In recent years, many different varieties of attacks have been created in order to perform malicious acts on the computers of unsuspecting users. These attacks are capable of stealing data, corrupting or deleting files, and doing any other activities meant to disrupt a person’s normal computing activities. In order to defend against these attacks, Internet users need to be knowledgeable about any and all possible attacks to their systems. This post will examine some of the threats facing information systems today.
Virus
A computer virus is a program that contains malicious code. Once a virus has infected a computer, it will release its payload, which is the code in the program that actually does the malicious activity. A virus might act by be erasing all .doc or .xls files found on the computer. It could also access the user’s email contacts and send out messages with copies of the virus attached to the message. Payloads vary from virus to virus, some being more destructive than others. Some payloads may just pop up annoying messages on the screen at random times, other payloads may erase all files on the C: drive.
An example of a virus would be a macro virus. A macro virus is one that exploits flaws in certain documents, mainly Microsoft Office documents. By using the macro function is Microsoft Office documents, the macro virus can delete files and corrupt data.
To protect against viruses, anti-virus programs can be used to search out, detect and remove virus programs. Most virus scanners will quickly scan every document or email attachment that a user opens. If the file is found to contain a virus, it is immediately sent to the “quarantine”, where it can not deliver its payload. It is important to keep virus definition files up to date, because virus scanners can only detect the viruses they know about, and new viruses appear everyday. For critical system components, virus definition file updates and scans should be made numerous times each day. For workstations and computers of lesser importance, daily virus scans are acceptable, as long as the anti-virus program is scanning every document that the user opens.
Worms
A worm is a self replicating computer program that attacks the network of a system. Unlike viruses, which need to be attached to another program in order to replicate, worms can continuously replicate on their own. A worm will replicate over and over again until it fills all available resources, such as hard drive space or network bandwidth.
Worms can spread to other computers through email, instant messaging clients, or the internet. The payload of the worm generally only causes the worm to replicate and spread to other machines without altering files on the host machine. This rapid spread to other computers can choke internet bandwidth. Some worms have payloads that install backdoors onto the infected computer before replicating to another machine. This backdoor could be used for many purposes, including a distributed denial of service attack.
An example of a worm is Mydoom. Mydoom was released in January of 2004, and quickly became the fastest spreading worm on the internet. Mydoom infected computers through an email attachment, and used the computers for a distributed denial of service attack against the SCO Group. The worm also sent copies of itself to all contacts in the user’s email address book. Mydoom gained national media attention as it shut down the SCO Group, and a second version of the worm was set to shut down Microsoft’s web servers as well.
Virus and mal-ware scanners can be used to protect systems from computer worms. Like defending computers from viruses, the scanning programs should be updated and used on a regular basis.
Trojan Horses
Trojan Horses are programs which contain hidden malicious code. The programs are usually disguised in small, seemingly helpful programs. When somebody installs the program, the malicious part of the code executes its payload. Some Trojan horse payloads silently monitor the internet behavior of the user, and transmit that data back to their creators. The creators of the Trojan horse then sell that consumer data to spamming or advertising companies. Other Trojan horses install backdoors on the systems they sneak on to, creating a zombie computer, which can be used in a distributed denial of service attack.
To protect users from Trojan horses, anti-virus and mal-ware software can be used to detect and prevent Trojan horses. It would also be wise to explain to employees the threat of Trojan horses, and show them how to spot a Trojan horse in email.
Password Attacks
An organization’s security is only effective when attackers do not have access to the inner layers of the network. Passwords are essential in keeping private data out of the hands of hackers. Two types of password attacks are a brute force attack and a dictionary attack.
A brute force attack attempts to guess passwords by entering every possible combination of keystrokes until the correct password is guessed. A brute force attack could be prevented by enforcing policy that only allows users to enter a wrong password 3 times before being locked out of the system for 20 minutes.
A dictionary attack is similar to the brute force attack, but a dictionary attack will only guess common passwords from the dictionary. Because most people use simple, easy to remember words as their passwords, dictionary attacks can easily break into machines that aren’t properly secured. To prevent against dictionary attacks, companies can force employees to create passwords that contain at least 10 characters, and use at least 3 numbers, for example. These are known as strong passwords.
Denial of Service Attacks
Denial of service attacks (DoS) attempt to crash servers by sending an unmanageable amount of information to the target server. The server cannot handle all the requests, and when the server crashes legitimate users of the server can no longer access it. If a retail web server was targeted, a company would lose money every second their server was down.
A distributed denial of service attack (DDoS) uses zombie computers to launch a large amount of simultaneous requests at a server from many different locations. This attack has the same effect; it crashes the server and denies access to legitimate users of the server. Backdoors can be installed by using Trojan horses or worms.
Denial of service attacks are the most difficult attack to defend against. They are considered to be an Internet Weapon of Mass Destruction. They can be very costly to organizations.
Man-in-the-Middle Attack
A man-in-the-middle attack uses IP spoofing to allow a hacker to sneak past a firewall, where he examines packets traveling along the network. The hacker will intercept certain messages and modify them, without either the sender or receiver knowing about the change. The man-in-the-middle could ask a user for her username and password, thereby gaining access to secure systems on the network. Intrusion detection systems try to detect any packet sniffing happening on the network, and they look for signs that someone is eavesdropping on the network.