SlideShare a Scribd company logo
Chapter 2 Systems Threats and Risks Security+ Guide to Network Security Fundamentals, Third Edition
Objectives Describe the different types of software-based attacks List types of hardware attacks Define virtualization and explain how attackers are targeting virtual systems
Software-Based Attacks
Malware (Malicious software ) Software that enters a computer system without the owner’s knowledge or consent The three primary objectives of malware To  infect  a computer system Conceal  the malware’s malicious actions Bring  profit  from the actions that it performs
Viruses Programs that secretly attach to file and execute when that file is opened Once a virus infects a computer, it performs two separate tasks Replicates  itself by spreading to other computers Activates its malicious  payload Payload examples Encrypt data and charge money to decrypt it Reformat the hard drive Use your computer to send spam Many others
Types of computer viruses File infector virus  – attached to EXE or COM file Resident virus  – lives in RAM Boot virus  – Infects the boot sector of a floppy disk Companion virus  – second file with similar name users execute by mistake, like  cmd.bat Macro virus  – lives inside a Microsoft Office document Metamorphic viruses Avoid detection by altering how they appear Polymorphic viruses Also encrypt their content differently each time
Worms Program designed to take advantage of a vulnerability in an application or an operating system in order to enter a system Worms are different from viruses in two regards: A worm can travel by itself (over a network) A worm does not require any user action to begin its execution Actions that worms have performed: deleting files on the computer; allowing the computer to be remote-controlled by an attacker
Trojans Trojan Horse (or just  Trojan ) Program advertised as performing one activity that but actually does something else User is tricked into installing the software
Rootkits System files are replaced by counterfeits Hides files and processes from the operating system Intruder gains remote control of the computer VERY hard to detect and remove Usually reformatting the drive and restoring from read-only backup is recommended
SONY Rootkit Secretly installed on PCs that played SONY music CDs in 2005 Exposed those machines to remote control by SONY and others This led to a massive product recall, and numerous lawsuits Links Ch 2a, 2b, 2c
Logic bomb Program waits for a  trigger event  such as a date, or the programmer being fired Once triggered, the  payload  executes, deleting files or causing other damage Logic bombs are extremely difficult to detect before they are triggered
Famous Logic Bombs
Privilege Escalation Gaining rights that the user should not have Types of privilege escalation Gain higher system rights, usually Administrator Gain another user’s rights
Spam Unsolicited e-mail Text-based spam messages can easily by trapped by special filters Image spam  uses graphical images of text in order to circumvent text-based filters
 
Evading Spam Filters Techniques GIF layering Word splitting Geometric variance See link Ch 2d
 
Malware for Profit (continued)
 
