ActiveX
a set of rules for how applications under the Microsoft Windows operating system should share information.
- is not a programming language but a set of rules for how applications under the Microsoft Windows OS should share information
- attackers can take advantage of vulnerabilities to perform malicious attacks on a computer
ActiveX control
a specific way of implementing ActiveX that runs through the web browser and functions like a miniature application
- represent specific way of implementing ActiveX and are sometimes called ActiveX Applications
- can be invoked from webpages through the use of a scripting language or directly by an HTML command
- can delete files or reformat a hard drive
add-on
program that provides additional functionality to web browsers. also called EXTENSION
add-ons can:
- create additional web browser toolbars
- change browser menus
- be aware of other tabs open in the same browser process
- process the content of every webpage that is loaded
Address Resolution Protocol (ARP)
part of the TCP/IP protocol for determining the MAC address based on the IP address
-if the IP address for a device is known but the MAC address is not, the sending computer sends an ARP packet to all computers on the network that in effect says, “If this is your IP address, send me back your MAC address.” The computer with that IP address sends back a packet with the MAC address so the packet can be stored in ARP cache for future reference. In addition, all other computers that hear the ARP reply also cache that data
arbitrary/remote code execution
an attack that allows an attacker to run programs and execute commands on a different computer
- HEAP SPRAY is targeted and inserts data only in certain parts of memory. Often used in an arbitrary/remote code execution attack
- gains control of the victim’s computer to execute the attacker’s commands; turns it into his own remote computer
- gaining control of the victim’s computer can virtually perform any command for example; access the computer’s files, displaying objectionable content on the screen, erasing the entire contents of the hard drive
- this attack often takes advantage of malicious attachments. If a user opens a specially crafted file, such as a Microsoft Visio file or a PDF file, the attacker can gain the same user rights as the current user who is logged on
p109
ARP poisoning
an attack that corrupts the ARP cache
- attacker can modify the MAC address in the ARP cache so that the corresponding IP address points to a different computer
- Man-in- the- middle attack using ARP poisoning requires sending malicious ARP reply messages and using IP forwarding. However, many automated attack software tools will easily perform ARP POISONING
Example of ARP poisoning:
Attack: Steal data
Description: attacker can substitute her own MAC address and steal data intended for another device
Attack: Prevent internet access
Description: attacker can substitute an invalid MAC address for the network gateway so that no users can access external networks
Attack: Man-in-the-middle
Description: man-in-the middle device can be set to receive all communications by substituting that MAC address
Attack: Dos attack
Description: the valid IP address of the DoS target can be substituted with an invalid MAC address, causing all traffic destined for the target to fail
p114
attachment
a file that coupled to an email message and often carries malware
- commonly used to spread viruses, trojans, and other malware when they are opened
- most users are unaware of the danger of attachments and routinely open any email attachment that they receive, even if it is from an unknown sender
- attackers include information in the subject line that entices even reluctant users to open the attachment, such as a current event (i.e. Check out this info about yesterday’s hurricane) or information about the recipient (i.e. Is this really you in this picture?)
- Email-distributed malware frequently takes advantage of personal
buffer overflow attack
an attack that occurs when a process attempts to store data in RAM beyond the boundaries of a fixed-length storage buffer
- the extra data overflows into the adjacent memory locations (a buffer overflow). the storage buffer typically contains the “return address” memory location, an attacker can overflow the buffer with a new address pointing to the attacker’s malware code
- The “return address” is not the only element that can be altered in a buffer overflow attack, but it is one of the most commonly altered elements
client-side attack
an attack that targets vulnerabilities in client applications that interact with a compromised server or process malicious data
- this happens when the client initiates the connection with the server and results in an attack
- client-side attacks are not limited to the web: they can occur on any client/server pair, such as email, File Transfer Protocol (FTP), instant messaging (IM) or multimedia streaming
- user’s computer can become compromised just by VIEWING a webpage and not even clicking on any content. Known as (DRIVE-BY DOWNLOAD).
- attackers first identify a vulnerable web server and inject content by exploiting the server through vulnerable scripting applications
- attackers avoid visual detection by often crafting a ZERO-PIXEL IFRAME (Inline Frame). This is an HTML element that allows for embedding another HTML document inside the main document. This is invisible to the naked eye. The browsers download the initial exploit script that targets a vulnerability in the browser through an IFrame. This will instruct the browser to connect to the attackers’s web server to download malware, which is then automatically installed and executed on the client
- DRIVE-BY DOWNLOADS sites target older web browsers; these attacks often are noT as effective against new browsers
command injection
injecting and executing commands to execute on a server
- attack can be launched through a vulnerability in the web application program that accepts user input, a vulnerability in the web server operating system software, or a security misconfiguration on the server itself
- long string of characters may be entered such as http://../../../../../../../../ where ../ traverses up one directory level. if user input were permitted and not properly validated, the attacker could create the input http://www.server.net/dnamic.asp?view=../../../../../TopSecret.docx which could display the contents of a document
pg100
cookie
a file on a local computer in which a web server stores user-specific information
- the server can store user-specific information in a file on the user’s local computer and then retrieve it later
- cookies can store any personally identifiable information (name, email address, work address, telephone number, and so on). however, a website cannot gain access to private information stored on the local computer.
