Below is a list of few attacks which can be harmful to a network or a webserver:
- XSS : Cross Site Scripting.
- Dos: Denial Of Service, DDos: Distributed Denial Of Services.
- SQL Injection.
- CRSF: Cross Site Request Forgery.
- FTP Bounce Attack.
- Smurf Attack.
- SYN Flooding Attack.
- IPFragmentation/Overlapping Fragment Attack.
- IPSequence Prediction Attack.
- SNMP Attack.
- Send Mail Attack.
--more--
- Eavesdropping. -
- Data Modification.
- Identity Spoofing (IP Address Spoofing).
- Password-Based Attacks.
- Man-in-the-Middle Attack.
- Compromised-Key Attack.
- Sniffer Attack.
- Application-Layer Attack.
For detailed information on above attacks please visit: technet.microsoft
---------------------------------------------------------------------------------------------------------------- 1.XSS - Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which enable malicious attackers to inject client-side script into web pages viewed by other users. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy. Cross-site scripting carried out on websites were roughly 80% of all security vulnerabilities documented by Symantec as of 2007. Their impact may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site, and the nature of any security mitigations implemented by site owner. [ Source: Wikipedia ]
2.Dos,DDos - A denial-of-service attack (Dos attack) or distributed denial-of-service attack (DDos attack) is and attempt to make a computer resource unavailable to its intended users. Although the means to carry out, motives for, and targets of Dos attack may vary, it generally consists of the concerted efforts of a person or people to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely. Perpetrators of Dos attacks typically target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even root nameservers.
[ Source: Wikipedia ]
3.SQL injection - SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application (like queries). The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It happens from using poorly designed query language interpreters. [ Source: Wikipedia ]
4.CRSF - Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF (pronounced sea-surf[1]) or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser. [ Source: Wikipedia ]
5.FTP Bounce attack - FTP bounce attack is an exploit of the FTP protocol whereby an attacker is able to use the PORT command to request access to ports indirectly through the use of the victim machine as a middle man for the request.This technique can be used to port scan hosts discreetly, and to access specific ports that the attacker cannot access through a direct connection.nmap is a port scanner that can utilize an FTP bounce attack to scan other servers.Nearly all modern FTP server programs are configured by default to refuse PORT commands that would connect to any host but the originating host, thwarting FTP bounce attacks. [ Source: Wikipedia ]
6.Smurf attack - The Smurf attack is a way of generating significant computer network traffic on a victim network. This is a type of denial-of-service attack that floods a target system via spoofed broadcast ping messages.This attack relies on a perpetrator sending a large amount of ICMP echo request (ping) traffic to IP broadcast addresses, all of which have a spoofed source IP address of the intended victim. If the routing device delivering traffic to those broadcast addresses delivers the IP broadcast to all hosts (for example via a layer 2 broadcast), most hosts on that IP network will take the ICMP echo request and reply to it with an echo reply, multiplying the traffic by the number of hosts responding. On a multi-access broadcast network, hundreds of machines might reply to each packet. [ Source: Wikipedia ]
7.SYN Flooding technique - A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.
Techniqal Details → Normally when a client attempts to start a TCP connection to a server, the client and server exchange a series of messages which normally runs like this:The client requests a connection by sending a SYN (synchronize) message to the server.The server acknowledges this request by sending SYN-ACK back to the client.The client responds with an ACK, and the connection is established.This is called the TCP three-way handshake, and is the foundation for every connection established using the TCP protocol.A SYN flood attack works by not responding to the server with the expected ACK code. The malicious client can either simply not send the expected ACK, or by spoofing the source IP address in the SYN, cause the server to send the SYN-ACK to a falsified IP address - which will not send an ACK because it "knows" that it never sent a SYN.The server will wait for the acknowledgement for some time, as simple network congestion could also be the cause of the missing ACK, but in an attack increasingly large numbers of half-open connections will bind resources on the server until no new connections can be made, resulting in a denial of service to legitimate traffic. Some systems may also malfunction badly or even crash if other operating system functions are starved of resources in this way. [ Source: Wikipedia ]
