Presenter: Komal Mehfooz

1. GROUP MEMBERS
Names:
Komal Mehfooz
Rafia Khalid
Hazeema Mateen
Iqra Sohail

3.  The state of being free from danger or threat.
 The system is designed to provide maximum security against toxic
spills.
Or another definition is:
In the context of computer science, security is the prevention of, or
protection against, access to information by unauthorized recipients,
and. intentional but unauthorized destruction or alteration of that
information.

4.  Security violations (or misuse) of the system can be
categorized as intentional (malicious) or accidental.
 It is easier to protect against accidental misuse than
against malicious misuse. For the most part, protection
mechanisms are the core of protection from accidents.
Note: In discussion of security , we use the terms intruder
and cracker for those attempting to breach security.
 A threat is the potential for a security violation, such as
the discovery of a vulnerability, whereas an attack is the
attempt to break security.

5. Breach of
confidentiality:
This type of violation involves unauthorized reading of data (or
theft of information). Typically, a breach of confidentiality is the
goal of an intruder. Capturing secret data from a system or a
data stream, such as credit-card information or identity
information for identity theft, can result directly in money for the
intruder.

6. Breach of integrity:
This violation involves unauthorized modification of data. Such attacks can, for
example, result in passing of liability to an innocent party or modification of the source
code of an important commercial application.
Breach of availability:
This violation involves unauthorized destruction of data. Some crackers would rather
wreak havoc and gain status or bragging rights than gain financially. Web-site
defacement is a common example of this type of security breach.
Theft of service:
This violation involves unauthorized use of resources.
For example, an intruder (or intrusion program) may install a daemon on
a system that acts as a file server.

7. Denial of service: (DOS)
This violation involves preventing legitimate use of the system. Denial-of-service,
or DOS , attacks are sometimes accidental. The original Internet worm
turned into a DOS attack when a bug failed to delay its rapid spread.
 Attackers use several standard methods in their attempts to breach security.
The most common is masquerading, in which one participant in a
communication pretends to be someone else (another host or another
person).
 By masquerading, attackers breach authentication, the correctness of
identification; they can then gain access that they would not normally be
allowed or escalate their privileges—obtain privileges to which they would not
normally be entitled. Another common attack is to replay a captured
exchange of data.
 A replay attack consists of the malicious or fraudulent repeat of a valid data
transmission. Sometimes the replay comprises the entire attack—for example,
in a repeat of a request to transfer money. But frequently it is done along
with message modification, again to escalate privileges.

9. To protect a system, we must take security measures at
 Physical:
four levels:
The site or sites containing the computer systems must be physically
secured against armed or surreptitious entry by intruders. Both the machine rooms
and the terminals or workstations that have access to the machines must be
secured.
 Human:
Authorization must be done carefully to assure that only appropriate
users have access to the system. Even authorized users, however, may be
“encouraged” to let others use their access (in exchange for a bribe, for example).
They may also be tricked into allowing access via social engineering. One type of
social- engineering attack is phishing.

10.  Operating system:
The system must protect itself from
accidental or purposeful security breaches. A runaway process
could constitute an accidental denial-of-service attack. A query
to a service could reveal passwords. A stack overflow could
allow the launching of an unauthorized process. The list of
possible breaches is almost endless.
 Network:
Much computer data in modern systems travels
over private Leased lines, shared lines like the Internet , wireless
connections , or dial-up lines. Intercepting these data could be
just as harmful as breaking into a Computer ; and interruption of
communications could constitute a remote denial-of service
attack, diminishing users use of and trust in the system.

11.  In computer security a threat is a possible danger
that might exploit a vulnerability to breach security
and thus cause possible harm.
 A threat can be either "intentional" (i.e., intelligent;
e.g., an individual cracker or a criminal organization)
or "accidental" (e.g., the possibility of a computer
malfunctioning, or the possibility of a natural disaster
such as an earthquake, a fire, or a tornado) or
otherwise a circumstance, capability, action, or
event.

12. What is Malware ?
Malware is a malicious software. This software include the program
that exploit the vulnerabilities in computing system. The purpose of
malicious software is harm you or steal the information from you.

