DOCSLIB.ORG

Troubleshooting and Cyber-Reference

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Troubleshooting and Cyber-Reference APPENDIX A Troubleshooting and Cyber-Reference Security Center Logs and Cybersecurity Vocabulary Azure Security Center Diagnostics Troubleshooting This appendix contains tips for troubleshooting Security Center that you may need during configuration and when trying to understand how data flows from the endpoint protection–extended client to Security Center. This appendix was written in response to technical questions that I have gotten in the course of my work; it helps security analysts understand how the communications and log data are handled in Security Center. Finally, cloud administrators in businesses large or small that are using Azure Security Center can gain insight into how to collect and share cybersecurity information. You should begin by searching for data in the Azure Audit Logs view after logging into the Azure Resource Manager (ARM) portal. When you installed and configured Security Center, you configured the diagnostic log that collects information separately from the virtual machines (VMs) and other platform as a service (PaaS) services. The Azure portal provides a Monitor journey with information collected for more than Azure Security Center. Review the information in Figure A-1 to gain a better understanding of the Azure Monitoring view. © Marshall Copeland 2017 165 M. Copeland, Cyber Security on Azure, DOI 10.1007/978-1-4842-2740-4 APPENDIX A ■ TROUBLESHOOtING aND CYBER-REFERENcE Figure A-1. Azure “Diagnostics logs” collection portal service The log files for Windows Server contain records of information specifically used to write events on the services provided by the operating system (OS). The security log in Windows Server provides details for the Local Security Authority Subsystem Service (LSASS.exe), and this log is used to investigate any attempt to gain access by unauthorized intruders. If you are taking advantage of the Azure infrastructure as a service (IaaS), the specific logs for the Windows OS VM include the following: • Windows Log • Application • Security • Setup • System • ForwardedEvents • Applications and Services • Admin • Operation • Analytic • Debug 166 APPENDIX A ■ TROUBLESHOOtING aND CYBER-REFERENcE Now that a VM is a supported OS type (in the Azure Marketplace) running in Azure, additional logs have been added to the OS. These logs can also be used in collecting and identifying health issues beyond the standard OS logs. Some of the Azure logs include Azure platform logs, which includes logs that might be related to Azure guest agents, the Azure extensions, and other Azure components. ■■Note You can find Azure log details at https://azure.microsoft.com/en-us/blog/simplifying- virtual-machine-troubleshooting-using-azure-log-collector, and you can find the Azure VM extension details at https://docs.microsoft.com/en-us/azure/virtual-machines/windows/log-collector- extension. The Event-Logging service controls tracked events in the OS, and when the service starts, you can track activities such as user actions and system resource events. The generic data that is provided includes auditing data in categories by event audit, including the following: • Information: Events that are informational, not a toggle between success and failure • Success Audit: Events related to successful action • Failure Audit: Failed execution of an action • Warning: Details useful in future system actions • Error: Failure for a specific action When you look at log information, there is specific data that log files can provide including the following: • Source: What application or service logged the action • Category: Future description related to the action • Event: Identifies the specific action • User: User account that was logged during the event action • Computer: Computer name during the event action • Description: Details of the event action • Data: Any data or error codes output by the event action You now have a good understanding of the type of data provided in the Window OS event logs and the extended logs from the Microsoft Azure event logs. The logs and data can be searched for the action, who enabled it, when the action accrued, and other statuses or values of the event to help with troubleshooting. In this book, you were introduced to three Azure Security Center agents that are installed on VMs, and these services all provide log file data. You should enable the monitoring of the agents’ data collection when you configure the diagnostic service. The three services are as follows: • ASMAgentLauncher.exe: Azure Monitoring Agent • ASMMonitoringAgent.exe: Azure Security Monitoring extension • ASMSoftwareScanner.exe: Azure Scan Manager The extensions are needed to integrate the Azure-installed endpoint protection agent and to complete the automated removal of cybersecurity threats. If open a Task Manager or Sysinternals Process Explorer, you will see something similar to Figure A-2. 