Internet Threads To An Organisation
By: Kristina Volk
Tags: Security, Network Security, Malware Analysis, Network Attacks, Hacking

Modern society can no longer do without information technology. Information technology has penetrated into all areas of human life. Their integral part is the global Internet. Of course, one of the main tasks is to ensure the security of information circulation within the network. One of the security risks is hacker attacks. Many people have already become victims of intruders. So, there are two obvious questions: “What types of hacker attacks are there? How to resist them?

Hacking methodology

“Network attacks” — today this phrase is familiar to any computer user. Meanwhile, the general and vague designation “network attacks” hides quite specific actions of hackers, whose ignorance by the user, greatly simplifies the task of hackers. Speaking about threats in the information domain, there is a brief description of the types of network attacks.

Network Attacks

Network attack — an action, proceed by an intruder with a purpose of threat realization. The action is aiming for a search for any faults in a computer.

Network attacks are as diverse as the systems against which they are directed. Some attacks are very complex. Others can be carried out by an ordinary operator, even without presupposing what consequences his activity may have. To evaluate the types of attacks, you need to know some of the limitations inherent in the TPC / IP protocol.

Firstly, there are main network attack types:

Access

Modification

Denial of Service

Password

Viruses and Trojan Horse

Secondly, there are many techniques for attack execution. One of them is social engineering where an intruder obtains data via ordinal mobile phone call or gets inside into an organisation as its service worker. These attacks are the most dangerous.

Attacks intended for gaining access to information have one specific feature: the information is not being stolen, it is only being copied. Thus, it is very difficult to detect the time when it occurred.

Attacks of access

This is a type of attacks with the purpose of getting information without any permission to review it. To obtain unauthorized action the intruder needs to be close to the data. Electronic devices are commonly used here. Implementation of wireless networks has increased the chances of successful listening. Therefore, an attacker no longer needs to connect physically to a network.

Attacks of modification

A modification attack is a way to mutate information without authorization which is possible to occur where the information is sent. One of them is replacing the existing data. Another one is adding new data to the existing (e. g. Banking transferring). Changing the database or transaction list files without any evidence is very difficult. And hackers make use of “masquerade” and “event denial” to complete a modification.

DoS attacks

Denial-of-service (DoS) attacks are malicious actions that are taken to prevent a legitimate user from accessing a system, network, application, or information. DoS attacks have many forms, they are centralized (running from one system) or distributed (running from several systems).

DoS attacks cannot be completely prevented, nor can they be stopped if the source of the attack cannot be identified. A pair of pliers is a simple tool for DoS-attacks. What is required is merely to take them and cut the LAN cable.

Notably, another important point in the preparation of most attacks. Until the attacker fails to penetrate the target system, DoS attacks are launched from fake addresses. The IP protocol has an error in the addressing scheme: it does not check the sender address when creating a packet. Thus, the hacker gets the opportunity to change the address of the sender of the package to hide its location. Most DoS attacks do not need to return traffic to the hacker’s home system to achieve the desired result.

Password attacks

Hackers can conduct password attacks using simple brute force attack, Trojan horse, IP spoofing and packet sniffing. Although the username and password can often be obtained using IP spoofing and packet sniffing, hackers often try to find the password and username using multiple access attempts. The name of this approach is a simple brute force attack. Often, a special program is used for such an attack, which attempts to gain access to a common resource. If, as a result, the hacker gains access to the resources, he gets it as a regular user, whose password was chosen. If this user has significant access privileges, a hacker can create a “pass” for himself for future access, which will be valid even if the user changes his password and login.

Another problem arises when individuals use the same (albeit complicated) password to access many systems: corporate, personal, and Internet systems. Since password strength is equal to that of the weakest host, a hacker who has learned the password through this host has access to all other systems that use the same password.

Viruses and Trojan Horse

End-user workstations are highly vulnerable to viruses and Trojan horses. Viruses are malware that infiltrates other programs to perform a specific undesirable function on an end-user workstation. An example is a virus that is written in the file command prompt and erases other files, and also infects all other versions of cmd found by it. The Trojan Horse is not a software insert, but a real program that looks like a useful application, but actually plays a harmful role. An example of a typical Trojan horse is a program that looks like an elementary game for a user’s workstation. However, while the user is playing the game, the program sends its copy by email to each subscriber listed in this user’s address book. All subscribers receive in the mail the game, causing its further distribution.

3 Real world examples of network attacks

(Access attack)

On May 22, cybercriminals gained unauthorized access to the US Department of Justice website. According to the representative of the ministry, hackers got access to the server, where they collected data on all crimes committed in the United States, including in the computer sphere.

The case of a hacker named Datastream Cowboy. Together with the Kuji hacker, he hacked the Griffis Air Force Base Aircraft Development Center system in Rome and New York and stole software worth over two hundred thousand dollars. Hacker Datastream Cowboy was a 16-year-old teenager from the UK — he was arrested and convicted in 1997. He was sentenced to pay a fine in the amount of 1915 dollars.

