothing more than creative lying.
        
        The lies are often backed up by materials found in dumpster diving, which involves digging through the victim’s trash, looking for important documents, phone lists, and so forth. Knowing a few important names, for example, can make the attacker seem more authentic and can allow him to pose as someone he is not, perhaps asking for classified information over the telephone. This information can be something as trivial as someone’s telephone number, or as confidential as someone’s server password and login ID.
- - - - Vulnerability Scanning
        
        Vulnerability scanning is important to both attackers and those responsible for security hosts and networks. This refers to the act of probing a host in order to find an exploitable service or process. There are a number of tools that can assist in vulnerability scanning.
        
        A basic example is a tool called Nmap. It is a port scanner, which sends packets to a host in order to generate a list of services the host is running, and it will also return the OS type.
        
        With this information, an attacker can get a better idea of what type of attack may be suitable for that particular host
      - Sniffing and Eavesdropping
        
        A sniffer is a tool that enables a machine to see all packets that are passing over the wire (or through the air on a wireless network), even the ones not destined for that host
        
        This is a very powerful technique for diagnosing network problems, but it can also be used maliciously to scan for passwords, e-mail, or any other type of data sent in the clear.
        
        One of the more powerful features of Ethereal is the ability to reassemble TCP streams and sessions. After capturing an amount of data, an attacker can easily reassemble Web
        pages viewed, files downloaded or e-mail sent.
- - - - Brute force, in its simplest definition, refers to trying as many password combinations as possible until hitting on the right one. It is a method commonly used to obtain passwords, especially if the encrypted password list is available.
      - While the exact number of characters in a password is usually unknown, most passwords can be estimated to be between four and 16 characters. Since only about 100 different values can be used for each character of the password, there are only about 100^4 to 10016 likely password combinations
      - Brute force attempts to discover passwords usually involve stealing a copy of the username and hashed password listing and then methodically encrypting possible passwords using the same hashing function. Some variations of brute force techniques involve simply passing. possible passwords directly to the system via remote login attempts.
    - - Appropriate password selection minimizes—but cannot completely eliminate—a
        password’s ability to be cracked
      - Simple passwords such as any individual word in
        a language make the weakest passwords because they can be cracked with an elementary
        dictionary attack
      - In this type of attack, long lists of words of a particular
        language called dictionary files are searched to find a match to the encrypted password.
- - - - Malware is malicious software. Two common types of malware are viruses and Trojan horses. Viruses self-replicate and spread without user interaction, and the really advanced ones can modify themselves to avoid detection.
      - A Trojan horse (or Trojan) is a program that appears to do one thing but does something else instead of or in addition to its claimed use. Trojan horses typically trick a user into running them by promising that they do something great, such as make the
        e-mail transfer faster, or offering a money-making opportunity.
    - - Parasitic: Parasitic viruses infect executable files or programs in the computer. This type of virus typically leaves the contents of the host file unchanged but appends to the host in such a way that the virus code is executed first.
      - Bootstrap sector: This virus replaces either the programs that store information about the disk’s contents or the programs that start the computer. This type of virus is most commonly spread via the physical exchange of floppy disks.
      - Multi-partite: Multi-partite viruses combine the functionality of the
        parasitic virus and the bootstrap sector viruses by infecting either files or boot sectors.
      - Companion: Instead of modifying an existing program, a companion
        virus creates a new program with the same name as an already existing
        legitimate program. It then tricks the OS into running the companion
        program, which delivers the virus payload.
      - Link:Link viruses function by modifying the way the OS finds a program, tricking it into first running the virus and then the desired program. This virus is especially dangerous because entire directories can be infected. Any executable program accessed within the directory will trigger the virus.