Assigment 1

Are We Safe?

Dangers of The Net

Task 1 (A)

In this assignment I will be describing how networks can be attacked, how networks can be protected, the operation of different intruder detection systems and possibly discuss recent network threats.

 Malware

The most common threat for a network will be different malware such as:

Viruses

Computer Viruses are a type of malware that is usually found hidden within software it can be unknowingly installed into a hard drive; when this happens, the affected areas are then said to be "infected". Viruses can be devastating to some users depending on how malicious it is by corrupting or modifying files, however by using an anti-virus you can usually prevent them.

Worms

Worms are another type of malware but it does not need host-like software unlike a virus, the worm replicates itself in order to spread to other computers. Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it. Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupts or modify files on a targeted computer.

Rootkit

A rootkit is a stealthy type of software, typically malicious, designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer; using a rootkit you could view the network as long as you want undetected.

Trojans & Backdoors

The Trojan horse is another type of malware that hides within software, until when opened carries out actions determined by the nature of the Trojan, typically causing loss or theft of data and possible system harm.

The term is derived from the story of the wooden horse used to trick defenders of Troy into taking the concealed Greek warriors into their city.

though when you access a network it is always best that you leave with a way of going back in this way back in is the backdoor which allows you to re-enter a system or network without having to take the hard route of re-hacking(the method you tried at first could be fixed) again.

Spyware

Spyware is software or hardware that aids in gathering information about a person or organization without their knowledge and that may send such information to the gatherer to either sell or blackmail with.

"Spyware" is mostly classified into four types:

·         System Monitors

·         Trojans

·         Adware

·         Tracking Cookies

Spyware is mostly used for the purposes of tracking and storing Internet users' movements with on the Web by Tracking Cookies and serving up an annoying amount of pop-up ads to Internet users using Adware, but there can be ones such as key-loggers which record what is being typed into a keyboard; using this gatherer can see passwords, usernames even emails that are private.

Key-logger

A key-logger is a type of surveillance software (considered to be either software or spyware) that has the capability to record every keystroke you make to a log file, usually encrypted. A key-logger recorder can record instant messages, e-mail, and any information you type at any time using your keyboard. The log file created by the key-logger can then be sent to a specified receiver; using this software the receiver can see what you type into your bank account password basically and it doesn’t have to be software, a key-logger can be a piece of hardware as well.

The Vulnerabilities of an Operating System

Many administrators install Operating Systems on their default settings leaving vulnerabilities that remain unpatched, “Vulnerabilities?” I hear you ask; when large companies such as windows and mac keep pumping out new and ‘better’ operating systems, their programmers are concentrating more on the fact that it works instead of security when the deadline is close, because of this crackers can write malware that uses these security faults to enter a network.

How an Off-The-Shelf can be Vulnerability

Off-the-shelf Applications are in the same area as operating systems for the security holes, but using customised software has its benefits of having hardly any viruses directed to it because not a lot of people use it. Spending a few months creating a virus for software where you can access for example 2,500 networks, when you could make a virus for 10,000 just isn’t worth it; that being the case you have to be careful with customised software because they might have a little unwanted present hidden inside such as Spyware or other malicious malware.

Shrink-wrap (Rapper)

Using the vulnerabilities of an application or operating system the coder inputs a malware into the software and puts it into the internet usually on a pirated site(what? you believed they would give it to you risk free?) and then when the software is downloaded so is the malware.

Dictionary and Brute Force Attacks

A Dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary. Unlike the Dictionary attack the brute force attack as the name suggest isn’t as refined because it uses all possible keys to figure out every possible combination for a password for example; AAAA, ABAA, ACAA, ADAA, AEAA and this is repeated until the password is found which may take a varied amount of time depending on how strong the password is.

Phising

Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes indirectly money) by somebody pretending to be something of a trustworthy entity such as an IT Administrator or the Bank itself. They would send you e-mail with a message of urgency but when you open the message malware has infiltrated into your computer these would most likely be a spyware but worst case it would be a Trojan or virus.

Social Engineering

Social Engineering is a way of accessing a secure area such as a server room by the use of Acting and interpersonal skills, from casually talking to the guard into opening the door to faking an appointment; all of this is used in order to gain access so that you can plant spyware right into the server. Though there are easier and simpler ways of social engineering, for example there is shoulder surfing; when you look over someone’s shoulder as they type in a password and memorise it or even dumpster diving which is when you search for poorly discarded company papers containing financial details for example.

Task 1 (B)

Recent Network Threats

Cross Site Scripting (XSS)

Cross-site scripting (XSS) is a security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users; its effect may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site.

 An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script because it thinks the script came from a trusted source; the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.

SQL Injection Attack

SQL injection is a technique where malicious users can inject SQL commands into an SQL statement, through web page input; Injected SQL commands can alter SQL statement and compromise the security of a web application.