Blocking Spam Image spam cannot be easily filtered based on the content of the message To detect image spam, one approach is to examine the context of the message and create a profile, asking questions such as: Who sent the message? What is known about the sender? Where does the user go if she responds to this e-mail? What is the nature of the message content? How is the message technically constructed?
Spyware Software that violates a user’s privacy Antispyware Coalition defines spyware as: Technologies that are deployed without the user’s consent and impair the user’s control over: Use of their system resources, including what programs are installed on their computers Collection, use, and distribution of their personal or other sensitive information Material changes that affect their user experience, privacy, or system security
Spyware Spyware creators are motivated by profit Spyware is often more intrusive than viruses, harder to detect, and more difficult to remove Spyware is very widespread Almost every computer has some spyware on it Most common types of spyware Adware   Keyloggers
Effects of Spyware
Adware Delivers advertising content, often as pop-up windows Can slow or crash a computer Can monitor or track your activities Image from Link Ch 2e (adwarereport.com)
Hardware Keylogger A small device inserted between the keyboard connector and computer keyboard port  Records each keystroke a user types on the computer’s keyboard Used by a high school student to steal a final exam from a teacher (link Ch 2f)
Software Keyloggers Programs that silently capture all keystrokes, including passwords and sensitive information Hide themselves so that they cannot be easily detected even if a user is searching for them
Botnets Hundreds or thousandsof zombie computers are under the control of an attacker Zombie An infected computer with a program that will allow the attacker to remotely control it Attackers use  Internet Relay Chat (IRC)  to remotely control the zombies Attacker is knows as a  bot herder
Uses of Botnets
Hardware-Based Attacks
BIOS Basic Input/Output System (BIOS)   A program embedded on a chip Recognizes and controls different devices on the computer system Executed when the computer system is first turned on On older computer systems the BIOS was a  Read Only Memory (ROM)  chip Today’s computer systems have a  PROM (Programmable Read Only Memory)  chip Images from link Ch 2g, Ch 2h
BIOS Attacks One virus overwrites the contents of the BIOS and the first part of the hard disk drive, rendering the computer completely dead A BIOS virus or rootkit won’t be removed even by reformatting or replacing the hard drive One defense is to block BIOS flashing on the motherboard
USB Devices USB devices use  flash memory Flash memory is a type of  EEPROM , nonvolatile computer memory that can be electrically erased and rewritten repeatedly USB devices are widely used to spread malware Also, USB devices allow spies or disgruntled employees to copy and steal sensitive corporate data In addition, data stored on USB devices can be lost or fall into the wrong hands
Link Ch 2i
USB PocketKnife As soon as it is plugged into a computer, it steals passwords, files, installs a trojan, etc. We do this as a project in CNIT 124 Links Ch 2j, 2k
USB Devices To reduce the risk introduced by USB devices: Disable the USB in hardware Disable the USB through the operating system Use third-party software
Better Solution: IEEE 1667 Standard Protocol for Authentication in Host Attachments of Transient Storage Devices USB devices can be signed and authenticated, so only authorized devices are allowed Will be implemented in Windows 7 Link Ch 2l
Network Attached Storage (NAS) Single, dedicated hard disk-based file storage device that provides centralized and consolidated disk storage available to LAN users through a standard network connection
Link Ch 2m
Storage Area Network (SAN) Specialized high-speed network for attaching servers to storage devices Larger and more expensive than NAS Link Ch 2n
NAS and SAN Security They can be attacked just like other servers NAS security is implemented through the standard operating system security features The operating system on NAS devices can be either a standard operating system, a proprietary operating system, or a “stripped-down” operating system with many of the standard features omitted
Cell Phone Attacks Lure users to malicious Web sites Cell Phone Viruses (link Ch 2o) Access account information Abuse the cell phone service
Attacks on Virtualized Systems
What Is Virtualization? Virtualization Simulating hardware (or other things) on a computer Operating system virtualization A  virtual machine  is a whole simulated computer running as a program on another computer
A Virtual Machine Host OS: Windows 7 Guest OS: Ubuntu Linux
Virtual Servers Virtual servers are Easier to set up and repair More reliable Cheaper – because many virtual servers can run on a single physical computer Use less energy 100% of the Fortune 100 companies use VMware Link Ch 2p
Attackers Use Virtual Machines A single computer can use both Windows and Linux tools
Security of Virtual Machines Security for virtualized environments can be a concern for two reasons Existing security tools were designed for single physical servers and do not always adapt well to multiple virtual machines Virtual machines not only need to be protected from the outside world, but they also need to be protected from other virtual machines on the same physical computer Virtual Machines can be used as security devices running security software, such as a firewall and intrusion detection system

More Related Content

PPT
Network security and protocols
ODP
Operating Systems
PPTX
Chapter 11 computer security and safety, ethics, and privacy
PPT
5 - System Administration.ppt
PPTX
Secure communication
PPT
Windows Security in Operating System
PPT
Operating system vulnerability and control
PDF
IDS Evasion Techniques
Network security and protocols
Operating Systems
Chapter 11 computer security and safety, ethics, and privacy
5 - System Administration.ppt
Secure communication
Windows Security in Operating System
Operating system vulnerability and control
IDS Evasion Techniques

What's hot (20)

