Week 12

1. Lecture 12
Information
Security

2. Today’s lecture outline

3. Basic terminology1
Security jargon
Vulnerability, threat,
attack;
Hacker, cracker;
Black hats versus White
hats

4. Information Security Basics

5. Malware2
The software that is
written for malicious
purposesViruses
Trojan Horses
Spyware
Keyloggers

6. Reproduced with permission. Please visit www.SecurityCartoon.com for more material

7. Brain Virus (Pakistani Flu)
1986
Credit: http://en.wikipedia.org/wiki/Brain_(computer_virus)
The first computer virus

8. Key-loggers and Spyware

9. Spoofing Attacks3
where the attacker
impersonates some one
elseEmail spoofing
URL spoofing
DNS spoofing
IP spoofing
MAC spoofing

10. Email Spoofing (phishing)3.a

14. URL Spoofing (phishing)3.b

15. Genuine URL;
Site: niit.edu.pk;
directory: src;
file: login.php
https://webmail.niit.edu.pk/src/login.php1

16. https://webmail.niit.org.pk/src/login.php
Victim.ID
**************
The second-level
domain is .org and not
.edu; faked website
https://webmail.niit.org.pk/src/login.php
2

17. https://webmail.niit.edu.tk/src/login.php
3
The first-level domain
is .tk and not .pk;
faked website
https://webmail.niit.edu.tk/src/login.php
Victim.ID
**************

18. https://202.125.111.57/src/login.php
The IP address does
not correspond to
webmail.niit.edu.pk;
faked website
https://202.128.111.87/src/login.php
4
Victim.ID
**************

19. DNS Spoofing3.c
IP Spoofing3.d
MAC Spoofing3.e

20. DNS spoofing
W
W
W
Tell me the IP address
of www.niit.edu.pk?
W
W
W
DNS
Request

21. W
W
W
Reply
The IP address of
www.niit.edu.pk is
110.125.157.198
DNS spoofing
W
W
W
DNS
The IP address of
www.niit.edu.pk is
110.125.157.198 Fake NIIT site

22. Private
network
192.168.1.0/24
MAC/ IP spoofing
.254
00:aa:bb:cc:dd:ee:ff
.1
.254
00:aa:bb:cc:dd:ee:ff
Malicious
node
The malicious node can
pretend to be another node

23. Network-based attacks4
where the attacker pretends to be
something he/she/it is not
Worms
Denial of Service attacks

24. Denial of Service attacks

25. Social Engineering5
Targets the weakest component of
a security system---the users

26. Non-technical hacking

27. Greeting card phishing

28. Lottery winning phishing

29. How to protect against
security attacks?
6

30. Use an Internet Firewall

31. Apply the latest updates

32. Use up-to-date Anti-virus

33. Opening trusted files only

34. Protecting against spyware

35. Passwords and locking
systems when unused

36. Backing up data

37. Security protection---Recall

38. Conclusions

39. http://tinyurl.com/5hb8pp