Since SQL statements are text only, it is easy, with a little piece of computer code, to dynamically change SQL statements to provide information from a database from which would normally not be available or SQL Injection can be used to gain access to an organization's host computers.

DDoS & DoS

Denial of Service attack is an attempt to make a machine or network resource unavailable, although the means to carry out, the motives for, and targets of a DoS attack vary; it generally consists of efforts to temporarily or indefinitely bring down a network. DoS attacks may be initiated from a single machine, but they typically use many computers to carry out an attack. Since most servers have firewalls and other security software installed, it is easy to find out which individuals are sending the attack and lock out the individual systems. Therefore, Distributed Denial of Service (DDoS) attacks are often used to coordinate multiple systems with varied/fake IP addresses in a simultaneous attack; this is known as an IP Spoofing DDoS Attack.

A DDoS attack tells all coordinated systems to send a stream of requests to a specific server at the same time. These requests may be a simple ‘ping’ or a more complex series of packets. If the server cannot respond to the large number of simultaneous requests, the incoming requests will eventually result in a slow response time or a no response at all. When the server is unable to respond to legitimate requests or breaks down, the denial of service attack has succeeded.

Google Hacking

Google hacking is the use of a search engine, such as Google, to locate a security vulnerability on the Internet. There are generally two types of vulnerabilities to be found on the Web: software vulnerabilities and misconfigurations. Although there are some sophisticated intruders who target a specific system and try to discover vulnerabilities that will allow them access, the vast majority of intruders start out with a specific software vulnerability or common user misconfiguration that they already know how to exploit, and simply try to find or scan for systems that have this vulnerability. Google is of limited use to the first attacker, but invaluable to the second.

Task 1 (C)

Real Recent Breaches

eBay

There have been complaints that eBay customers have been exposed to malware over a few months, little did they know was that  eBay had been hit by a cross-site scripting attack, more than 100 of the listings of the website resulted in users being redirected to a spoof site designed to steal their credentials.

The spoof site had been set up to look like the online marketplace's welcome page; duping visitors into thinking they were browsing the genuine eBay website.

Visitors carried on viewing through the spoof website whilst being redirected through a series of other websites until they arrived on a page asking for their eBay log-in and password, this resulted in up to 233 million people having their personal details stolen including telephone numbers, names, postal and email addresses, dates of birth and passwords; It was only when Paul Kerr, an IT worker from Alloa in Clackmannanshire realised he had been redirected when browsing for an IPhone.

eBay apologised to all of its customers and recommended them to changing their passwords as the attacker is still unknown.

Variable Annuity Life Insurance Co.

A former financial adviser at the company was found in possession of a USB drive that contained details on 774,723 of the company’s customers. The drive was provided to the company by law enforcement as the result of a search warrant served on the former adviser. The USB drive included full or partial Social Security numbers, but the insurance company said it didn’t believe any of the data had been used to access customer accounts. It’s not the first time the company has lost data on a USB drive. In 2006, it wrapped up a lawsuit against a former financial adviser for downloading “confidential customer information” onto “a portable flash drive.”

Task 2 (A)

 Procedures Needed to Guard Against Breaches

S/Mime

Secure/Multipurpose Internet Mail Extension is a method of encryption which encrypts your emails so that only readers who have the decryption key can read them, this keeps unwanted eyes from reading your mail for malicious purposes; this can be best used for company emails however, S/Mime is not only limited to Email you can also use it for any transport mechanism that transport any Mime data such as HTTP.

Spam Guard

Spam guards are used to keep spam emails away from your inbox but there is more than one type of spam guard; there is a spam guard which quarantine unknown sender emails into a grey area until the user approves or disapproves them as to whether or not they are safe after they have been checked. The other is an outbound protection used to stop any to be sent outwards from the network, this is more suited for a business network;

Lastly there is the Honeypot, you make fake emails and then post them on the internet somewhere so spammers can find them, and when a spammer starts spamming that email you then take all the addresses that get send to that email and block them from coming onto your network.

Hoaxing

Hoaxing is a phishing method where you fake the IP and MAC address so it looks like it’s coming from a different computer compare to what it actually is. You can check whether the email is a fake or not by checking the header of the email that will tell you whether it came from the correct source or not. Within a business this type of fraud catches a lot of people off guard, so the training of the staff will be required to stop them failing to recognise whether or not it is real.

Wireless Network Security

You’ll be surprised just how many people leave their Wireless Access Point in default settings; simply just not changing the name can be quite risky as somebody can easily find out your password and then change it themselves because internet providers such as virgin, Sky or BT use a certain pattern for the default password. Do yourself a favour and change your WAP, WEP and WPA name into something that doesn’t give the make of it such as ‘Home Sweet Home’.

