1.3 Identify non-essential services and protocols and know what actions to take to reduce the risks of those services and protocols
When setting up a new server, it is usually best to start with a clean installation of the Operating System (OS) and determine which specific protocols and services are needed, then disable the rest.
1.4 Recognize the following attacks and specify the appropriate actions to take to mitigate vulnerability and risk
o DOS / DDOS (Denial of Service / Distributed Denial of Service) - These attacks are meant to disrupt (deny) service to real users who need or want that service. A DDOS attack comes from a large collection of unknowing users whose computers have been turned into "zombies." There are several types of DOS attacks:
Smurf - an attack that uses the Internet Control Message Protocol (ICMP) echo reply, or ping. During a smurf attack, the attacker sends a large number of "ping" packets to a network's broadcast address with the source address changed to the victim. This causes the entire network to reply to the ping and flood the victim with traffic.
Fraggle - this attack is similar to a smuf attack except it uses the User Datagram Protocol (UDP), not ICMP. Modified UDP packets are sent to a broadcast address to either port 7, which is ECHO, or port 19, CHARGEN.
Ping flood - this DOS attack sends a large number of ping requests to the victim
Ping of death - this is a type of ping flood with packets that are too large, which can crash the OS
SYN flood - this sends a large number of synchronization (SYN) requests to the victim, which replies with a SYN-ACK, but never receives the acknowledgment (ACK), which leaves a large number of half-open TCP sessions. There is a wait before the port is reset, which can make an overflow possible denying legitimate users access.
LAND - this attack is when a fake SYN packet is sent with the IP address and port the same for both the source and destination, which "confuses" the OS and may crash it.
Teardrop - this attack sends UDP packets that are fragmented, but when the OS tries to create the original UDP packet, some of the fragments overlap and can crash the OS.
Bonk - this is an attack where corrupt UDP packets are sent to port 53 (DNS) which can crash the OS
Boink - this is similar to a bonk attack, except more ports are targeted.
o Back Door - A backdoor is a "hole" in fuctional software usually left in by the programmer to allow a support technician into the computer. If these are unpatched, malicious users may enter your computer through it. Some well-known examples include Back Orifice, NetBus, and SubSeven. To avoid possible damage from back doors, only use software from trusted sources, and update that software regularly.
o Spoofing - Spoofing is the modification of data so it appears to come from a different source. For example, an attacker could find the IP address of a computer within a network, then "spoof" his or her IP address to pretend to be that computer. The potential danger may be lessened by blocking traffic from the outside that claims to be from the inside of the network.
o Man in the Middle - In a Man in the Middle attack, an attacker secretly sits between two or more communicating computers and can modify information or merely spy on a session of communication between the computers. Strong encryption can helpt to lessen the danger from a man in the middle attack.
o Replay - A replay attack is capturing data then extracting authentication information from that data and sending it to authenticate the hacker. One way to avoid this is using time stamps, which limit the length of time the authentication information is valid.
o TCP/IP Hijacking - This attack occurs when an attacker actually "hijacks," or takes over an IP session between two computers. It often starts as a man in the middle attack then the client is kicked off. This can be prevented by forcing users to reauthenticate before allowing transactions or even cookies.
o Weak Keys - This is an attack on poor encryption.
o Mathematical - This attack tries to break encryption based on mathematical structure.
o Social Engineering - A social engineering attack is exploiting users, not PCs, and using trust and emotions to gain information.
o Password Guessing - this attack is on authentication, and is usually an attempt to crack passwords. The best way to limit the effectiveness of these attacks is to require long, complex passwords, require passwords to change on a regular basis (while not allowing the same password to be used twice), and to limit the number of logon attempts before locking an account. However, requiring passwords that are too comlplex may result in the users writing passwords down near the computer, which is very unsafe. There are several password guessing attacks:
- Brute Force - Ths attack tries every possible combination of letters, symbols, punctuation, and letters to try and crack a password. It takes a considerable amount of time, but can crack any password if given the proper amount of time.
- Birthday - A birthday attack is a type of brute force attack that uses hashing. In a group of 23 people, there is a probability of more than 50% that two or more people have the same birthday. A birthday attack uses similar logic to try and find another object with the same hash.