8.IP Fragmentation/Overlapping Fragment Attack - IP fragmentation is the process of breaking up a single Internet Protocol (IP) datagram into multiple packets of smaller size. Every network link has a characteristic size of messages that may be transmitted, called the maximum transmission unit (MTU).Part of the TCP/IP suite is the Internet Protocol (IP) which resides at the Internet Layer of this model. IP is responsible for the transmission of packets between network end points. IP includes some features which provide basic measures of fault-tolerance (time to live, checksum), traffic prioritization (type of service) and support for the fragmentation of larger packets into multiple smaller packets (ID filed, fragment offset). The support for fragmentation of larger packets provides a protocol allowing routers to fragment a packet into smaller packets when the original packet is too large for the supporting datalink frames. IP fragmentation exploits (attacks) use the fragmentation protocol within IP as an attack vector. [ Source: Wikipedia ]
9.IPSequence Prediction Attack - A TCP sequence prediction attack is an attempt to predict the sequence number used to identify the packets in a TCP connection, which can be used to counterfeit packets.[1]The attacker hopes to correctly guess the sequence number to be used by the sending host. If they can do this, they will be able to send counterfeit packets to the receiving host which will seem to originate from the sending host, even though the counterfeit packets may in fact originate from some third host controlled by the attacker. One possible way for this to occur is for the attacker to listen to the conversation occurring between the trusted hosts, and then to issue packets using the same source IP address. By monitoring the traffic before an attack is mounted, the malicious host can figure out the correct sequence number. After the IP address and the correct sequence number are known, it is basically a race between the attacker and the trusted host to get the correct packet sent. One common way for the attacker to send it first is to launch another attack on the trusted host, such as a Denial-of-Service attack. Once the attacker has control over the connection, it is able to send counterfeit packets without getting a response. [ Source: Wikipedia ]
For more information on CRSF, FTP Bounce Attack, Smurf Attack, SYN Flooding Attack, IPFragmentation, IPSequence Prediction Attack, SNMP Attack and SendMail Attack Please visit the following link: techiwarehouse
---------------------------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------------------------
Computer Worms -:
1.Conficker - Conficker, also known as Downup, Downadup and Kido, is a computer worm targeting the Microsoft Windows operating system that was first detected in November 2008.[1] It uses flaws in Windows software to co-opt machines and link them into a virtual computer that can be commanded remotely by its authors. Conficker has more than seven million computers now under its control—government, business and home computers in more than 200 countries, according to the New York Times. [ Source: Wikipedia ]
Know more about conficker at: microsoft.com
Detect whether your computer is infected by Conficker worm by visiting: Check Conficker Worm.
If your computer is infected by the Conficker worm you may wish to remove it by visiting » BitDefender. ----------------------------------------------------------------------------------------------------------------
Many more known worms are:
1. Badtrans - Installs a keylogger; distributes logged information
2. Bagle
3. Blaster - Targeted to Bill Gates; contained message "billy gates why do you make this possible ? Stop making money and fix your software!!"
4. Brontok - Spread through an Indonesian e-mail headed with "stop the collapse in this country"; destroys firewalls
5. Code Red - Defaced websites with "Hacked by Chinese!"
6. Code Red II - Exploited Microsoft Internet Information Server security holes.
7. Dabber
8. Doomjuice -Attacks computers which have previously been infected by the Mydoom worm.
9. ExploreZip -Spread through zipped documents in a spam e-mail.
10. Father Christmas
11. HybrisSpreads through an e-mail from "haha@sexyfun.net"
12. Hydra
13. Kak worm - Restarts the computer after 5pm, the first day of each month with the following message displayed: "Driver Memory Error - Kagou-Anti-Kro$oft says not today !"
14. Klez
15. Mabutu
16. Melissa -Not originally intended as harmful, but crashed servers by flooding them with e-mail
17. Morris
18. Mydoom -Fastest-spreading e-mail worm known; used to attack SCO Group.
19. Mylife
20. Netsky
21. Nimda -Suspected to be connected to Al Qaeda because of release date; uses multiple infection vectors
22. Sadmind
23. Sasser
24. Sircam - Spread through e-mail with text like "I send you this file in order to have your advice."
25. Sober - Was disguised as e-mail from United States government.
26. Sobig - Also a Trojan horse because it appeared to be a non-malware program.
27. SQL Slammer -Caused global Internet slowdown
28. Swen
29. Supernova worm
30. Upering
31. W32/Bolgimo.worm, W32/Fus.worm, W32/IRCbot.worm! -
32. WANK -Spread a pacifist, anti-nuclear political message
33. Welchia - A helpful worm meant to install security patches.
34. Witty -Appeared very rapidly after announcement of Internet Security Systems vulnerability
35. Zotob
----------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------
Top 7 Most Dangerous Computer Viruses of the 20th Century:
1. ILOVEYOU - 2000 - Considered to be one of the most dangerous computer worms in history, ILOVEYOU was for the first time detected in Philippines on May 4. In just one day it spread worldwide, with about 10 percent of all Internet users being affected by the worm. ILOVEYOU also caused $5.5 billion damage. Its name comes from the subject of the email that a user received. The email included an attachment that said "LOVE-LETTER-FOR-YOU.TXT.vbs". When activated, the computer worm overwrote all files on the host, attacking a copy of itself to each file. In addition, the worm sent a copy of itself to everyone in a user's contact list.
