1. Exploits Dalia Solomon

2. Categories Trojan Horse Attacks Trojan Horse Attacks Smurf Attack Smurf Attack Port Scan Port Scan Buffer Overflow Buffer Overflow FTP Exploits FTP Exploits Ethereal Exploit Ethereal Exploit Worm Worm Virus Virus Password Cracker Password Cracker DNS Spoofing DNS Spoofing

3. Trojan Horse attacks A computer becomes vulnerable to this attack when the user downloads and installs a file onto their system. A computer becomes vulnerable to this attack when the user downloads and installs a file onto their system. This opens a port without the knowledge of the user. The open port gives the remote user access to ones computer This opens a port without the knowledge of the user. The open port gives the remote user access to ones computer

4. Trojan Horse - NetBus NetBus is a tool that allows a remote user to gain administrative privileges NetBus is a tool that allows a remote user to gain administrative privileges NetBus consists of two programs a server and a client. NetBus consists of two programs a server and a client.

5. NetBus Server To infect a computer, NetBus disguises itself as an ICQ executable file that a naive user install on their computer. To infect a computer, NetBus disguises itself as an ICQ executable file that a naive user install on their computer.

6. NetBus Server NetBus server – This application will open a backdoor on the target computer. This application can be configured to be either invisible or visible to the user. NetBus server – This application will open a backdoor on the target computer. This application can be configured to be either invisible or visible to the user.

7. NetBus Client NetBus - This application will connect to a computer that is running NetBus server. It allows the hacker to spy and take control of the infected computer. NetBus - This application will connect to a computer that is running NetBus server. It allows the hacker to spy and take control of the infected computer.

8. Smurf Attack A Smurf Attack occurs when a packet such as an ICMP echo frame (in this application) is sent to a group of machines. A Smurf Attack occurs when a packet such as an ICMP echo frame (in this application) is sent to a group of machines. The packet sent has the source address replaced by the target computer or network IP address. This causes a flurry of echo responses to be sent to the target machine, which can overflow the target computer. The packet sent has the source address replaced by the target computer or network IP address. This causes a flurry of echo responses to be sent to the target machine, which can overflow the target computer.

9. Smurf Attack Here we are attacking our computer Here we are attacking our computer

10. Port Scan This program allows the hacker to scan a target computer to detect open ports. This program allows the hacker to scan a target computer to detect open ports. This is primarily used to detect vulnerable applications using certain ports on the target computer. This is primarily used to detect vulnerable applications using certain ports on the target computer.

11. Port Scan

12. Buffer Overflow Buffer Overflow Buffer Overflow Most common form of exploitsMost common form of exploits Occurs when you put more data in the buffer than what it can holdOccurs when you put more data in the buffer than what it can hold Occurs if bounds are not checked by programOccurs if bounds are not checked by program Purpose of buffer overflow is to execute codes and gain special privilegesPurpose of buffer overflow is to execute codes and gain special privileges

13. Buffer Overflow

16. FTP Exploits This exploit shows how it is possible for somebody to get a shell (command prompt) from Serv-U FTP server. This exploit shows how it is possible for somebody to get a shell (command prompt) from Serv-U FTP server. This exploit causes a buffer overflow condition to occur in Serv-U FTP when it parses the MDTM command. This exploit causes a buffer overflow condition to occur in Serv-U FTP when it parses the MDTM command.

17. FTP Exploits The exploit required that the user have login access to a server. The exploit required that the user have login access to a server.

18. FTP Exploits This shows how the hacker gains shell access to the target machine. This shows how the hacker gains shell access to the target machine.

19. FTP Exploits

20. Here is a segment of the code that causes the buffer overflow. Here is a segment of the code that causes the buffer overflow.

21. Ethereal Exploit Vulnerability exist in Ethereal. By sending carefully crafted packets to the sniffed wire or by convincing someone to load a malicious packet capture file into Ethereal a user can overflow a buffer and execute malicious code Vulnerability exist in Ethereal. By sending carefully crafted packets to the sniffed wire or by convincing someone to load a malicious packet capture file into Ethereal a user can overflow a buffer and execute malicious code The vulnerability exist in the following packets: BGP, EIGRP, IGAP, IRDA, ISUP, NetFlow, PGM, TCAP and UCP.The vulnerability exist in the following packets: BGP, EIGRP, IGAP, IRDA, ISUP, NetFlow, PGM, TCAP and UCP.

22. Ethereal - example Ethereal IGAP message Ethereal IGAP message This exploits a vulnerability in Ethereal when handling IGAP messagesThis exploits a vulnerability in Ethereal when handling IGAP messages Works on Ethereal 0.10.0 to Ethereal 0.10.2.Works on Ethereal 0.10.0 to Ethereal 0.10.2. Will either crash Ethereal or open a port that allows a user to gain root privilegesWill either crash Ethereal or open a port that allows a user to gain root privileges

23. Ethereal - example This code will create a malformed IGAP header that when sent, causes the Ethereal application to crash because of its vulnerability in handling IGAP packets. This code will create a malformed IGAP header that when sent, causes the Ethereal application to crash because of its vulnerability in handling IGAP packets.