PPT
Hacking web applications
PPT
Chapter 3: Information Security Framework
PPTX
Operating system security
PPT
Ch03 Protecting Systems
PDF
Network security - OSI Security Architecture
PPT
Penetration Testing Basics
PPT
Security models
PPTX
introduction to system administration
PPTX
Introduction to Network and System Administration
PPTX
Network security
PPT
Basics of Information System Security
PPTX
PPT
Intrusion Detection Systems and Intrusion Prevention Systems
PPTX
Operating system security
PDF
Cyber security and demonstration of security tools
PPTX
Malware & Anti-Malware
PPTX
System security
PPT
Database Security
PDF
Network Security Fundamentals
PPT
Virtualization.ppt
Hacking web applications
Chapter 3: Information Security Framework
Operating system security
Ch03 Protecting Systems
Network security - OSI Security Architecture
Penetration Testing Basics
Security models
introduction to system administration
Introduction to Network and System Administration
Network security
Basics of Information System Security
Intrusion Detection Systems and Intrusion Prevention Systems
Operating system security
Cyber security and demonstration of security tools
Malware & Anti-Malware
System security
Database Security
Network Security Fundamentals
Virtualization.ppt
Ad

Viewers also liked (20)

PPT
Network Security Threats and Solutions
PPT
Ch10 Conducting Audits
PPT
Microsoft Operating System Vulnerabilities
PPT
Ch09 Performing Vulnerability Assessments
PPT
Ch04 Network Vulnerabilities and Attacks
PPT
Ch13 Business Continuity Planning and Procedures
PPT
Ch05 Network Defenses
PPT
Ch01 Introduction to Security
PPT
Ch14 Policies and Legislation
PPT
Ch12 Cryptographic Protocols and Public Key Infrastructure
PPT
Ch08 Authentication
PPT
Ch11 Basic Cryptography
PPT
Ch06 Wireless Network Security
PPT
Ch07 Access Control Fundamentals
PPT
Network security
PPTX
system Security
PPTX
Software based attacks
PPTX
Program and System Threats
PPTX
Program Threats
Network Security Threats and Solutions
Ch10 Conducting Audits
Microsoft Operating System Vulnerabilities
Ch09 Performing Vulnerability Assessments
Ch04 Network Vulnerabilities and Attacks
Ch13 Business Continuity Planning and Procedures
Ch05 Network Defenses
Ch01 Introduction to Security
Ch14 Policies and Legislation
Ch12 Cryptographic Protocols and Public Key Infrastructure
Ch08 Authentication
Ch11 Basic Cryptography
Ch06 Wireless Network Security
Ch07 Access Control Fundamentals
Network security
system Security
Software based attacks
Program and System Threats
Program Threats
Ad

Similar to Ch02 System Threats and Risks (20)

PPT
Network Attacks
PPT
Threats to an information system
PDF
CNIT 123: Ch 3: Network and Computer Attacks
PDF
4 threatsandvulnerabilities
PPT
091005 Internet Security
PDF
Week3-CyberSecurity 8th Semester important.pdf
PPTX
PPTX
23 network security threats pkg
PPTX
Computer Security and Ethics
PPTX
SECURITY THREATS.pptx SECURITY THREATS.pptx
PPTX
2nd Class PPT.pptx
DOCX
Chapter 10.0
PPT
Cyber-Security-.ppt
PPTX
Information about malwares and Attacks.pptx
PPT
Desktop pc computer security
PPT
Desktop Pc Computer Security
PPTX
NETWORK SECURITY THREATS - POWERPOINT PRESENTATION
PPTX
Botnets Attacks.pptx
PPT
Software security
PDF
Sophos Threatsaurus: The A-Z of Computer and Data Security Threats
Network Attacks
Threats to an information system
CNIT 123: Ch 3: Network and Computer Attacks
4 threatsandvulnerabilities
091005 Internet Security
Week3-CyberSecurity 8th Semester important.pdf
23 network security threats pkg
Computer Security and Ethics
SECURITY THREATS.pptx SECURITY THREATS.pptx
2nd Class PPT.pptx
Chapter 10.0
Cyber-Security-.ppt
Information about malwares and Attacks.pptx
Desktop pc computer security
Desktop Pc Computer Security
NETWORK SECURITY THREATS - POWERPOINT PRESENTATION
Botnets Attacks.pptx
Software security
Sophos Threatsaurus: The A-Z of Computer and Data Security Threats