167 APPENDIX A ■ TROUBLESHOOtING aND CYBER-REFERENcE Figure A-2. ASM agents installed by Azure Security Center SYSINTERNALS FROM A WEB BROWSER Often IT professionals must configure tools to run on systems and provide details; for example, you might need a tool to review log files and run processes in memory and CPU utilization. However, installing the product is a post-configuration build step that is sometimes missed. Rather than install the Sysinternals tools on each server, with the proper firewall security in place, you can use the entire toolset available at https://live.sysinternals.com, as shown in Figure A-3. These Sysinternals tools, with proper administrative permissions, run on any server or workstation with a web browser. 168 APPENDIX A ■ TROUBLESHOOtING aND CYBER-REFERENcE Figure A-3. View through a browser of https://live.sysinternals.com 169 APPENDIX A ■ TROUBLESHOOtING aND CYBER-REFERENcE If you scroll down to the Process Explorer and click the text to start the executable, you may see a browser pop-up window to allow the processes, as shown in Figure A-4. Figure A-4. IE browser pop-up to run or save the Sysinternals procexp.exe program Click Run; the installation starts and requires permission to continue, as shown in Figure A-5. Figure A-5. Sysinternals license terms 170 APPENDIX A ■ TROUBLESHOOtING aND CYBER-REFERENcE Click Agree, and the Process Explorer program starts to run. Process Explorer is a feature-rich view, more than the built-in Windows Task Manager, as shown in Figure A-6. Figure A-6. Process Explorer running after selecting the procexp.exe from the web browser The Azure Security Monitoring extension does the scan for event information, and each agent has a different responsibility, such as patch scanning. You can look at the log file information on the Azure VM in the installation directory’s agent log folder. • %systemdrive%\windowsazure\logs (i.e., C:\WindowsAzure\Logs). One of the “unwritten” rules of cybersecurity analysis is to understand, based on log file data, the amount of data and correlation of events to classify work as “normal.” If log file information is not updating as expected or is not what you would normally expect to see from the agent log files, you need to restart the VM because there is currently no PowerShell command to stop or restart the agent. After the system reboots, you can remove the agent and then reinstall it to validate that any issues were resolved. Typically, on large installations, identifying a single Security Center agent installation that is incomplete is common. To uninstall the agent and then automatically reinstall it, follow these steps: 1. From the Azure portal, click the virtual machine. 2. Right-click Microsoft Azure Security Monitoring and click Uninstall. The Security Monitoring extension will automatically reinstall (it takes about ten minutes). The Security Center agent installation in Linux requires a different but similar log file location. The following are the log file locations: • /var/log/mdsd.err • /var/log/azure/ On a Linux system, the extension is downloaded to the following location: /var/lib/waagent/. Then you need to run the command cat /var/log/waagent.log. 171 APPENDIX A ■ TROUBLESHOOtING aND CYBER-REFERENcE Linux systems have daemons (similar to Windows OS services) and require listening via connections for specific ports based on the TCP or UDP requirements. The Linux agent communicates on port 29130 using TCP. From a command prompt, run the following: netstat -plantu | grep 29130 General networking troubleshooting processes may include the endpoint protection of the anti- malware extension on the Azure agent. ■■Security Tip This tip is important to repeat. The System Center Configuration Manager agent installation is not compatible with Azure Security Center because it does not, currently, have the needed extensions. Even if you plan to support all Azure VMs through the Configuration Manager console, the integration with Azure Security Center must be installed from the Azure System Center portal. The following are additional key points for troubleshooting: • Remove and reinstall the agent: uploaded, custom image, and new installs. • The Linux agent is different from the Windows agent. • New agents update automatically. Older versions do not update correctly; you must reinstall them. • Validate that the agent is running (Figure A-2); some software may disable the agent. • A change request process may help identify when incorrect settings for an Azure network security group (NSG) were changed. Block network traffic to and from the guest agent. There are other Azure-specific sites that you can review, including the Windows Azure – Troubleshooting & Debugging site. (The current site refers to Windows Azure still.) You can find it at https://blogs.msdn.microsoft.com/kwill/, as shown in Figure A-7. 172 APPENDIX A ■ TROUBLESHOOtING aND CYBER-REFERENcE Figure A-7. Azure troubleshooting blog Another location for helpful information on all Azure cloud subjects is the Microsoft Azure forum at https://social.msdn.microsoft.com/forums/en-US/home?category=windowsazureplatform, azuremarketplace,windowsazureplatformctp, as shown in Figure A-8. The top-right search option allows you to search for Security Center topics. 173 APPENDIX A ■ TROUBLESHOOtING aND CYBER-REFERENcE Figure A-8.
