1. (see also Q1 and Q2 Topics)
ECE6612
Quiz 2 -> Exam Topics
(see also Q1 and Q2 Topics)
Fall 2006

2. Chapter 9 - Viruses, Worms
Prevention, Detection, Phases (Dor.,Prop,Trig.,Exec.), Types, How fast can they spread.
Virus - code that copies itself into other programs.
A Bacteria replicates until it fills all disk space, or CPU cycles.
Payload - harmful things the malicious program does, after it has had time to spread.
Worm - a program that replicates itself across the network (usually riding on messages or attached documents (e.g., macro viruses). “viruses” are technically “worms”.
Trojan Horse - instructions in an otherwise good program that cause bad things to happen (sending your data or password to an attacker over the net).
Logic Bomb - malicious code that activates on an event (e.g., date).
Trap Door (or Back Door) - undocumented entry point written into code for debugging that can allow unwanted users.
Vulnerability - a program defect that permits Intrusions.
Easter Egg - extraneous code that does something “cool.” A way for programmers to show that they control the product. 2

3. Simple Firewall - drops packets based on IP, port
Chapter 10a - Firewalls
Simple Firewall - drops packets based on IP, port
Stateful - Keeps track of connections, set up inside or outside.
NAT - Network Address Translation, Private Address ranges (10. )
Proxy Server - checks application header and data.
Attacks - how does Firewall protect against scanning, bad-fragments, bad TCP flags, Smuft attack, ...
Host-based Firewalls - xinetd (/etc/hosts.allow), iptables, Zone Alarm, Black Ice (now ISS Desktop Proventia) 3

4. Chapter 10b - Trusted Systems
Subject, Object, Access Rights (permissions)
Policy - Access matrix or ACL (access control list)
Basic Security Rules:
No read up (simple security property)
No write down (do not widen accessibility)
Need to Know.
Reference Monitor, audit file, security kernel database.
Requirements to be a “Trusted System”:
Complete Mediation,
Isolation,
Verifiability
“Common Criteria” Security Specifications - multinational trust ratings 4

5. Use of bad fragments to crash Operating System (OS).
Chapter 11 - TCP/IP
Use of bad fragments to crash Operating System (OS).
Use of ICMP packets (ping, “unreachable”, “time-out”)
Smuft attack (packet multiplication, use of broadcast address).
“Spoofed” addresses.
TCP Flags - bad combinations to map OS, cause crashes.
TCP - Highjacked connection. 5

6. Chapter 12 - Traffic Visualization
Not covered. 6

7. Chapter 13 - NetSec Utilities
What do they do?
Tripwire
Saint and Satan
Nessus
Ethereal and “tcpdump”
Security Organizations:
US-CERT (U.S. Computer Emergency Response Team)
SANS
NIPC (FBI - Nat. Infrastructure Protection Center)
What to do if a host is compromised.
Evidence - chain of custody 7

8. Slide Set 14 - Wireless Security
WEP is weak security, but far better than nothing.
WPA is better, but needs long passphases (22 characters)
Use longest key-length possible.
Enable use of “allowed list” of MAC addresses.
Use higher-layer security - IPsec or SSL.
Use a firewall and IDS to isolate wireless access points (WAP’s) just like you do for the Internet.
Search for “Rogue” WAP’s. 8

9. Hidden Files (on UNIX, name starts with “.”)
Slide set 15 - Hidden Data
Hidden Files (on UNIX, name starts with “.”)
Startup scripts (great place to hide a Trojan Horse)
Covert channels (hide in “Ping” packets, SSH, port 80, FTP)
Steganography (hiding data in an image file)
Watch for new processes ( use 'ps aux')., new files (particularly “suid” files), open Internet TCP and UDP ports ('netstat -lp' or 'sockstat -4') 9

10. (The 1st rule is "No security without physical security.")
Slide Set 16 - Safe Computing
Buffer Overflow(what is it, what does it do)
How to code to prevent possibility of a “Buffer Overflow”
Eliminate unneeded daemons, “suid programs,” open ports, and user accounts (to "harden" the computer).
Enforce long, mixed-character passwords.
Explain “Once root, always root” (Copeland's 2nd rule*)
(The 1st rule is "No security without physical security.")
(The 3rd rule is "Layers of protection and detection are needed ... .")
Good Luck! and Best Wishes for 2007 10