Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
SlideShare a Scribd company logo

Ethical Hacking - Introduction to Computer Security

•Download as PPT, PDF•
•
V
Vibrant Event

This presentation is about the following point, 1. Packet sniffing techniques 2. how to defend against sniffing

1 of 24
Ethical Hacking - Introduction to Computer Security
Introduction To Computer SecurityIntroduction To Computer Security • By :- Vibrant Technologies & Computers
• In 1983, Kevin Mitnick did an intrusion on a Pentagon’s computer • Robert Tappan Morris created the first worm and sent it from MIT to the web and caused $50,000 of damages • In 1994, Vladimir Levin intruded in an American bank computer and stole 10 millions dollars • Jonathan James “c0mrade”, 16 years old, infiltrated a NASA computer in 1999 and had access to data worth 1,7 millions dollars • Today (CSI Report, 2007): o 46% of companies have admitted to suffering financial losses due to security incidences. The reported loss amounted to a total of approximately $66,930,000. o 39% of companies have been unable (or unwilling) to estimate the cost of their losses. • Financial Losses, Personal losses, Privacy losses, Data Losses, Computer Malfunction and more….. Computer Security
Computer SecurityComputer Security • Computer and Network security was not at all well known, even about 12 years ago • Today, it is something everyone is aware of the need, but not sure what is really means • Interesting topic of threats, countermeasures, risks, stories, events and paranoia o With some mathematics, algorithms, designs and software issues mixed in o Yet, not enough people, even security specialists understand the issues and implications
Media StoriesMedia Stories • Consumers are bombarded with media reports narrating dangers of the online world o Identity Theft o Embezzlement and fraud o Credit card theft o Corporate Loss • Just “fear mongering”?
Security? What is that?Security? What is that? • Lock the doors and windows and you are secure o NOT • Call the police when you feel insecure o Really? • Computers are powerful, programmable machines o Whoever programs them controls them (and not you) • Networks are ubiquitous o Carries genuine as well as malicious traffic • End result: Complete computer security is unattainable, it is a cat and mouse game o Similar to crime vs. law enforcement
Goals of Computer SecurityGoals of Computer Security • Integrity: o Guarantee that the data is what we expect • Confidentiality o The information must just be accessible to the authorized people • Reliability o Computers should work without having unexpected problems • Authentication o Guarantee that only authorized persons can access to the resources
Security BasicsSecurity Basics • What does it mean to be secure? o “Include protection of information from theft or corruption, or the preservation of availability, as defined in the security policy.” - The Wikipedia • Types of Security o Network Security o System and software security o Physical Security • Very little in computing is inherently secure, you must protect yourself! o Software cannot protect software (maybe hardware can) o Networks can be protected better than software
Some Types of AttacksSome Types of Attacks • What are some common attacks? o Network Attacks • Packet sniffing, man-in-the-middle, DNS hacking o Web attacks • Phishing, SQL Injection, Cross Site Scripting o OS, applications and software attacks • Virus, Trojan, Worms, Rootkits, Buffer Overflow o Social Engineering • (NOT social networking) • Not all hackers are evil wrongdoers trying to steal your info o Ethical Hackers, Consultants, Penetration testers, Researchers Need to know: Networking, Web Programming, Operating Systems, Programming languages and compilers.
Network AttacksNetwork Attacks • Packet Sniffing o Internet traffic consists of data “packets”, and these can be “sniffed” o Leads to other attacks such as password sniffing, cookie stealing session hijacking, information stealing • Man in the Middle o Insert a router in the path between client and server, and change the packets as they pass through • DNS hijacking o Insert malicious routes into DNS tables to send traffic for genuine sites to malicious sites Need to know: Networking protocols, routing, TCP-IP
Web AttacksWeb Attacks • Phishing o An evil website pretends to be a trusted website o Example: • You type, by mistake, “mibank.com” instead of “mybank.com” • mibank.com designs the site to look like mybank.com so the user types in their info as usual • BAD! Now an evil person has your info! • SQL Injection o Interesting Video showing an example • Cross Site Scripting o Writing a complex Javascript program that steals data left by other sites that you have visited in same browsing session Need to know: Web Programming, Javascript, SQL
VirusVirus • Definition o Piece of code that automatically reproduces itself. It’s attached to other programs or files, but requires user intervention to propagate. • Infection (targets/carriers) o Executable files o Boot sectors o Documents (macros), scripts (web pages), etc. • Propagation is made by the user. The mechanisms are storage elements, mails, downloaded files or shared folders Infection Propagation Payload