Load more

Recommended publications
  • Wikileaks Wars: Digital Conflict Spills Into Real Life
    Home | Tech | Science in Society | News | Back to article WikiLeaks wars: Digital conflict spills into real life 15 December 2010 by Jacob Aron Magazine issue 2791. Subscribe and save For similar stories, visit the Computer crime and Weapons Technology Topic Guides ADVERTISEMENT Editorial: Democracy 2.0: The world after WikiLeaks WHILE it is not, as some have called it, the "first great cyberwar", the digital conflict over information sparked by WikiLeaks amounts to the greatest incursion of the online world into the real one yet seen. In response to the taking down of the WikiLeaks website after it released details of secret diplomatic cables, a leaderless army of activists has gone on the offensive. It might not have started a war, but the conflict Dress code for an Anonymous vendetta (Image: is surely a sign of future battles. Sander Koning/AFP/Getty) 1 more image No one is quite sure what the ultimate political effect of the leaks will be. What the episode has done, though, is show what happens when the authorities attempt to silence what many people perceive as a force for freedom of information. It has also shone a light on the evolving world of cyber-weapons (see "The cyber-weapon du jour"). WikiLeaks was subjected to a distributed denial of service (DDoS) attack, which floods the target website with massive amounts of traffic in an effort to force it offline. The perpetrator of the attack is unknown, though an individual calling himself the Jester has claimed responsibility. WikiLeaks took defensive action by moving to Amazon's EC2 web hosting service, but the respite was short-lived as Amazon soon dumped the site, saying that WikiLeaks violated its terms of service.
    [Show full text]
  • Impact of Distributed Denial-Of-Service Attack On
    View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Sheffield Hallam University Research Archive Impact of Distributed Denial-of-Service Attack on Advanced Metering Infrastructure Satin Asri1 and Bernardi Pranggono2 1Department of Computer Science and Engineering Manipal Institute of Technology Manipal, India Email: [email protected] 2School of Engineering and Built Environment Glasgow Caledonian University Glasgow, UK Email: [email protected] Abstract The age of Internet of Things (IoT) has brought in new challenges specifically in areas such as security. The evolution of classic power grids to smart grids is a prime example of how everything is now being connected to the Internet. With the power grid becoming smart, the information and communication systems supporting it is subject to both classical and emerging cyber-attacks. The article investigates the vulnerabilities caused by distributed denial-of-service (DDoS) attack on the smart grid advanced metering infrastructure (AMI). Attack simulations have been conducted on a realistic electrical grid topology. The simulated network consisted of smart meters, power plant and utility servers. Finally, the impact of large scale DDoS attacks on the distribution system’s reliability is discussed. Keywords advanced metering infrastructure (AMI); distributed denial-of- service (DDoS); smart grid; smart meter 1 Introduction In 2011 McAfee reported over 60% of critical infrastructure companies regularly found malware designed to attack their systems. Smart grid is arguably the most fundamental cyber-physical infrastructures of the humankind and modern society. Smart grid and advanced metering infrastructure (AMI) or commonly known as the smart meter are considered as the main signs of classical electrical grids evolution toward smarter grids.
    [Show full text]
  • Guide to Ddos Attacks November 2017
    TLP: WHITE Guide to DDoS Attacks November 2017 This Multi-State Information Sharing and Analysis Center (MS-ISAC) document is a guide to aid partners in their remediation efforts of Distributed Denial of Service (DDoS) attacks. This guide is not inclusive of all DDoS attack types and references only the types of attacks partners of the MS-ISAC have reported experiencing. Table Of Contents Introduction .................................................................................................................................................................. 1 Standard DDoS Attack Types ................................................................................................................................... 4 SYN Flood ................................................................................................................................................................ 4 UDP Flood................................................................................................................................................................ 5 SMBLoris .................................................................................................................................................................. 7 ICMP Flood .............................................................................................................................................................. 8 HTTP GET Flood .................................................................................................................................................
    [Show full text]
  • Deploying Crowd-Sourced Formal Verification Systems in a Dod Network
    Calhoun: The NPS Institutional Archive Theses and Dissertations Thesis Collection 2013-09 Deploying crowd-sourced formal verification systems in a DoD network Dumlupinar, Mahmut Firuz Monterey, California: Naval Postgraduate School http://hdl.handle.net/10945/37617 NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS DEPLOYING CROWD-SOURCED FORMAL VERIFICATION SYSTEMS IN A DOD NETWORK by Mahmut Firuz Dumlupinar September 2013 Thesis Advisor: Geoffrey G. Xie Second Reader: Thomas Housel Approved for public release; distribution is unlimited THIS PAGE INTENTIONALLY LEFT BLANK REPORT DOCUMENTATION PAGE Form Approved OMB No. 0704-0188 Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington DC 20503. 1. AGENCY USE ONLY (Leave blank) 2. REPORT DATE 3. REPORT TYPE AND DATES COVERED September 2013 Master’s Thesis 4. TITLE AND SUBTITLE 5. FUNDING NUMBERS DEPLOYING CROWD-SOURCED FORMAL VERIFICATION SYSTEMS IN A DOD NETWORK 6. AUTHOR(S) Mahmut Firuz Dumlupinar 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION Naval Postgraduate School REPORT NUMBER Monterey, CA 93943-5000 9. SPONSORING /MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING/MONITORING N/A AGENCY REPORT NUMBER 11.