- Dictionary - This attack uses words and phrases from a "dictionary," or list of common words and passwords to try and crack simple passwords. Some forms replace letters with numbers that are commonly substitued for those letters.
o Software Exploitation - These are attacks based on weaknesses and vulnerabilities in the software on a computer. The main method is a buffer overflow, which occurs when more data is sent in than the software is able to handel, crashing the system. The best way to avoid this is by frequently updating the software.
1.5 Recognize the following types of malicious code and specify the appropriate actions to take to mitigate vulnerability and risk
o Viruses - A virus is a type of malicious code that "infects" other files and spreads when those files are exchanged. Well-known virsues include "Stoned," "Michelangelo," "Jerusalem," "Cascade," and "Melissa," (later a worm was also named Melissa). Please note that there are always many virus hoax e-mails circulating. Do not pay any attention to them or forward them to anybody. There are many types of viruses including, but not limited to:
Boot-sector - these viruses infect the first sector of the hard drive or floppy drives. So, when the computer starts up, the virus is loaded into the memory. These can be detected and removed with antivirus software.
Master Boot Record - these are similar to boot sector viruses, but instead infect the master boot record.
Multipartite - these viruses infect the boot record and files, complicating repair efforts. If one part is deleted but not the other, the computer will be re-infected.
Polymorphic - polymorphic viruses change in some way each time they run. This is to make them more difficult to detect by antivirus software. These can still be detected with updated signatures and behavoir-based scanning.
Retro - a retrovirus attempts to attack antimalware software and its database or attempt to bypass it.
Stealth - stealth viruses attempt to hide themselves and redirect commands concerning them. They may also move from one file to another while a scan is being done. For example, some modify the reported file size.
Macro - these viruses are included in Microsoft Office documents and infect the computer the documents are opened on. Disabling macros can stop these from spreading.
Armored - armored viruses often contain some code to limit the ability for debugging programs to analyze their code, or make parts of the code to act as a decoy. This helps to allow the virus to last longer without antivirus vendors being able to create signatures to remove it.
o Trojan Horses - Trojan horses often come with software that pretends to be legitimate and are triggered when that program is used. They, unlike viruses, do not replicate themselves. Well-known trojans include "Acid Rain," "Vundo," "Nuker," and "Simpsons." Good antimalware programs can remove these, but reading the license agreement for software and avoiding downloading unknown software is the best way to prevent Trojan Horses from ever being installed.
o Logic Bombs - Logic bombs are malicious code that wait for a specified condition, such as a date, before taking action. Having an independent consultant review a program's code can help to prevent an employee from inserting a logic bomb.
o Worms - A worm is a type of malicious code that is able to self-replicate and spread to other systems. These often exploit unpatched vulnerabilities. Several popular examples include "Code Red," "Netsky," "Nimba," "Badtrans," "Bagle," "Netsky," "Blaster," "Sasser," and "Morris."
1.6 Understand the concept of and know how reduce the risks of social engineering
Social Engineering is an attack on human character instead of technology. For example, an administrator might receive a call from someone claiming to be the company's vice president who says that he or she forgot his or her password and needs it for an important meeting. The administrator might feel sympathy that clouds his or her judgement and might give the person the password. Training is usually the best method of avoiding social engineering attacks.
1.7 Understand the concept and significance of auditing, logging and system scanning
Logging is noting system and/or network information for possible use in the future.
Auditing is analyzing information about a user and/or event, which often uses logged information.
System (Vulnerability) Scanning is scanning one's own network for vulnerabilities using tools that are often used for malicious purposes.
Resources:
PrepLogic Security+ Mega Guide - http://www.preplogic.com/products/mega-guides/mega-guides-product-details.asp?eid=129
CompTIA Security+ TechNotes - "Access Control" & "Authentication" -
http://www.techexams.net/technotes/securityplus/mac_dac_rbac.shtml
http://www.techexams.net/technotes/securityplus/authentication.shtml
CompTIA Security+ Certification - http://certification.comptia.org/security/
ExamCram CompTIA Security+ ISBN 0-7897-2910-5 Que Publishing July 2006.
This page was last modified on 07/28/07 02:08 PM