13. Types of Threats:
 In computing, a Trojan horse is a program
which purports to do some benign task, but
secretly performs some additional malicious
task. A classic example is a password-grabbing
login program which prints
authentic-looking "username“ and
"password" prompts, and waits for a
user to type in the information.
 When this happens, the password grabber
stashes the information away for its creator,
then prints out an "invalid password"
message before running the real login
program. The unsuspecting user thinks they
made a typing mistake and reenters the
information, none the wiser.
TROJAN HORSE

14. Spyware is software which collects information
from a computer and transmits it to someone
else. The exact information spyware gathers may
vary, but can include anything which potentially
has value:
Different Ways:
1. Usernames and passwords. These might be
harvested from files on the machine, or by
recording what the user types using a key
logger. A key logger differs from a Trojan
horse in that a key logger passively
captures key strokes only; no active
deception is involved.
2. Email addresses, which would have value
to a spammer.
3. Bank account and credit card numbers.
4. Software license keys, to facilitate software
pirating.

15. The oldest type of malicious software. This program is
embedded with some other program. When certain
condition meets, the logic bomb will destroy your pc.
 It also crash at particular date which is
fixed by attacker. It will be included in
legitimate or authorized person like this:
legitimate code
if date is Friday the 13th: crash_computer legitimate code
E.g.:
if some antivirus trying to delete or
clean the logic bomb. The logic bomb will
destroy the pc.

17. One special kind of
back door is a RAT,
which stands for Remote
Administration
Tool or Remote Access Trojan,
depending on who's
asked. These
programs allow a
computer to be
monitored and
controlled remotely;
username = read_username()
password = read_password()
if tisername i s "133t h4ck0r": return ALLOW^LOGIN
if username and password are valid:
return ALLOW_LOGIN
e l s e:
return DENY^LOGIN

18. A virus is malware that, when executed, tries to replicate itself into
other executable code; when it succeeds, the code is said to be
infected. The infected code, when run, can infect new code in turn.
This self-replication into existing executable code is the key defining
characteristic of a virus.
Types of Viruses:
1. Parasitic virus:
Traditional and common virus. This will be attached with EXE files
and search for other EXE file to infect them.
2. Memory Resident Virus:
Present in your system memory as a system program. From here
onwards it will infects all program that executes.
3. Boot Sector Virus:
Infects the boot record and spread when the system is booted
from
the disk containing the virus.
4. Stealth Virus:
This virus hides itself from detection of antivirus scanning.

19. A worm shares several characteristics
with a Virus.
 The most important characteristic is
that worms are self-replicating too,
but self-replication of a worm is
distinct in two ways. First, worms
are standalone, and do not rely on
other executable code. Second,
worms spread from machine to
machine across networks.

20.  The stack- or buffer-overflow attack is the most common way for
an attacker outside the system, on a network or dial-up
connection, to gain unauthorized access to the target system. An
authorized user of the system may also use this exploit for privilege
escalation.
 Essentially, the attack exploits a bug in a program. The
bug can be a simple case of poor programming , in
which the programmer neglected to code bounds
checking on an input field. In this case, the attacker sends
more data than the program was expecting. By using trial and
error, or by examining the source code of the attacked program
if it is available, the attacker determines the vulnerability and
writes a program to do the following:

21. Three Steps:
 1. Overflow an input field, command-line
argument, or input buffer—for example, on a
network daemon—until it writes into the stack.
 2. Overwrite the current return address on the
stack with the address of the exploit code
loaded in step 3.
 3. Write a simple set of code for the next
space in the stack that includes the
commands that the attacker wishes to
execute—for instance, spawn a shell.

22. Note: that a
careful
programmer
could have
performed
bounds checking
on the sizeof
argv[1] by using
the strncpy()
function rather
than strcpy(),
replacing the line
“ strcpy(buffer,
argv[1]); ” with “
strncpy(buffer,
argv[1],
sizeof(buffer)-1);
”. Unfortunately,
good bounds
checking is
the exception
rather than the
norm.
#include < stdio.h >
#define BUFFER SIZE 256
int main(int argc, char *argv[])
{
char buffer[BUFFER SIZE];
if (argc < 2) return -1;
else {
strcpy(buffer,argv[1]);
return 0;
} }
Example: C program with buffer-overflow
condition.

24. Code Segment:
 A cracker could execute a buffer-overflow attack. Her goal is to replace
the return address in the stack frame so that it now points to the code
segment containing the attacking program.
 The programmer first writes a short code segment such as the following:
#include <stdio.h>
int main(int argc, char *argv[])
{
execvp(‘‘ bin sh’’,‘‘ bin sh’’, NULL);
return 0;
}
Using the execvp() system call, this code segment creates a shell process.

25. THANK YOU