    [Show full text]
  • Turning a Smartphone Into a Mobile Attack Vector
    View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by ZENODO SlowDroid: Turning a Smartphone into a Mobile Attack Vector Enrico Cambiaso∗, Gianluca Papaleo†, Maurizio Aiello‡ National Research Council, CNR-IEIIT, via De Marini, 6, 16149 Genoa, Italy Email: ∗[email protected], †[email protected], ‡[email protected] Abstract—Nowadays, last generation of smartphones are (DoS) menace, executed to make a network service unavailable comparable to desktop computers in terms of computational for its legitimate users. While the first generation of DoS capabilities. Such characteristics can turn a smartphone into a attacks were based on a particular exploit or on flooding the mobile attack vector. In this paper we analyze the use of mobile victim with a large amount of network traffic, novel threats, devices to perpetrate cyber attacks. We present a mobile threat, known as Slow DoS Attacks (SDAs) [6], are particularly suit- SlowDroid, running on Android operating system. Such menace able to a mobile environment, since they require tiny amount of implements a Denial of Service attack and it is particularly suitable to a mobile execution, since it makes use of low amounts network and computational resources. Moreover, since SDAs of computational and bandwidth resources. We present in detail are considered particularly dangerous, a mobile execution of SlowDroid implementation and our choices in terms of design, these menaces should represent an amplification of the threat, graphical user interface, and system architecture. as a portable and position varying threat execution may elude detection methodologies. Keywords—android, mobile attack, cybersecurity, slow dos at- tack, denial of service The rest of the paper is structured as follows.
    [Show full text]
  • JETIR Research Journal
    © 2020 JETIR February 2020, Volume 7, Issue 2 www.jetir.org (ISSN-2349-5162) REVELATION OF INFECTED NODES IN NETWORK USING HONEYPOT 1Sabari Giri Murugan S, 2Shravya R Nadig, 3Thiyagu S 1Assistant Professor, 2Student of BCA, 3Assistant Professor 1Department of BCA, 1Jain Deemed to be University, Bangalore, India. Abstract: The network which we use for the various purpose may have anonymous nodes that need to be determined detected with a various counter attempt which is done by the unauthorized user (attackers). In this, we use honeypot which can be detected by the intrusion detection system that can be identified the malicious code or activity or software that is performed by the attacker over the network. Further, we can analyze the behavior of different tools that have been created by DOS and DDOS attack over the network. In a DoS defence mechanism, a honeypot acts as a detective server among the pool of servers in a specific network; where any packet received by the honeypot is most likely a packet from an attacker. There are also many loopholes that have been created by the attacker that could be getting information about the legitimate user for his software and hardware requirements. Index Terms – Attacker, DoS and DDoS. I. INTRODUCTION In the present fast paced world consistent continuous productive assistance is the establishment for all help associations. The achievement of any new or existing endeavor is basically subject to the unwavering quality and nonstop accessibility of administration. Continuously every individual is getting increasingly more reliant on the web for creative and well-coordinated satisfaction of his need.