WormWorm • Definition o Piece of code that automatically reproduces itself over the network. It doesn’t need the user intervention to propagate (autonomous). • Infection o Via buffer overflow, file sharing, configuration errors and other vulnerabilities. • Target selection algorithm o Email addresses, DNS, IP, network neighborhood • Payload o Malicious programs o Backdoor, DDoS agent, etc. infection Propagation engine Payload Target Selection algorithm Scanning engine
Backdoor, trojan, rootkitsBackdoor, trojan, rootkits • Goal o The goal of backdoor, Trojan and rootkits is to take possession of a machine subsequently through an infection made via a backdoor. • Backdoor o A backdoor is a program placed by a black-hacker that allows him to access a system. A backdoor have many functionalities such as keyboard-sniffer, display spying, etc. • Trojan o A Trojan is a software that seems useful or benign, but is actually hiding a malicious functionality. • Rootkits (the ultimate virus) o Rootkits operate like backdoor and Trojan, but also modify existing programs in the operating system. That allows a black-hacker to control the system without being detected. A rootkit can be in user-mode or in kernel-mode.
Social EngineeringSocial Engineering
Social EngineeringSocial Engineering • Why is this social engineering? o Manipulating a person or persons into divulging confidential information • I am not dumb, so does this really apply to me? o YES! Attackers are ALSO not dumb. o Social Engineers are coming up with much better and much more elaborate schemes to attack users. o Even corporate executives can be tricked into revealing VERY secret info • What can I do to protect myself? o NEVER give out your password to ANYBODY. o Any system administrator should have the ability to change your password without having to know an old password Need to know: How to win friends (victims) and influence (scam) people (not CS).
Password AttacksPassword Attacks • Password Guessing o Ineffective except in targeted cases • Dictionary Attacks o Password are stored in computers as hashes, and these hashes can sometimes get exposed o Check all known words with the stored hashes • Rainbow Tables o Trade off storage and computation – uses a large number of pre- computed hashes without having a dictionary o Innovative algorithm, that can find passwords fast! • e.g. 14 character alphanumeric passwords are found in about 4- 10 minutes of computing using a 1GB rainbow table
Computer Security IssuesComputer Security Issues • Vulnerability is a point where a system is susceptible to attack. • A threat is a possible danger to the system. The danger might be a person (a system cracker or a spy), a thing (a faulty piece of equipment), or an event (a fire or a flood) that might exploit a vulnerability of the system. • Countermeasures are techniques for protecting your system
Vulnerabilities in SystemsVulnerabilities in Systems • How do viruses, rootkits enter a system? o Even without the user doing something “stupid” • There are vulnerabilities in most software systems. o Buffer Overflow is the most dangerous and common one • How does it work? o All programs run from memory. o Some programs allow access to reserved memory locations when given incorrect input. o Hackers find out where to place incorrect input and take control. o Easy to abuse by hackers, allows a hacker complete access to all resources
How can you achieve security?How can you achieve security? • Many techniques exist for ensuring computer and network security o Cryptography o Secure networks o Antivirus software o Firewalls • In addition, users have to practice “safe computing” o Not downloading from unsafe websites o Not opening attachments o Not trusting what you see on websites o Avoiding Scams
CryptographyCryptography • Simply – secret codes • Encryption o Converting data to unreadable codes to prevent anyone form accessing this information o Need a “key” to find the original data – keys take a few million- trillion years to guess • Public keys o An ingenious system of proving you know your password without disclosing your password. Also used for digital signatures o Used heavily in SSL connections • Hashing o Creating fingerprints of documents
Cryptographic ProtocolsCryptographic Protocols Symmetric encryption Authentication Asymmetric encryption Public Key Infrastructure
Why Care?Why Care? • Online banking, trading, purchasing may be insecure o Credit card and identity theft • Personal files could be corrupted o All school work, music, videos, etc. may be lost • Computer may become too slow to run o If you aren't part of the solution you are part of the problem • Pwn2Own contest - 2008 o Mac (Leopard) fell first via Safari, Vista took time but was hacked via Flash Player, Ubuntu stood ground. • Upon discovery, vulnerabilities can be used against many computers connected to the internet.
ThankThank You !!!You !!! For More Information click below link: Follow Us on: http://vibranttechnologies.co.in/ethical-hacking-classes-in- mumbai.html