More from Information Technology (20)

PDF
Sql Server Security Best Practices
PPT
PPT
SQL 2005 Disk IO Performance
PPT
PPT
Review of SQL
PPT
Sql 2005 high availability
PPT
IIS 7: The Administrator’s Guide
PPT
MOSS 2007 Deployment Fundamentals -Part2
PPT
MOSS 2007 Deployment Fundamentals -Part1
PPT
Clustering and High Availability
PDF
F5 beyond load balancer (nov 2009)
PPT
WSS 3.0 & SharePoint 2007
PPT
SharePoint Topology
PDF
Sharepoint Deployments
PPT
Microsoft Clustering
PDF
Scalable Internet Servers and Load Balancing
PPT
PPT
Migration from ASP to ASP.NET
PPT
Internet Traffic Monitoring and Analysis
Sql Server Security Best Practices
SQL 2005 Disk IO Performance
Review of SQL
Sql 2005 high availability
IIS 7: The Administrator’s Guide
MOSS 2007 Deployment Fundamentals -Part2
MOSS 2007 Deployment Fundamentals -Part1
Clustering and High Availability
F5 beyond load balancer (nov 2009)
WSS 3.0 & SharePoint 2007
SharePoint Topology
Sharepoint Deployments
Microsoft Clustering
Scalable Internet Servers and Load Balancing
Migration from ASP to ASP.NET
Internet Traffic Monitoring and Analysis

Recently uploaded (20)

PDF
RMMM.pdf make it easy to upload and study
PDF
Chinmaya Tiranga quiz Grand Finale.pdf
PDF
Hazard Identification & Risk Assessment .pdf
PDF
Weekly quiz Compilation Jan -July 25.pdf
PDF
LNK 2025 (2).pdf MWEHEHEHEHEHEHEHEHEHEHE
PPTX
History, Philosophy and sociology of education (1).pptx
PPTX
Orientation - ARALprogram of Deped to the Parents.pptx
PPTX
Tissue processing ( HISTOPATHOLOGICAL TECHNIQUE
PPTX
Onco Emergencies - Spinal cord compression Superior vena cava syndrome Febr...
PDF
Black Hat USA 2025 - Micro ICS Summit - ICS/OT Threat Landscape
PDF
advance database management system book.pdf
PDF
OBE - B.A.(HON'S) IN INTERIOR ARCHITECTURE -Ar.MOHIUDDIN.pdf
PDF
احياء السادس العلمي - الفصل الثالث (التكاثر) منهج متميزين/كلية بغداد/موهوبين
PDF
ChatGPT for Dummies - Pam Baker Ccesa007.pdf
PPTX
Digestion and Absorption of Carbohydrates, Proteina and Fats
DOC
Soft-furnishing-By-Architect-A.F.M.Mohiuddin-Akhand.doc
PPTX
UNIT III MENTAL HEALTH NURSING ASSESSMENT
PDF
Paper A Mock Exam 9_ Attempt review.pdf.
PDF
Indian roads congress 037 - 2012 Flexible pavement
PDF
Classroom Observation Tools for Teachers
RMMM.pdf make it easy to upload and study
Chinmaya Tiranga quiz Grand Finale.pdf
Hazard Identification & Risk Assessment .pdf
Weekly quiz Compilation Jan -July 25.pdf
LNK 2025 (2).pdf MWEHEHEHEHEHEHEHEHEHEHE
History, Philosophy and sociology of education (1).pptx
Orientation - ARALprogram of Deped to the Parents.pptx
Tissue processing ( HISTOPATHOLOGICAL TECHNIQUE
Onco Emergencies - Spinal cord compression Superior vena cava syndrome Febr...
Black Hat USA 2025 - Micro ICS Summit - ICS/OT Threat Landscape
advance database management system book.pdf
OBE - B.A.(HON'S) IN INTERIOR ARCHITECTURE -Ar.MOHIUDDIN.pdf
احياء السادس العلمي - الفصل الثالث (التكاثر) منهج متميزين/كلية بغداد/موهوبين
ChatGPT for Dummies - Pam Baker Ccesa007.pdf
Digestion and Absorption of Carbohydrates, Proteina and Fats
Soft-furnishing-By-Architect-A.F.M.Mohiuddin-Akhand.doc
UNIT III MENTAL HEALTH NURSING ASSESSMENT
Paper A Mock Exam 9_ Attempt review.pdf.
Indian roads congress 037 - 2012 Flexible pavement
Classroom Observation Tools for Teachers

