ESET SMART SECURITY User's Guide download pdf (Page 115)

115

6.2.1 DoS attacks

DoS, or Denial of Service, is an attempt to make a computer or network unavailable for its intended users. The

communication between afflicted users is obstructed and can no longer continue in a functional way. Computers

exposed to DoS attacks usually need to be restarted in order to work properly.

In most cases, the targets are web servers and the aim is to make them unavailable to users for a certain period of

time.

6.2.2 DNS Poisoning

Using DNS (Domain Name Server) poisoning, hackers can trick the DNS server of any computer into believing that

the fake data they supplied is legitimate and authentic. The fake information is cached for a certain period of time,

allowing attackers to rewrite DNS replies of IP addresses. As a result, users trying to access Internet websites will

download computer viruses or worms instead of their original content.

6.2.3 Worm attacks

A computer worm is a program containing malicious code that attacks host computers and spreads via a network.

Network worms exploit security vulnerabilities in various applications. Due to the availability of the Internet, they

can spread all over the world within a few hours of their release.

Most worm attacks (Sasser, SqlSlammer) can be avoided by using default security settings in the firewall, or by

blocking unprotected and unused ports. Also, it is essential that your operating system is updated with the most

recent security patches.

6.2.4 Port scanning

Port scanning is used to determine which computer ports are open on a network host. A port scanner is software

designed to find such ports.

A computer port is a virtual point which handles incoming and outgoing data – this is crucial from a security point of

view. In a large network, the information gathered by port scanners may help to identify potential vulnerabilities.

Such use is legitimate.

Still, port scanning is often used by hackers attempting to compromise security. Their first step is to send packets to

each port. Depending on the response type, it is possible to determine which ports are in use. The scanning itself

causes no damage, but be aware that this activity can reveal potential vulnerabilities and allow attackers to take

control of remote computers.

Network administrators are advised to block all unused ports and protect those that are in use from unauthorized

access.

6.2.5 TCP desynchronization

TCP desynchronization is a technique used in TCP Hijacking attacks. It is triggered by a process in which the

sequential number in incoming packets differs from the expected sequential number. Packets with an unexpected

sequential number are dismissed (or saved in the buffer storage, if they are present in the current communication

window).

In desynchronization, both communication endpoints dismiss received packets, at which point remote attackers are

able to infiltrate and supply packets with a correct sequential number. The attackers can even manipulate or modify

communication.

TCP Hijacking attacks aim to interrupt server-client, or peer-to-peer communications. Many attacks can be avoided

by using authentication for each TCP segment. It is also advised to use the recommended configurations for your

network devices.

1 2 ... 110 111 112 113 114 115 116 117 118 119 120

No comments

ESET SMART SECURITY User's Guide Page 115