    [Show full text]
  • Efeitos Do Ataque LOIC
    GTS 2012 Efeitos do ataque LOIC. Eduardo Bergmann Roteiro •LOIC: Definição, participação e ferramentas •Cenário de testes •Metodologia •Resultados •Prevenção •Conclusão LOIC: Low Orbit Ion Cannon •Desenvolvida pela Praetox Technologies •Ferramenta de teste de carga •TCP(Transmission Control Protocol), •UDP (User Datagram Protocol) •HTTP (HyperText Transfer Protocol) •Disponível em: http://sourceforge.net/projects/loic/ Funcionamento Funcionamento via canal IRC •Iniciar ataque: !lazor targetip=<IRC_server> message=<texto> port=80 method=http wait=false threads=15 method=tcp random=true start •Finalizar ataque: !lazor stop Implementações Windows Web Linux Android BSD (JavaScript) Participação consciente •Downloads: 1.Estados Unidos 2.França 3.Brasil 4.Alemanha ... http://sourceforge.net/projects/loic/ em 26 de abril de 2012 Popular e acessível Agendamento de ataque http://pastebin.com/WEydcBVV em 26 de abril de 2012 Receberam ataques •FBI •MPAA – Motion Picture Association of America •Departament of Justice •RIAA – Recording Industry Association of America •Sony •Visa •MasterCard •Paypal Cenário dos testes Servidor atacado: • Core 2 Duo 2.2 Ghz • 2 Gb RAM • Ubuntu 10.04 • Apache 2.2 • Conectado a um switch ethernet 100 Mbps Cenário dos testes PC iPad 2 Galaxy SII Motorola Defy Core 2 Duo 2.2 Dual-core Dual-core 1.2 800 MHz Ghz Apple A5X GHz Cortex-A9 Cortex-A8 2 GB RAM 512 MB RAM 1 GB RAM 512 MB RAM Cenário dos testes Ferramentas de ataque PC Galaxy SII Motorola Defy iPad 2 LOIC JSLOIC JSLOIC JSLOIC JSLOIC Android LOIC Android LOIC Metodologia
    [Show full text]
  • Distributed Denial of Service Attacks on the Rise: What Community Bank Ceos Should Know
    Illinois Department of Financial and Professional Regulation Division of Banking PAT QUINN MANUEL FLORES Governor Acting Secretary Memorandum To: All Illinois Financial Institutions From: Manny Flores, Acting Secretary Subject: Distributed Denial of Service Attacks planned for May 7, 2013 As you are probably aware, cyber thieves and hacktivist groups (hackers that disrupt online services for social causes) are increasingly in the news for their use of distributed denial of service (DDoS) attacks on the banking system. Recently a group of hacktivists announced on Pastebin (a publicly available website where hacktivists post announcements) that they plan to initiate a campaign of cyber-attacks, named OpUSA, against U.S. financial institutions’ websites beginning today, May 7th. Previous efforts by this group have had limited impact; however, there have been additional Pastebin postings inviting other hacktivists groups to join or support the planned attacks. The FBI has been reaching out to financial institutions directly to inform them of these postings. I’ve enclosed information about Distributed Denial of Service Attacks and the steps you can take to help minimize the risk of an attack. Please share this information with your institutions Incident Response Team. Also enclosed you will find the latest FBI Liaison Alert System (FLASH Message) message. FLASH message contains critical technical information collected by the FBI for use by both interagency and private sector partners. This report is intended for liberal distribution throughout the financial sector to provide recipients with actionable intelligence, which will aid in timely victim notification and response. Every FLASH Message has a unique alpha-numeric tag, which can be located at the top of each report.
    [Show full text]
  • Ddos Handbook.Pdf
    DDoS HANDBOOK THE ULTIMATE GUIDE TO EVERYTHING YOU NEED TO KNOW ABOUT DDoS ATTACKS SHARE THE DDoS HANDBOOK © 2015 Radware, Ltd. All Rights Reserved. Radware and all other Radware product and service names are registered trademarks of Radware in the U.S. and other countries. All other trademarks and names are the property of their respective owners. DDoS Handbook Table of Contents 1 Introduction ...........................................................................................................4 2 A Quick Look Back .................................................................................................5 3 Recent History: Notable Cyber-Attacks of 2014 ......................................................8 4 Attack Types ........................................................................................................10 5 Attack Tools .........................................................................................................19 6 Enterprise Security: Then and Now.......................................................................24 7 What Lies Ahead: Predictions for 2015 and Beyond ..............................................29 8 DDoS Mitigation Considerations ...........................................................................31 9 Checklist: How to Evaluate a Vendor for DDoS & Cyber-Attack Mitigation .............35 10 DDoS Dictionary ..................................................................................................37 1 Introduction Since the first denial of service (DoS) was
    [Show full text]
  • (U) Hacktivist Groups Target U.S. and Foreign Networks