Ch02 System Threats and Risks

  • 1. Chapter 2 Systems Threats and Risks Security+ Guide to Network Security Fundamentals, Third Edition
  • 2. Objectives Describe the different types of software-based attacks List types of hardware attacks Define virtualization and explain how attackers are targeting virtual systems
  • 4. Malware (Malicious software ) Software that enters a computer system without the owner’s knowledge or consent The three primary objectives of malware To infect a computer system Conceal the malware’s malicious actions Bring profit from the actions that it performs
  • 5. Viruses Programs that secretly attach to file and execute when that file is opened Once a virus infects a computer, it performs two separate tasks Replicates itself by spreading to other computers Activates its malicious payload Payload examples Encrypt data and charge money to decrypt it Reformat the hard drive Use your computer to send spam Many others
  • 6. Types of computer viruses File infector virus – attached to EXE or COM file Resident virus – lives in RAM Boot virus – Infects the boot sector of a floppy disk Companion virus – second file with similar name users execute by mistake, like cmd.bat Macro virus – lives inside a Microsoft Office document Metamorphic viruses Avoid detection by altering how they appear Polymorphic viruses Also encrypt their content differently each time
  • 7. Worms Program designed to take advantage of a vulnerability in an application or an operating system in order to enter a system Worms are different from viruses in two regards: A worm can travel by itself (over a network) A worm does not require any user action to begin its execution Actions that worms have performed: deleting files on the computer; allowing the computer to be remote-controlled by an attacker
  • 8. Trojans Trojan Horse (or just Trojan ) Program advertised as performing one activity that but actually does something else User is tricked into installing the software
  • 9. Rootkits System files are replaced by counterfeits Hides files and processes from the operating system Intruder gains remote control of the computer VERY hard to detect and remove Usually reformatting the drive and restoring from read-only backup is recommended
  • 10. SONY Rootkit Secretly installed on PCs that played SONY music CDs in 2005 Exposed those machines to remote control by SONY and others This led to a massive product recall, and numerous lawsuits Links Ch 2a, 2b, 2c
  • 11. Logic bomb Program waits for a trigger event such as a date, or the programmer being fired Once triggered, the payload executes, deleting files or causing other damage Logic bombs are extremely difficult to detect before they are triggered
  • 13. Privilege Escalation Gaining rights that the user should not have Types of privilege escalation Gain higher system rights, usually Administrator Gain another user’s rights
  • 14. Spam Unsolicited e-mail Text-based spam messages can easily by trapped by special filters Image spam uses graphical images of text in order to circumvent text-based filters
  • 15.  
  • 16. Evading Spam Filters Techniques GIF layering Word splitting Geometric variance See link Ch 2d
  • 17.  
  • 18. Malware for Profit (continued)
  • 19.  
  • 20. Blocking Spam Image spam cannot be easily filtered based on the content of the message To detect image spam, one approach is to examine the context of the message and create a profile, asking questions such as: Who sent the message? What is known about the sender? Where does the user go if she responds to this e-mail? What is the nature of the message content? How is the message technically constructed?
  • 21. Spyware Software that violates a user’s privacy Antispyware Coalition defines spyware as: Technologies that are deployed without the user’s consent and impair the user’s control over: Use of their system resources, including what programs are installed on their computers Collection, use, and distribution of their personal or other sensitive information Material changes that affect their user experience, privacy, or system security
  • 22. Spyware Spyware creators are motivated by profit Spyware is often more intrusive than viruses, harder to detect, and more difficult to remove Spyware is very widespread Almost every computer has some spyware on it Most common types of spyware Adware Keyloggers
  • 24. Adware Delivers advertising content, often as pop-up windows Can slow or crash a computer Can monitor or track your activities Image from Link Ch 2e (adwarereport.com)