(DDoS attack)

Some called it the first cyberwar. In April 2007, online services and websites of the government, financial and medical institutions were established in Estonia. A giant DDoS attack happened at the same time as the political protests organized by the Russian nationalists. Citizens of the country paid banks online and even voted online. Therefore, this attack in the literal sense of the word paralyzed the whole country.

(Password attack)

Morris worm. In 1988, a student at Cornell University, Robert Morris, developed a program that was distributed via the Internet. This program used several vulnerabilities to gain access to computer systems and play itself. One of the vulnerabilities were weak passwords. The program, along with a list of the most common passwords, used the following passwords: a blank password, an account name, an account name added to itself, a username, a user’s last name, and a reserved account name. This worm caused damage to a sufficiently large number of systems and very effectively disabled the Internet.

Ways and techniques on how to decrease the number of internet threats

Means to cope with network attacks.

The threat of DoS attacks can be reduced in three ways:

Anti-spoofing features — properly configuring anti-spoofing features on your routers and firewalls will help reduce the risk of DoS. These functions, at a minimum, should include RFC 2827 filtering. If a hacker cannot disguise his real identity, he is unlikely to decide to attack. Anti-DoS features — a proper configuration of anti-DoS features on routers and firewalls can limit the effectiveness of attacks. These functions often limit the number of half-open channels at any given time. Traffic rate-limiting — an organization may ask an ISP to limit the amount of traffic. This type of filtering allows you to limit the amount of non-critical traffic passing through your network. A common example is limiting the amount of ICMP traffic, which is used only for diagnostic purposes. Attacks DDoS often use ICMP.

When it comes password attacks the major thing is necessary to do is:

Do not use passwords in text form. One-time passwords and/or cryptographic authentication can virtually nullify the threat of such attacks. Unfortunately, not all applications, hosts and devices support the above authentication methods.

When using regular passwords, try to come up with a password that would be hard to find. The minimum password length must be at least eight characters. The password must include uppercase characters, numbers, and special characters (#,%, $, etc.). The best passwords are difficult to select and difficult to remember, which forces users to write passwords on paper. To avoid this, users and administrators can benefit from a number of recent technological advances. For example, there are application programs that encrypt a list of passwords that can be stored in a pocket computer. As a result, the user needs to remember only one complex password, while all other passwords will be reliably protected by the application. From the point of view of the administrator, there are several methods of dealing with the selection of passwords. One of them is to use the L0phtCrack tool, which hackers often use to find passwords in the Windows NT environment. This tool will quickly show you whether it is easy to find the password chosen by the user.

Actually, the fight against viruses and Trojan horses is carried out with the help of effective antivirus software running at the user level and, possibly, at the network level. Anti-virus tools detect most viruses and Trojan horses and prevent their spread. Getting the latest information about viruses will help to more effectively deal with them. As new viruses and Trojan horses appear, an enterprise should install new versions of anti-virus tools and applications.

What is a “security policy”?

“A security policy is a formal statement of the rules that must be followed by individuals who gain access to corporate technology and information.”

Network security refers to actions that protect the health and integrity of the network and data. This includes hardware and software technologies. The effectiveness of network security is expressed in controlling access to network resources. This set of measures is focused on a variety of threats and helps prevent their penetration and distribution in the network.

What is network security based on?

To ensure network security, protection is provided both around the perimeter and within the network. Each level of network security implements certain policies and controls. Authorized users gain access to network resources, and malicious objects are blocked and deprived of the opportunity to use exploits and threats.

CONCLUSION

The Internet completely changes the way we work, live, entertain and learn. These changes will occur in areas already known to us (e-commerce, access to real-time information, expansion of communication capabilities, etc.), as well as in areas that we are not aware of yet. There may even come a day when a corporation can make all its phone calls over the Internet and is completely free.

However, together with the tremendous growth in the popularity of this technology, there is an unprecedented threat of disclosure of personal data, critical corporate resources, state secrets, etc. Every day, hackers threaten these resources by trying to access them with special attacks.

Thus, the main hacker attacks and ways to combat them were considered. This area is most growing, as there is a constant rivalry between attackers and organizations that provide data security. Despite the possible use of comprehensive measures to protect your computer, the most reliable way to protect your computer is to use proven electronic resources, reading letters from trusted sources. Those, the greatest protection against attacks can be provided by the user himself while taking precautions.

What’s more? The spread of digital technology has changed our world. Our lifestyle, work, entertainment and learning — everything has changed. Every company that seeks to provide clients and employees with the services they need is obliged to ensure the protection of their network infrastructure. Network protection also helps to protect information that constitutes a trade secret from attacks. And most importantly, it protects the reputation of your company.