Use of Transmission Media

Lately, debate has arisen on the advantages and disadvantages of shielded twisted-pair (STP) cables and unshielded twisted-pair (UTP) cables. Though STP cables have additional shielding material that is used to reduce external interference, the drawback of STP cables is that they will increase the total cost of an installation. STP cables are more expensive due to the shielding, which is an additional material that goes into every meter of the cable. The shielding also makes the cable heavier and stiffer. Thus, it is more difficult to handle.

Personal Access Control

For the strongest of Security for an area such as a server room there can be three stages of clearance to enter and these are:

·         Password (Something that you know)

·         Permission (Something that you can hold)

·         Biometrics (Something that you are)

Password is the obvious one but the more complex the better, have both letters (A, B, C) and numbers (1, 2, 3); you should also throw in a couple of symbols for extra protection (#, %,!) but no matter how complex it can be, any password can be stolen or Brute Force can be used to crack it.

As there is always the chance of that happening it’s best to have another stage of security known as permission which can be a security card, though this can also be stolen, therefor you use a third level of security known as a Biometric which is usually a fingerprint or a retina scan because I doubt somebody would go as far as ‘stealing’ them.

Intrusion Prevention System

This can either be a piece of hardware or software, this will search through the network and detect any malicious content and then instantly block it from the network rendering it unable to harm.

Task 2 (B)

Types of IDS, Firewalls and Honeypots

Reactive & Passive IDS

Within passive IDS its main goal is to detect the intrusion and just logs it and alerts the network admin. So with this type of IDS you will need another system to prevent the intrusion from dealing any damage to the network as the passive is not used for that instead the Reactive is like the passive IDS but it actually acts upon what has been detected to prevent that from doing any damage to the network. After it has logged the intrusion it will then prevent it by changing the firewall to block this type of intrusion and also stop the source of the problem by logging them out of the network.

Network & Host IDS

The Network IDS works by having a central database in the Network. Whenever you attempt to install something that is malicious or if you access a website you shouldn’t be accessing, the database is notified. This is done for every computer connected to the network by analysing the data packets flowing through the network and the database processes this data and generates a report containing this information.

The Network IDS is quite expensive so not many companies would use it instead they would use the Host IDS which detects any intrusions on the client is installed on only and will only report information to that machine; if there is a fault the entire network will be notified, although it is cheaper than the Network IDS it is not as effective.

Knowledge Based & Behavioural Based IDS

A Knowledge Based IDS collects information about various hacking attempts that have recently taken place in the world. There are multiple world servers that contain this information and this makes it a reliable source to collect information from. Whenever someone is hacked, they will upload this information to one of the servers detailing how it took place; the IDS will then ‘learn’ it so it can then block out any other intrusion of the same method.

Advantages of this could include not having to worry about common vulnerabilities in a network due to the IDS having the knowledge to counteract this and if there is an alarm it would be very detailed, this allows the security officer to make preventive or corrective action. However if the knowledge based IDS is difficult to keep updated on new attack methods therefor if the IDS goes against a new type of attack method the IDS will not be able to block it.

Behavioural Based IDS focuses on looking for particular patterns or styles which are associated with hacking such as a ‘user’ inputting their password wrong an unusual amount of times The system will assume that someone is trying to brute force the password of a user and react accordingly.

The advantages of this are the Behavioural IDS can detect attempts of exploiting new and unforeseen vulnerabilities; Documenting these new exploits can then help others with their Knowledge based IDS. The disadvantage is the Behavioural Based IDS will give lots of false alarms by confusing an activity with hacking or as the IDS is learning new behavioural patterns as your information system is under attack.

Packet Filled Firewall

This type of firewall controls the data that flows through the network; the firewall uses a set of rules, to scan every packet that runs through the system to check whether that packet is allowed through the system or not.

It is a low cost type of fire wall so it will not cost the business much money to use. The impact on the network performance is low as well so it will not slow down the network but it cannot prevent attacks that exploit the weaknesses of application software to get into the network.

Stateful Inspection Firewall

This type of firewall will log all data that comes through it, and identify where it came from and specifically where it was sent to. If data travels along this path frequently, it will assume it is ok and allow data to flow between them. However, data packets will still be inspected and will not let anything suspicious through. The major disadvantage is if the hackers knows which Devices are trusted they can spoof using the trusted devices IP address to enter the network

Proxy Firewall

Proxy Firewalls work by being between the source and destination of the packet; when an untrusted packet comes through it goes to the proxy firewall first to be checked for any suspicious content, if the packet contains malicious data it will not be sent to the network.

Due to the close inspection of the packet and being in-between the source and the network, the speed of the network becomes quite slow.

Honey Pot

A honeypot is a computer that is to lure attackers. This is done by making the computer relatively easy to hack, by opening commonly exploited ports and services. When hackers attempt to hack the organisations network, they are instead directed into hacking into the honeypot. Tools and techniques that are used to hack the honeypot are then logged and used to increase the security of the actual servers.