----------------------------------------------------------------------------------------------------------------
2. Melissa - 1999 - This computer virus managed to cause a damaged estimated between $300 and $600 million. The famous computer virus gained huge fame on March 26, 1999. Experts claimed that this computer virus managed to infect between 15 and 20 percent of all business PCs on the planet. Melissa virus spread so fast that a number of big companies, including Intel and Microsoft, that used Outlook, had to shut down their email systems to hold up the damage. The computer virus took advantage of Microsoft outlook to send email messages of itself to 50 names on the contact list of a user. The message in the email read: "Here is that document you asked for don’t show anyone else." It featured an attached Word document, which, when opened, unleashed the virus that infected the computer and then repeated the replication. When the virus was activated it changed Word documents by leaving quotes from the popular animated show "The Simpsons".
----------------------------------------------------------------------------------------------------------------
3. CIH (a.k.a. Chernobyl) - 1998 - Our list of the most dangerous computer viruses on the 20th century continues with CIH virus that caused an estimated damage of $20 to $80 million around the globe. After its launch, the computer virus managed to affect huge amounts of data stored on computers. Later it was discovered that the computer virus was launched in Taiwan. It has been recognized to be one of the most dangerous computer viruses in history. It infected Windows 95, 98, and ME executable files. In addition, CIH remained resident in the memory of the machine, being able to carry on infecting other executables. After being activated, the virus overwrote data on the HDD of the infected PC, making the latter inoperable. CIH could also overwrite the BIOS of the infected computer, thus preventing boot-up. The second name of the virus - Chernobyl - was given because some of the biggest damages occurred on the day when the nuclear reactor exploded.
----------------------------------------------------------------------------------------------------------------
4. Solar Sunrise - 1998 - This is not the name of the computer virus, it is the name of the situation that occurred in 1998 when a team of hackers managed to take control of more than 500 computer system of the army, government as well as private sector of the United States. The name Solar Sunrise comes after the well-known vulnerabilities in machines that run on the Sun Solaris OS. At first the attack was believed to have been organized by hackers from Iraq, but later it was discovered that the ones to blame were two American youngsters from California.
----------------------------------------------------------------------------------------------------------------
5. Barrotes - 1993 - This is believed to be the first popular computer virus developed in Spain. As soon as it infected the system, it would remain there until January the 5th, when it would set off showing a series of bars on the screen. It infected .COM, .EXE and overlay files. The Barrotes computer virus represents a resident virus - it becomes a resident of the computer memory each time the machine starts up. Due to a series of vertical lines that appear on the monitor, it was easy to identify the virus. It could also overwrite the Master Boot Record of the HDD, thus making it impossible for the uses to access the hard disk.
----------------------------------------------------------------------------------------------------------------
6. Morris (a.k.a. Internet Worm) - 1988 - Previously at www.InfoNIAC.com we wrote about this computer worm, which is believed to be one of the first worms that spread over the Internet. The name of the virus comes from its developer Robert Tappan Morris, who was a student at Cornell University. The computer worm was set off on November 2, 1988 and after some time it managed to infect 6,000 to 9,000 machines. It overloaded the whole Internet, leading to the failure of a large number of servers. According to its developer, the goal was to discover just how far and fast a computer worm can spread all over the network. Robert Tappan Morris was found guilty and sentenced to 3 years of probation along with 400 hours of community service. In addition, he had to pay a $10,000 fine.
----------------------------------------------------------------------------------------------------------------
7. Jerusalem - 1987 - For the first time it was discovered in 1987 on October 1. The virus was dubbed Jerusalem because it was identified in a Hebrew university, but in 1991 antivirus experts found that Italy is the country were the first traces of the computer virus were noticed. Jerusalem is believed to be one of the oldest computer viruses in history, being able to infect both .EXE and .COM files. Initially the Jerusalem virus included a bug that led to a repeat infection of the files that continued until the size of the files overcome computer resources. In addition, each Friday 13 it deleted all programs in the infected system as a result of a malicious payload that set off on the respective day. Jerusalem considerably slowed down the machine. A person could identify the virus but noticing two lines on the monitor.
----------------------------------------------------------------------------------------------------------------
