Lifecycle Of An Attack 58576s

Lifecycle of an attack -Apoorva Srinivasan

Lifecycle of an attack •  Probing •  Penetrate •  Persists •  Propagate •  Paralyze

Probing Attacker first explores the target, and looks for the vulnerability in the system. The common methods for doing this are -

  Scanning ports/IP and checking for open ports . Tools used are nmap

  Guess s and s Guessing some common s that are created for some special purposes.

  Run traceroute print the route packets take to network host

  Exploiting the bugs/loopholes of the target s/w

Penetrate

Penetrate

An attempt to get into the target system by exploiting the vulnerabilities found. The methods used are

  Buffer overflows: to overflow the system stack/heap to either crash the (DoS) or to get control of the execution

  Email attachments: Sending an executable via attachment.   Back Door and Trojans: Backdoors are unauthorized or a secret entry that sures all kind of security

  Java applets & Active X controls: Accessing full

windows system information via Active X control. Can be developed in any language.

  Brute Force attacks: Trying all combinations of s to .

Persist Makes changes into the target system to Weaken the existing security settings or by install new services by -

  Creating or modifying files   weaken Registry strings   install new services   Trap doors…

Propagating The virus can then be transferred to another communicating machines in many ways

  Email : eg automatically forward the virus to all the s in the address book.

  Internet connections   FTP   infected file shares

Paralyzing Since now the attacker has access to the target system, the final stage depends upon the attacker and what damages he wants to do. Some things may include

  Reading or corrupting confidential data   Formatting the disk   Crashing the system   Remove all the security

References   http://shrenikp.webs.com/apps/blog/show/ 4187107-life-cycle-of-an-attack

•  http://www.indiastand.com/wp-content/s/ 2010/04/crim.gif

Images

•  Using Management Center for Cisco Security Agents 6.0.1

•  http://searchsecurity.techtarget.com/definition/

Thank you