24. Worm A worm is a program that makes copies of itself and causes major damage to the files, software, and data A worm is a program that makes copies of itself and causes major damage to the files, software, and data Method of replication include Method of replication include EmailEmail File sharingFile sharing

25. Worm - example W32/Bugbear-A W32/Bugbear-A Is a network worm that spreads by emailing attachments of itselfIs a network worm that spreads by emailing attachments of itself It creates a thread which attempts to terminate anti-virus and security programsIt creates a thread which attempts to terminate anti-virus and security programs The worm will log keystrokes and send this information when the user is connected onlineThe worm will log keystrokes and send this information when the user is connected online The worm will open port 80 on the infected computerThe worm will open port 80 on the infected computer

26. Worm - example http://www.sophos.com/virusinfo/analyses/w32bugbeara.html

27. Worm - Example W32/MyDoom-A is a worm which spreads by email. W32/MyDoom-A is a worm which spreads by email. When the infected attachment is launched, the worm harvests email addresses from address books and from files with the following extensions: WAB, TXT, HTM, SHT, PHP, ASP, DBX, TBB, ADB and PL. When the infected attachment is launched, the worm harvests email addresses from address books and from files with the following extensions: WAB, TXT, HTM, SHT, PHP, ASP, DBX, TBB, ADB and PL.

28. Worm – Example (continue…) Attached files will have an extension of BAT, CMD, EXE, PIF, SCR or ZIP. Attached files will have an extension of BAT, CMD, EXE, PIF, SCR or ZIP.

29. Worm – Example (continue…) the worm will attempt a denial-of-service attack to www.sco.com, sending numerous GET requests to the web server. the worm will attempt a denial-of-service attack to www.sco.com, sending numerous GET requests to the web server. Drops a file named shimgapi.dll to the temp or system folder. This is a backdoor program loaded by the worm that allows outsiders to connect to TCP port 3127. Drops a file named shimgapi.dll to the temp or system folder. This is a backdoor program loaded by the worm that allows outsiders to connect to TCP port 3127. http://www.sophos.com/virusinfo/analyses/ w32mydooma.html

30. Virus A virus is program that infect operating system and applications. A virus is program that infect operating system and applications. Replication methods Replication methods Application File (Word doc.)Application File (Word doc.) Hard drive or Boot record (boot disk)Hard drive or Boot record (boot disk) Scripts (batch file)Scripts (batch file)

31. Virus - example W97M/Marker Virus is a Word macro virus It collects user information from Word and sends the information through FTP It adds a log at the end of the virus body for every infected user. This log contains information for system time, date, users name and address

32. Virus - example When you open a document file it will display a message When you open a document file it will display a message Depending on the user’s response the user will get one of these messages Depending on the user’s response the user will get one of these messages

33. Password Cracker Some applications and web pages are vulnerable to remote password cracker tools. Some applications and web pages are vulnerable to remote password cracker tools. Application such as HTTP, FTP and telnet that don’t handle login properly and have small size password are vulnerable to brute force password cracker tools. Application such as HTTP, FTP and telnet that don’t handle login properly and have small size password are vulnerable to brute force password cracker tools.

34. Password - cracker Brutus is a remote password cracker tool, on an older Serv-U v 2.5 application it can crack a password by sequentially sending in all possible password combination Brutus is a remote password cracker tool, on an older Serv-U v 2.5 application it can crack a password by sequentially sending in all possible password combination

35. Password - cracker

36. DNS spoofing A DNS attack that involves intercepting and sending a fake DNS response to a user. A DNS attack that involves intercepting and sending a fake DNS response to a user. This attack forwards the user to a different address than where he wants to be. This attack forwards the user to a different address than where he wants to be.

37. DNS spoofing WinDNSSpoof WinDNSSpoof spoof DNS packetsspoof DNS packets http://www.securesphere.net/download/papers/dnsspoof.htmhttp://www.securesphere.net/download/papers/dnsspoof.htmhttp://www.securesphere.net/download/papers/dnsspoof.htm

38. DNS Exploitation Tool Zodiac is a robust DNS protocol monitoring and spoofing program Zodiac is a robust DNS protocol monitoring and spoofing program Features: Features: Captures and decodes DNS packetsCaptures and decodes DNS packets DNS local spoofingDNS local spoofing DNS ID spoofing, exploiting a weakness within the DNS protocol itself.DNS ID spoofing, exploiting a weakness within the DNS protocol itself. Etc…Etc…http://teso.scene.at/projects/zodiac/

39. Questions?