- once a cookie is created on a client computer, only the website that created that cookie can read it
Several different types of cookies exist:
- First-Party cookie
- Third-Party cookie
- Session cookie
- Persistent cookie
- Locally shared objects (LSO)
-cookies can pose both security and privacy risks. FIRST-PARTY COOKIES can be stolen and used to impersonate the user. THIRD-PARTY COOKIES can be used to track the browsing or buying habits of a user. This will allow organizations know which pages are being viewed, how often they are viewed, and the IP address of the viewing computer. This information can be used to infer what items the user may be interested in, and to target advertising to the user
p104
cross-site scripting (XSS)
an attack that injects scripts into a web application server to direct attacks at clients
- refers to an attack using scripting that originates on one site (the web server) to impact another site (the user’s computer)
- XSS is like a phishing attack but without needing to trick the user into visiting a malicious website. Instead, the user starts at a legitimate website and XSS automatically directs her to the malicious site
- an XSS attack requires a website that meets two criteria: it accepts user input without validating it, and it uses that input in a response
denial of service (DoS)
an attack that attempts to prevent a system from performing its normal functions by overwhelming the system with requests
- a deliberate attempt to prevent authorized users from accessing a system by overwhelming that system with requests
- most DoS attacks today are actually DISTRIBUTED DENIAL OF SERVICE (DDoS). instead of just one computer, a DDoS may used hundreds or thousands of zombie computers in a botnet to flood a device with requests
3 different types of DoS attacks:
- ping flood
- smurf attack (spoofing)
- SYN flood attack
directory traversal
an attack that takes advantage of a vulnerability so that a user can move from the root directory to restricted directories
-once the attacker has accessed a restricted directory, she can enter (inject) commands to execute on a server (called COMMAND INJECTION) or view confidential files
distributed denial of service (DDoS)
an attack that uses many computers to perform a DoS attack
-this is to overwhelm a network
DNS poisoning
an attack that substitutes DNS addresses so that the computer is automatically redirected to an attacker’s device
-predecessor to today’s Internet was a network known as ARPAnet. Network was completed in 1969 and linked together single computers located at each of four different sites. was trying to type the word LOGIN, but failed at letter G. the system crashed
Domain Name System (DNS)
a hierarchical name system for translating domain names to IP addresses
-When TCP/IP was developed, the host table concept was expanded to hierarchical name system for matching computer names and numbers known as DOMAIN NAME SYSTEM
extension
another name for ADD-ON
-add-ons/extensions can do the following:
create additional web browser toolbars
change browser menus
be aware of other tabs open in the same browser process
process the content of every webpage that is loaded
first-party cookie
a cookie that is created from the website currently being viewed
-example:
When viewing the website www.cengage.com, the cookie CENGAGE could be created and saved on the user’s hard drive. Whenever the user returns to this site, that cookie would be used by the site to view the user’s preferences and better customize the browsing experience
Flash cookie
another name for LOCALLY SHARED OBJECT (LSO)
- named after the Adobe Flash player
- they can store data more complex than the simple text that is typically found in a regular cookie
- can store up to 100 KB of data from a website, about 25 times as much as a regular cookie
a list of the mappings of host names to IP addresses
host table
-created in the early 1970s
part of HTTP that is comprised of fields that contain the different characteristics of the data that is being transmitted
HTTP header
This is comprised of:
- field name
- a colon
- field value
(i. e. Content-length:49) - core set of fields has been standardized by the Internet Engineering Task Force (IETF)
- HTTP headers are the result of an HTTP request by a web browser to a web server or the response back to the browser by the web server. Usually HTTP headers are used only by the web browser and the web server software because many web applications choose to ignore them
p102
modifying HTTP headers to create an attack
HTTP header manipulation
-not an actual attack, but rather the vehicle through which other attacks, such as XSS, can be launched
Examples of HTTP header attacks:
-REFERER-
some websites check the Referer field to ensure that the request came from a page generated by that site, an attacker can bypass this security by modifying the Referer field to hide the fact that it came from another site
-Accept-Language-
some web applications pass the contents of this field directly to the database. An attacker can inject an SQL command by modifying this header. an attacker could generate a directory traversal attack
-Respnonse splitting-
client computer must allow input that contains CARRIAGE RETURN (CR using %0d or \r) and line feed (LF using %0a, or \a). these characters can not only give attackers control of the remaining HTTP headers and body of the response but also allow them to create additional responoses via HTTP headers that are entirely under their control
p103
an attack that is the result of an attacker changing the value of a variable to something outside the range that the programmer had intended
integer overflow attack
-when this integer overflow occurs, the interpreted value then wraps around from the maximum value to the minimum value
The attack used in situations-
-used to create a buffer overflow situations. if introduced during the calculations for the length of a buffer when a copy is occurring, it could result in a buffer that is too small to hold the data. attack could then use this to create her buffer overflow attack
- a program that calculates the total cost of items purchased would use the number of units sold times the cost per unit.it could result in a negative value and a resulting negative total cost, indicating that a refund is due the customer
- a large positive value in a bank transfer could be wrapped around by an integer overflow attack to become a negative value, which could then reverse the flow of money. instead of adding this amount to the victim’s account, it could withdraw that amount and later transfer it to the attacker’s account