More Related Content

Ethical Hacking - Introduction to Computer Security

  • 2. Introduction To Computer SecurityIntroduction To Computer Security • By :- Vibrant Technologies & Computers
  • 3. • In 1983, Kevin Mitnick did an intrusion on a Pentagon’s computer • Robert Tappan Morris created the first worm and sent it from MIT to the web and caused $50,000 of damages • In 1994, Vladimir Levin intruded in an American bank computer and stole 10 millions dollars • Jonathan James “c0mrade”, 16 years old, infiltrated a NASA computer in 1999 and had access to data worth 1,7 millions dollars • Today (CSI Report, 2007): o 46% of companies have admitted to suffering financial losses due to security incidences. The reported loss amounted to a total of approximately $66,930,000. o 39% of companies have been unable (or unwilling) to estimate the cost of their losses. • Financial Losses, Personal losses, Privacy losses, Data Losses, Computer Malfunction and more….. Computer Security
  • 4. Computer SecurityComputer Security • Computer and Network security was not at all well known, even about 12 years ago • Today, it is something everyone is aware of the need, but not sure what is really means • Interesting topic of threats, countermeasures, risks, stories, events and paranoia o With some mathematics, algorithms, designs and software issues mixed in o Yet, not enough people, even security specialists understand the issues and implications
  • 5. Media StoriesMedia Stories • Consumers are bombarded with media reports narrating dangers of the online world o Identity Theft o Embezzlement and fraud o Credit card theft o Corporate Loss • Just “fear mongering”?
  • 6. Security? What is that?Security? What is that? • Lock the doors and windows and you are secure o NOT • Call the police when you feel insecure o Really? • Computers are powerful, programmable machines o Whoever programs them controls them (and not you) • Networks are ubiquitous o Carries genuine as well as malicious traffic • End result: Complete computer security is unattainable, it is a cat and mouse game o Similar to crime vs. law enforcement
  • 7. Goals of Computer SecurityGoals of Computer Security • Integrity: o Guarantee that the data is what we expect • Confidentiality o The information must just be accessible to the authorized people • Reliability o Computers should work without having unexpected problems • Authentication o Guarantee that only authorized persons can access to the resources
  • 8. Security BasicsSecurity Basics • What does it mean to be secure? o “Include protection of information from theft or corruption, or the preservation of availability, as defined in the security policy.” - The Wikipedia • Types of Security o Network Security o System and software security o Physical Security • Very little in computing is inherently secure, you must protect yourself! o Software cannot protect software (maybe hardware can) o Networks can be protected better than software
  • 9. Some Types of AttacksSome Types of Attacks • What are some common attacks? o Network Attacks • Packet sniffing, man-in-the-middle, DNS hacking o Web attacks • Phishing, SQL Injection, Cross Site Scripting o OS, applications and software attacks • Virus, Trojan, Worms, Rootkits, Buffer Overflow o Social Engineering • (NOT social networking) • Not all hackers are evil wrongdoers trying to steal your info o Ethical Hackers, Consultants, Penetration testers, Researchers Need to know: Networking, Web Programming, Operating Systems, Programming languages and compilers.
  • 10. Network AttacksNetwork Attacks • Packet Sniffing o Internet traffic consists of data “packets”, and these can be “sniffed” o Leads to other attacks such as password sniffing, cookie stealing session hijacking, information stealing • Man in the Middle o Insert a router in the path between client and server, and change the packets as they pass through • DNS hijacking o Insert malicious routes into DNS tables to send traffic for genuine sites to malicious sites Need to know: Networking protocols, routing, TCP-IP
  • 11. Web AttacksWeb Attacks • Phishing o An evil website pretends to be a trusted website o Example: • You type, by mistake, “mibank.com” instead of “mybank.com” • mibank.com designs the site to look like mybank.com so the user types in their info as usual • BAD! Now an evil person has your info! • SQL Injection o Interesting Video showing an example • Cross Site Scripting o Writing a complex Javascript program that steals data left by other sites that you have visited in same browsing session Need to know: Web Programming, Javascript, SQL
  • 12. VirusVirus • Definition o Piece of code that automatically reproduces itself. It’s attached to other programs or files, but requires user intervention to propagate. • Infection (targets/carriers) o Executable files o Boot sectors o Documents (macros), scripts (web pages), etc. • Propagation is made by the user. The mechanisms are storage elements, mails, downloaded files or shared folders Infection Propagation Payload
