The document discusses several types of cyber attacks and threats including ARP spoofing, botnets, cache poisoning, computer worms, keyloggers, malware, man-in-the-middle attacks, rootkits, and spoofing attacks. It provides definitions and examples of each threat as well as methods of detection and prevention. ARP spoofing, botnets, and cache poisoning are network-based attacks while keyloggers and rootkits are installed locally. Man-in-the-middle attacks exploit real-time communications. Detection requires antivirus software, monitoring of running processes and startup programs, and analyzing file system logs and network traffic. Comprehensive prevention relies on encryption, firewalls, and avoiding insecure network configurations.

1. Presented by
Avinash.D
SNIST
15315A0430
Information Security
&
Ethical Hacking

2. Overview
APPLICATION -ATTACK –TYPES
 ARP Spoofing
 Botnet
 Cache Poisoning
 Computer Worm
 Keylogger
 Malware
 Man in the Middle Attack
 Rootkit
 Spoofing Attack
 Spyware

3. What is ARP Spoofing ?
ARP spoofing is a type of attack in which a malicious
actor sends falsified ARP (Address Resolution
Protocol) messages over a local area network. This
results in the linking of an attacker’s MAC address
with the IP address of a legitimate computer or server
on the network. Once the attacker’s MAC address is
connected to an authentic IP address, the attacker will
begin receiving any data that is intended for that IP
address. ARP spoofing can enable malicious parties
to intercept, modify or even stop data in-transit. ARP
spoofing attacks can only occur on local area
networks that utilize the Address Resolution Protocol.

4. Types of ARP Spoofing
 Denial-of-service attacks: DoS attacks often
leverage ARP spoofing to link multiple IP
addresses with a single target’s MAC address. As
a result, traffic that is intended for many different
IP addresses will be redirected to the target’s
MAC address, overloading the target with traffic.
 Session hijacking: Session hijacking attacks can
use ARP spoofing to steal session IDs, granting
attackers access to private systems and data.
 Man-in-the-middle attacks: MITM attacks can rely
on ARP spoofing to intercept and modify traffic
between victims.

6. ARP spoofing detection, prevention
and protection
 Packet filtering
 Avoid trust relationships
 Use ARP spoofing detection software
 Use cryptographic network protocols

7. What is a BotNet ?
A botnet is a network of compromised computers
under the control of a malicious actor. Each
individual device in a botnet is referred to as a
bot. A bot is formed when a computer gets
infected with malware that enables third-party
control. Bots are also known as “zombie
computers” due to their ability to operate under
remote direction without their owners’ knowledge.
The attackers that control botnets are referred to
as “bot herders” or “bot masters.”

8. BotNet example
Zeus is a Trojan horse for Windows that was
created to steal bank information using botnets.
First discovered in 2007, Zeus spread through
email, downloads, and online messaging to users
across the globe. Zeus botnets used millions of
zombie computers to execute keystroke logging
and form grabbing attacks that targeted bank
data, account logins, and private user data. The
information gathered by Zeus botnets has been
used in thousands of cases of online identity
theft, credit card theft, and more.

9. Botnet detection detection and
prevention
They can be detected by:
 IRC traffic (botnets and bot masters use IRC for
communications)
 Connection attempts with known C&C servers
 Multiple machines on a network making identical DNS
requests
 High outgoing SMTP traffic (as a result of sending
spam)
 Unexpected popups (as a result of clickfraud activity)
 Slow computing/high CPU usage
 Spikes in traffic, especially Port 6667 (used for IRC),
Port 25 (used in email spamming), and Port 1080
(used by proxy servers)
 Outbound messages (email, social media, instant
messages, etc) that weren’t sent by the user
 Problems with Internet access

10. What is cache poisoning ?
 Cache poisoning is a type of attack in which corrupt
data is inserted into the cache database of the
Domain Name System (DNS) name server. The
Domain Name System is a system that associates
domain names with IP addresses. Devices that
connect to the internet or other private networks rely
on the DNS for resolving URLs, email addresses and
other human-readable domain names into their
corresponding IP addresses. In a DNS cache
poisoning attack, a malicious party sends forged
responses from an imposter DNS in order to reroute a
domain name to a new IP address. This new IP
address is almost always for a server that is
controlled by the attacker. DNS cache poisoning
attacks are often used to spread computer worms and
other malware . More sophisticated uses for DNS
cache poisoning include man-in-the-middle attacks
and denial-of-service attacks.

11. Cache poisoning prevention
In order to further prevent cache poisoning attacks,
IT teams
should configure their DNS name servers to:
 Limit recursive queries.
 Store only data related to the requested domain.
 Restrict query responses to only provide
information about the requested domain.

12. Computer worm
Often called Malicious software
SYMPTOMS:
 Users should be familiar with the symptoms of a computer worm so that
they can quickly recognize infections and begin the process of computer
worm removal. Here are some of the typical symptoms of a computer
worm:
 Slow computer performance
 Freezing/crashing
 Programs opening and running automatically
 Irregular web browser performance
 Unusual computer behavior (messages, images, sounds, etc)
 Firewall warnings
 Missing/modified files
 Appearance of strange/unintended desktop files or icons
 Operating system errors and system error messages
 Emails sent to contacts without the user’s knowledge

13. What is a Keylogger ?
 Keyloggers or keystroke loggers are software
programs or hardware devices that track the
activities (keys pressed) of a keyboard.
Keyloggers are a form of spyware where users
are unaware their actions are being tracked.
Keyloggers can be used for a variety of purposes;
hackers may use them to maliciously gain access
to your private information, while employers might
use them to monitor employee activities. Some
keyloggers can also capture your screen at
random intervals; these are known as screen
recorders. Keylogger software typically stores
your keystrokes in a small file, which is either
accessed later or automatically emailed to the
person monitoring your actions.