  • 25. Hardware Keylogger A small device inserted between the keyboard connector and computer keyboard port Records each keystroke a user types on the computer’s keyboard Used by a high school student to steal a final exam from a teacher (link Ch 2f)
  • 26. Software Keyloggers Programs that silently capture all keystrokes, including passwords and sensitive information Hide themselves so that they cannot be easily detected even if a user is searching for them
  • 27. Botnets Hundreds or thousandsof zombie computers are under the control of an attacker Zombie An infected computer with a program that will allow the attacker to remotely control it Attackers use Internet Relay Chat (IRC) to remotely control the zombies Attacker is knows as a bot herder
  • 30. BIOS Basic Input/Output System (BIOS) A program embedded on a chip Recognizes and controls different devices on the computer system Executed when the computer system is first turned on On older computer systems the BIOS was a Read Only Memory (ROM) chip Today’s computer systems have a PROM (Programmable Read Only Memory) chip Images from link Ch 2g, Ch 2h
  • 31. BIOS Attacks One virus overwrites the contents of the BIOS and the first part of the hard disk drive, rendering the computer completely dead A BIOS virus or rootkit won’t be removed even by reformatting or replacing the hard drive One defense is to block BIOS flashing on the motherboard
  • 32. USB Devices USB devices use flash memory Flash memory is a type of EEPROM , nonvolatile computer memory that can be electrically erased and rewritten repeatedly USB devices are widely used to spread malware Also, USB devices allow spies or disgruntled employees to copy and steal sensitive corporate data In addition, data stored on USB devices can be lost or fall into the wrong hands
  • 34. USB PocketKnife As soon as it is plugged into a computer, it steals passwords, files, installs a trojan, etc. We do this as a project in CNIT 124 Links Ch 2j, 2k
  • 35. USB Devices To reduce the risk introduced by USB devices: Disable the USB in hardware Disable the USB through the operating system Use third-party software
  • 36. Better Solution: IEEE 1667 Standard Protocol for Authentication in Host Attachments of Transient Storage Devices USB devices can be signed and authenticated, so only authorized devices are allowed Will be implemented in Windows 7 Link Ch 2l
  • 37. Network Attached Storage (NAS) Single, dedicated hard disk-based file storage device that provides centralized and consolidated disk storage available to LAN users through a standard network connection
  • 39. Storage Area Network (SAN) Specialized high-speed network for attaching servers to storage devices Larger and more expensive than NAS Link Ch 2n
  • 40. NAS and SAN Security They can be attacked just like other servers NAS security is implemented through the standard operating system security features The operating system on NAS devices can be either a standard operating system, a proprietary operating system, or a “stripped-down” operating system with many of the standard features omitted
  • 41. Cell Phone Attacks Lure users to malicious Web sites Cell Phone Viruses (link Ch 2o) Access account information Abuse the cell phone service
  • 43. What Is Virtualization? Virtualization Simulating hardware (or other things) on a computer Operating system virtualization A virtual machine is a whole simulated computer running as a program on another computer
  • 44. A Virtual Machine Host OS: Windows 7 Guest OS: Ubuntu Linux
  • 45. Virtual Servers Virtual servers are Easier to set up and repair More reliable Cheaper – because many virtual servers can run on a single physical computer Use less energy 100% of the Fortune 100 companies use VMware Link Ch 2p
  • 46. Attackers Use Virtual Machines A single computer can use both Windows and Linux tools
  • 47. Security of Virtual Machines Security for virtualized environments can be a concern for two reasons Existing security tools were designed for single physical servers and do not always adapt well to multiple virtual machines Virtual machines not only need to be protected from the outside world, but they also need to be protected from other virtual machines on the same physical computer Virtual Machines can be used as security devices running security software, such as a firewall and intrusion detection system