  • 13. WormWorm • Definition o Piece of code that automatically reproduces itself over the network. It doesn’t need the user intervention to propagate (autonomous). • Infection o Via buffer overflow, file sharing, configuration errors and other vulnerabilities. • Target selection algorithm o Email addresses, DNS, IP, network neighborhood • Payload o Malicious programs o Backdoor, DDoS agent, etc. infection Propagation engine Payload Target Selection algorithm Scanning engine
  • 14. Backdoor, trojan, rootkitsBackdoor, trojan, rootkits • Goal o The goal of backdoor, Trojan and rootkits is to take possession of a machine subsequently through an infection made via a backdoor. • Backdoor o A backdoor is a program placed by a black-hacker that allows him to access a system. A backdoor have many functionalities such as keyboard-sniffer, display spying, etc. • Trojan o A Trojan is a software that seems useful or benign, but is actually hiding a malicious functionality. • Rootkits (the ultimate virus) o Rootkits operate like backdoor and Trojan, but also modify existing programs in the operating system. That allows a black-hacker to control the system without being detected. A rootkit can be in user-mode or in kernel-mode.
  • 16. Social EngineeringSocial Engineering • Why is this social engineering? o Manipulating a person or persons into divulging confidential information • I am not dumb, so does this really apply to me? o YES! Attackers are ALSO not dumb. o Social Engineers are coming up with much better and much more elaborate schemes to attack users. o Even corporate executives can be tricked into revealing VERY secret info • What can I do to protect myself? o NEVER give out your password to ANYBODY. o Any system administrator should have the ability to change your password without having to know an old password Need to know: How to win friends (victims) and influence (scam) people (not CS).
  • 17. Password AttacksPassword Attacks • Password Guessing o Ineffective except in targeted cases • Dictionary Attacks o Password are stored in computers as hashes, and these hashes can sometimes get exposed o Check all known words with the stored hashes • Rainbow Tables o Trade off storage and computation – uses a large number of pre- computed hashes without having a dictionary o Innovative algorithm, that can find passwords fast! • e.g. 14 character alphanumeric passwords are found in about 4- 10 minutes of computing using a 1GB rainbow table
  • 18. Computer Security IssuesComputer Security Issues • Vulnerability is a point where a system is susceptible to attack. • A threat is a possible danger to the system. The danger might be a person (a system cracker or a spy), a thing (a faulty piece of equipment), or an event (a fire or a flood) that might exploit a vulnerability of the system. • Countermeasures are techniques for protecting your system
  • 19. Vulnerabilities in SystemsVulnerabilities in Systems • How do viruses, rootkits enter a system? o Even without the user doing something “stupid” • There are vulnerabilities in most software systems. o Buffer Overflow is the most dangerous and common one • How does it work? o All programs run from memory. o Some programs allow access to reserved memory locations when given incorrect input. o Hackers find out where to place incorrect input and take control. o Easy to abuse by hackers, allows a hacker complete access to all resources
  • 20. How can you achieve security?How can you achieve security? • Many techniques exist for ensuring computer and network security o Cryptography o Secure networks o Antivirus software o Firewalls • In addition, users have to practice “safe computing” o Not downloading from unsafe websites o Not opening attachments o Not trusting what you see on websites o Avoiding Scams
  • 21. CryptographyCryptography • Simply – secret codes • Encryption o Converting data to unreadable codes to prevent anyone form accessing this information o Need a “key” to find the original data – keys take a few million- trillion years to guess • Public keys o An ingenious system of proving you know your password without disclosing your password. Also used for digital signatures o Used heavily in SSL connections • Hashing o Creating fingerprints of documents
  • 22. Cryptographic ProtocolsCryptographic Protocols Symmetric encryption Authentication Asymmetric encryption Public Key Infrastructure
  • 23. Why Care?Why Care? • Online banking, trading, purchasing may be insecure o Credit card and identity theft • Personal files could be corrupted o All school work, music, videos, etc. may be lost • Computer may become too slow to run o If you aren't part of the solution you are part of the problem • Pwn2Own contest - 2008 o Mac (Leopard) fell first via Safari, Vista took time but was hacked via Flash Player, Ubuntu stood ground. • Upon discovery, vulnerabilities can be used against many computers connected to the internet.
  • 24. ThankThank You !!!You !!! For More Information click below link: Follow Us on: http://vibranttechnologies.co.in/ethical-hacking-classes-in- mumbai.html

Editor's Notes

  1. CS = Computer Security