This document provides an overview of several cybersecurity topics: - Botnets, which are networks of compromised computers controlled remotely. They are used to launch DDoS attacks, send spam, and other malicious activities. - Watering hole attacks target specific groups by infecting websites they commonly visit. - Spear phishing attacks use targeted emails to steal sensitive information. - DDoS attacks overwhelm servers with traffic from multiple compromised systems. Detection and prevention methods are discussed for each topic.

1. PRESENTATION
ON
CYBER SECURITY
TERMS
Suryaprakash Nehra
1130606

2. OUTLINE
Introduction to Cyber Security
Botnet
Watering Hole attack
Spear Phishing attacK
Distributed Denial of Service(DDoS)
Conclusion

3. BOTNET
 A Botnet is a network of compromised computers
under the control of a remote attacker
 controller of a botnet is able to direct the activities of
these compromised computers
 Botnet Terminology
 Bot Herder (Bot Master)
 Bot
 Bot Client
 IRC Server
 Command and Control Channel (C&C)

4. INTRODUCTION TO BOTNET(TERMINOLOGY)
IRC Channel
IRC Server
Code Server
IRC Channel
C&C Traffic
Updates
Victim
Attack
Bot Master

5. BOTNET IN NETWORK SECURITY
 Internet users are getting infected by bots
 Many times corporate and end users are trapped in
botnet attacks
 Today 16-25% of the computers connected to the
internet are members of a botnet
 In this network bots are located in various locations
 It will become difficult to track illegal activities
 This behavior makes botnet an attractive tool for
intruders and increase threat against network
security

6. HOW BOTNET IS USED??
Distributed Denial of Service (DDoS) attacks
 Sending Spams
 Phishing
 Addware
 Spyware
 Click Fraud

7. BOTNET DETECTION
Two approaches for botnet detection based on
 Setting up honeynets
 Passive traffic monitoring
 Signature based
 Anomaly based
 DNS based

8. BOTNET DETECTION:SETTING UP HONEYNETS
Windows Honey pot
 Honeywall Responsibilities:
DNS/IP-address of IRC server and port number
(optional) password to connect to IRC-server
Nickname of bot
Channel to join and (optional) channel-password

9. BOTNET DETECTION:SETTING UP HONEYNETS
Bot
1. Malicious Traffic
Sensor
3. Authorize
2. Inform bot’s IP
Bot Master

10. BOTNET DETECTION:TRAFFIC MONITORING
Signature based: Detection of known botnets
 Anomaly based: Detect botnet using following
anomalies
 High network latency
 High volume of traffic
 Traffic on unusual port
 Unusual system behaviour
 DNS based: Analysis of DNS traffic generated
by botnets

11. BOTNET DETECTION
 Determining the source of a botnet-based attack is
challenging:
 Traditional approach:
Every zombie host is an attacker
Botnets can exist in a benign state for an
arbitrary amount of time before they are used
for a specific attack
 New trend:
P2P networks

12. PREVENTING BOTNET INFECTIONS
Use a Firewall
 Use Antivirus (AV) software
 Deploy an Intrusion Prevention System (IPS)
 Define a Security Policy and
 Share Policies with your users systematically

13. WATERING HOLE ATTACK
• Watering Hole is a computer attack strategy identified in 2012 by RSA
Security, in which the victim is a particular group (organization,
industry, or region). In this attack, the attacker guesses or observes
which websites the group often uses and Infects one or more of them
with malware.
• How does it work ?
 Determine Target Group
 Identify Vulnerabilities on those Websites
 Inject Threat into Website
 Sit in the Tall Grass and Wait for Targets to Come to You
Why it is effective ??

14. PREVENT WATERING HOLE ATTACK
• Timely Software Update
• Vulnerability shielding
• Network traffic detection
• Correlating well-known APT (Advanced
Persistent threat) activities

15. SPEAR PHISHING ATTACK
• Spear phishing is an email that appears to be from an individual or
business that you know. But it isn't. It's from the same criminal hackers
who want your credit card and bank account numbers, passwords, and
the financial information on your PC.
Business impact
• Theft of sensitive information
• Secondary use of compromised machines
• Incident response and recovery costs

16. HOW TO DEFEND AGAINST SPEAR
PHISHING ATTACKS
• Security awareness training
• Boundary defence
• Continuous vulnerability assessment and remediation

17. DDoS Attack
• Distributed-Denial-of-Service attack
– DDoS is a type of DOS attack where multiple compromised
systems, which are often infected with a Trojan, are used
to target a single system causing a Denial of Service (DoS)
attack.
• DoS vs DDoS
– DoS: when a single host attacks
– DDos: when multiple hosts attacks simultaneously

18. How does DDos Attack work?
• build a network of computers
• discover vulnerable sites or hosts on the network
• exploit to gain access to these hosts
• install new programs (known as attack tools) on the compromised
hosts
• hosts that are running these attack tools are known as zombies
• many zombies together form what we call an army
• building an army is automated and not a difficult process
nowadays

19. How to find Vulnerable Machines?
• Random scanning
• Hit-list scanning
• Topological scanning
• Local subnet scanning
• Permutation scanning

20. How to propagate Malicious Code?
• Central source propagation
This mechanism commonly uses HTTP, FTP, and remote-
procedure call (RPC) protocols

21. • Back-chaining propagation :
• copying attack toolkit can be supported by simple port listeners or
by full intruder-installed Web servers, both of which use the Trivial
File Transfer Protocol (TFTP)
• Autonomous propagation

22. DDos Attack Taxonomy
– There are mainly two kinds of DDoS attacks
• Typical DDoS attacks, and
• Distributed Reflector DoS (DRDoS) attacks
– Typical DDoS Attacks:

23. – DRDoS Attacks:
• slave zombies send a stream of packets with the victim's IP
address as the source IP address to other uninfected machines
(known as reflectors)
• the reflectors then connects to the victim and sends greater
volume of traffic, because they believe that the victim was the
host that asked for it
• the attack is mounted by noncompromised machines without
being aware of the action

24. Comparison

25. A Corporate Structure Analogy

26. DEFENCE MECHANISMS
• SIGNATURE DETECTION
• ANOMALY DETECTION
• HYBRID SYSTEM