    A-0007-NCCIC-120020110630 DISTRIBUTION NOTICE (A): THIS PRODUCT IS INTENDED FOR THE CYBERSECURITY, CRITICAL INFRASTRUCTURE AND/OR KEY RESOURCES COMMUNITY AT LARGE. PLEASE DISTRIBUTE IT AS NECESSARY TO COMMUNICATIONS STAKEHOLDERS IN THE PUBLIC AND PRIVATE SECTORS. (U) HACKTIVIST GROUPS TARGET U.S. AND FOREIGN NETWORKS EXECUTIVE SUMMARY (U//FOUO) This Bulletin is being provided for your Executive Leadership, Operational Management, and Security Administrators situational awareness. The National Cybersecurity and Communications Integration Center (NCCIC), through coordination with its partners and monitoring of multiple sources, is tracking reports that members of the hacktivist collectives ‘LulzSec’ and ‘Anonymous’ have combined their efforts and continue to perpetrate cyber attacks targeting U.S. and foreign networks.i,ii LulzSec Members have posted statements on the internet claiming the attacks, referred to as ‘Operation AntiSecurity’ (AntiSec), are ‘designed to demonstrate the weakness of general internet security’ and have allowed them to collect massive amounts of data. (U) LulzSec is purported to be a group of former Anonymous members who typically use widely available and crude tools to hijack or deface web pages as a political statement.iii They also routinely post information regarding planned and ongoing activities on publicly available Internet Relay Chat (IRC) sessions and social networking sites like Twitter. Recent attacks by LulzSec and Anonymous have proven simple Tactics, Techniques and Procedures (TTPs) are often successful, even against entities who have invested a significant amount of time and capital into designing and securing their information networks. (U//FOUO) While LulzSec has generated a significant amount of media coverage and at least a moderate degree of financial impact to several commercial firms, it has primarily resulted in negative publicity for the entities whose networks were affected.
    [Show full text]
  • A Comprehensive Study on Distributed Denial of Service Attacks and Defense Mechanisms
    International Journal of Computer Applications (0975 – 8887) International Conference on Information and Communication Technologies (ICICT- 2014) A Comprehensive Study on Distributed Denial of Service Attacks and Defense Mechanisms Pavithra K.C Snitha Shetty Dr. Nagesh H.R IV Semester, M.Tech. IV Semester, M Tech. Professor & Head Dept. of CSE Dept. of CSE Dept. of CSE MITE, Moodabidri MITE, Moodabidri MITE, Moodabidri ABSTRACT Service (DDoS) attack. The result of a DDoS attack is The advances in information technologies in the internet are amplified and the problem of defence is made tougher by increasing the possibility of attacks exponentially. Denial of using multiple attackers. In such cases, it is harder to detect Service (DoS) and Distributed Denial of Service (DDoS) and block attackers manually, so special defences are needed attacks are increasing rapidly across the internet world. Denial to detect and defend against such large-scale attacks. of Service (DoS) is an attack on availability of a service. The Attackers infect thousands of computers spread across the attack aims at denying of an approved service to a legitimate world with sophisticated malware technologies in order to user. When a group of attackers perform DoS attack on a gain unauthorized access to such systems. Attackers do not common target, the attack is known as DDoS. The most really control their attacking machines.Thousands of common method of performing a DoS or a DDoS attacks is to compromised machines act as an army under the command of flood the target or network with unwanted traffic, causing one attacker. Such a collection of thousands of machines is interruptions to the communication of legitimate users.
    [Show full text]
  • Cryptography and Network Security: Overview
    NetworkNetwork Security:Security: OverviewOverview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-17/ Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 1-1 Overview 1. Security Components 2. Steps in Cracking a Network 3. Types of Malware 4. Types of Attacks 5. Security Mechanisms Ref: C. Easttom, “Computer Security Fundamentals,” 3rd Ed, Pearson, 2016, 432 pp., Safari Book. Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 1-2 Security Components Confidentiality: Need access control, Cryptography, Existence of data Integrity: No change, content, source, prevention mechanisms, detection mechanisms Availability: Denial of service attacks A=Availability, Authenticity or Accountability Confidentiality, Integrity and Availability (CIA) CIA Triangle Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 1-3 Steps in Cracking a Network Information Gathering: Public sources/tools. Port Scanning: Find open TCP ports. Network Enumeration: Map the network. Servers and workstations. Routers, switches, firewalls. Gaining Access: Keeping root/administrator access Modifying: Using access and modifying information Leaving a backdoor: To return at a later date. Covering tracks Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 1-4 Types of Malware Viruses: Code that attaches itself to programs, disks, or memory to propagate itself. Worms: Installs copies of itself on other machines on a network, e.g., by finding user names and passwords Trojan horses: Pretend to be a utility.
    [Show full text]