15. Functionality: Keylogger
Remote- access software keyloggers can allow access to locally recorded data from
a remote location. This communication can happen by using one of the following
methods:
 Uploading the data to a website, database or FTP server.
 Periodically emailing data to a predefined email address.
 Wirelessly transmitting data through an attached hardware system.
 Software enabling remote login to your local machine.
 Additional features that some software keyloggers come with can capture
additional information without requiring any keyboard key presses as input. They
include:
 Clipboard logging – Anything that can be copied to the clipboard is captured.
 Screen logging – Randomly timed screenshots of your computer screen are
logged.
 Control text capture – The Windows API allows for programs to request the text
value of some controls, meaning that your password may be captured even if
behind a password mask (the asterisks you see when you type your password
into a form).
 Activity tracking – Recording of which folders, programs and windows are
opened and also possibly screenshots of each.
 Recording of search engine queries, instant message conversations, FTP
downloads along with any other internet activities.

16. Detection and removal:
 There are a variety of ways to detect a keylogger, though
none are a catchall, so if you have reason to suspect your
computer has a keylogger, we recommend trying a variety
of these tactics:
 Begin by running your antivirus, which can often detect a
keylogger on your system.
 Run a program like Spybot Search and Destroy or
MalwareBytes to check for certain types.
 Check your task list by pressing ctrl+alt+del in Windows.
Examine the tasks running, and if you are unfamiliar with
any of them, look them up on a search engine.
 Scan your hard disk for the most recent files stored. Look
at the contents of any files that update often, as they might
be logs.
 Use your system configuration utility to view which
programs are loaded at computer start-up. You can access
this list by typing “msconfig” into the run box.

17. What is MITM ?
 Man-in-the-middle is a type of eavesdropping
attack that occurs when a malicious actor inserts
himself as a relay/proxy into a communication
session between people or systems.
 A MITM attack exploits the real-time processing of
transactions, conversations or transfer of other
data.
 Man-in-the-middle attacks allow attackers to
intercept, send and receive data never meant to
be for them without either outside party knowing
until it is too late.

20. What is a Rootkit ?
 A rootkit is a clandestine computer program designed
to provide continued privileged access to a computer
while actively hiding its presence. The term rootkit is a
connection of the two words "root" and "kit." Originally,
a rootkit was a collection of tools that enabled
administrator-level access to a computer or network.
Root refers to the Admin account on Unix and Linux
systems, and kit refers to the software components
that implement the tool. Today rootkits are generally
associated with malware – such as Trojans, worms,
viruses – that conceal their existence and actions
from users and other system processes.

21. Functionality and Detection
What Can a Rootkit Do?
 A rootkit allows someone to maintain command and control
over a computer without the computer user/owner knowing
about it. Once a rootkit has been installed, the controller of
the rootkit has the ability to remotely execute files and
change system configurations on the host machine. A
rootkit on an infected computer can also access log files
and spy on the legitimate computer owner’s usage.
Rootkit Detection
 It is difficult to detect rootkits. There are no commercial
products available that can find and remove all known and
unknown rootkits. There are various ways to look for a
rootkit on an infected machine. Detection methods include
behavioral-based methods (e.g., looking for strange
behavior on a computer system), signature scanning and
memory dump analysis. Often, the only option to remove a
rootkit is to completely rebuild the compromised system.

22. Well-known Rootkit examples
 Lane Davis and Steven Dake - wrote the earliest known rootkit in
the early 1990s.
 NTRootkit – one of the first malicious rootkits targeted at
Windows OS.
 HackerDefender – this early Trojan altered/augmented the OS at
a very low level of functions calls.
 Machiavelli - the first rootkit targeting Mac OS X appeared in
2009. This rootkit creates hidden system calls and kernel
threads.
 Greek wiretapping – in 2004/05, intruders installed a rootkit that
targeted Ericsson's AXE PBX.
 Zeus, first identified in July 2007, is a Trojan horse that steals
banking information by man-in-the-browser keystroke logging
and form grabbing.
 Stuxnet - the first known rootkit for industrial control systems
 Flame - a computer malware discovered in 2012 that attacks
computers running Windows OS. It can record audio,
screenshots, keyboard activity and network traffic.

23. Spyware
 Spyware is any software that installs itself on your
computer and starts covertly monitoring your
online behavior without your knowledge or
permission. Spyware is a kind of malware that
secretly gathers information about a person or
organization and relays this data to other parties.
In some cases, these may be advertisers or
marketing data firms, which is why spyware is
sometimes referred to as “adware.” It is installed
without user consent by methods such as a drive-
by download, a trojan included with a legitimate
program or a deceptive pop-up window

24. Signs of spyware
 Signs of a spyware infection can include
unwanted behaviors and degradation of system
performance. It can eat up CPU capacity, disk
usage and network traffic. Stability issues such as
applications freezing, failure to boot, difficulty
connecting to the internet and system crashes
are also common.