Page 159 - DCAP516_COMPUTER_SECURITY

Unit 13: Firewalls

Remote login: When someone is able to connect to your computer and control it in some Notes
form. This can range from being able to view or access your files to actually running
programs on your computer.
Application backdoors: Some programs have special features that allow for remote access.
Others contain bugs that provide a backdoor, or hidden access, that provides some level of
control of the program.
SMTP session hijacking: SMTP is the most common method of sending e-mail over the
Internet. By gaining access to a list of e-mail addresses, a person can send unsolicited junk
e-mail (spam) to thousands of users. This is done quite often by redirecting the e-mail
through the SMTP server of an unsuspecting host, making the actual sender of the spam
difficult to trace.

Operating system bugs: Like applications, some operating systems have backdoors. Others
provide remote access with insufficient security controls or have bugs that an experienced
hacker can take advantage of.

Denial of service: You have probably heard this phrase used in news reports on the attacks
on major Websites. This type of attack is nearly impossible to counter. What happens is
that the hacker sends a request to the server to connect to it. When the server responds
with an acknowledgement and tries to establish a session, it cannot find the system that
made the request. By inundating a server with these unanswerable session requests, a
hacker causes the server to slow to a crawl or eventually crash.

E-mail bombs: An e-mail bomb is usually a personal attack. Someone sends you the same
e-mail hundreds or thousands of times until your e-mail system cannot accept any more
messages.

Macros: To simplify complicated procedures, many applications allow you to create a
script of commands that the application can run. This script is known as a macro. Hackers
have taken advantage of this to create their own macros that, depending on the application,
can destroy your data or crash your computer.

Viruses: Probably the most well-known threat is computer viruses. A virus is a small
program that can copy itself to other computers. This way it can spread quickly from one
system to the next. Viruses range from harmless messages to erasing all of your data.

Spam: Typically harmless but always annoying, spam is the electronic equivalent of junk
mail. Spam can be dangerous though. Quite often it contains links to Websites. Be careful
of clicking on these because you may accidentally accept a cookie that provides a backdoor
to your computer.

Redirect bombs: Hackers can use ICMP to change (redirect) the path information takes by
sending it to a different router. This is one of the ways that a denial of service attack is
set up.

Source routing: In most cases, the path a packet travels over the Internet (or any other
network) is determined by the routers along that path. But the source providing the packet
can arbitrarily specify the route that the packet should travel. Hackers sometimes take
advantage of this to make information appear to come from a trusted source or even from
inside the network! Most firewall products disable source routing by default.
Some of the items in the list above are hard, if not impossible, to filter using a firewall. While
some firewalls offer virus protection, it is worth the investment to install anti-virus software on
each computer. And, even though it is annoying, some spam is going to get through your
firewall as long as you accept e-mail.

LOVELY PROFESSIONAL UNIVERSITY 153