Chapter 6 Computer Fraud and Abuse Techniques Copyright

Learning Objectives Compare and contrast computer attack and abuse tactics. Explain how social engineering techniques are used to gain physical or logical access to computer resources. Describe the different types of malware used to harm computers. Copyright © 2012 Pearson Education 6 -2

Computer Attacks and Abuse Hacking Unauthorized access, modification, or use of a computer system or other electronic device Social Engineering Techniques, usually psychological tricks, to gain access to sensitive data or information Used to gain access to secure systems or locations Malware Any software which can be used to do harm Copyright © 2012 Pearson Education 6 -3

Types of Computer Attacks Botnet—Robot Network of hijacked computers Hijacked computers carry out processes without users knowledge Zombie—hijacked computer Denial-of-Service (Do. S) Attack Constant stream of requests made to a Web-server (usually via a Botnet) that overwhelms and shuts down service Spoofing Making an electronic communication look as if it comes from a trusted official source to lure the recipient into providing information Copyright © 2012 Pearson Education 6 -4

Types of Spoofing E-mail sender appears as if it comes from a different source Caller-ID Incorrect number is displayed IP address Forged IP address to conceal identity of sender of data over the Internet or to impersonate another computer system SMS Incorrect number or name appears, similar to caller-ID but for text messaging Web page Phishing (see below) DNS Intercepting a request for a Web service and sending the request to a false service Address Resolution Protocol (ARP) Allows a computer on a LAN to intercept traffic meant for any other computer on the LAN Copyright © 2012 Pearson Education 6 -5

Hacking Attacks Cross-Site Scripting (XSS) Unwanted code is sent via dynamic Web pages disguised as user input. Buffer Overflow Data is sent that exceeds computer capacity causing program instructions to be lost and replaced with attacker instructions. SQL Injection (Insertion) Malicious code is inserted in the place of query to a database system. Man-in-the-Middle Hacker places themselves between client and host. Copyright © 2012 Pearson Education 6 -6

Additional Hacking Attacks Password Cracking Penetrating system security to steal passwords War Dialing Computer automatically dials phone numbers looking for modems. Phreaking Attacks on phone systems to obtain free phone service. Data Diddling Making changes to data before, during, or after it is entered into a system. Data Leakage Unauthorized copying of company data. Copyright © 2012 Pearson Education 6 -7

Hacking Embezzlement Schemes Salami Technique Taking small amounts from many different accounts. Economic Espionage Theft of information, trade secrets, and intellectual property. Cyber-Bullying Internet, cell phones, or other communication technologies to support deliberate, repeated, and hostile behavior that torments, threatens, harasses, humiliates, embarrasses, or otherwise harms another person. Internet Terrorism Act of disrupting electronic commerce and harming computers and communications. Internet Misinformation Copyright © 2012 Pearson Education 6 -8

Hacking for Fraud Internet Misinformation Using the Internet to spread false or misleading information Internet Auction Using an Internet auction site to defraud another person Unfairly drive up bidding Seller delivers inferior merchandise or fails to deliver at all Buyer fails to make payment Internet Pump-and-Dump Using the Internet to pump up the price of a stock and then selling it Copyright © 2012 Pearson Education 6 -9

Social Engineering Techniques Identity Theft Assuming someone else’s identity Pretexting Inventing a scenario that will lull someone into divulging sensitive information Posing Using a fake business to acquire sensitive information Phishing Posing as a legitimate company asking for verification type information: passwords, accounts, usernames Typesquatting Typographical errors when entering a Web site name cause an invalid site to be accessed Tabnapping Changing an already open browser tab Scavenging Looking for sensitive information in items thrown away Shoulder Surfing Snooping over someone’s shoulder for sensitive information Pharming Redirecting Web site traffic to a spoofed Web site. Copyright © 2012 Pearson Education 6 -10

More Social Engineering Lebanese Loping Capturing ATM pin and card numbers Skimming Double-swiping a credit card Chipping Planting a device to read credit card information in a credit card reader Eavesdropping Listening to private communications Copyright © 2012 Pearson Education 6 -11

Type of Malware Spyware Secretly monitors and collects personal information about users and sends it to someone else Adware Pops banner ads on a monitor, collects information about the user’s Websurfing, and spending habits, and forward it to the adware creator Key logging Records computer activity, such as a user’s keystrokes, e-mails sent and received, Web sites visited, and chat session participation Trojan Horse Malicious computer instructions in an authorized and otherwise properly functioning program Time bombs/logic bombs Idle until triggered by a specified date or time, by a change in the system, by a message sent to the system, or by an event that does not occur Copyright © 2012 Pearson Education 6 -12

More Malware Trap Door/Back Door A way into a system that bypasses normal authorization and authentication controls Packet Sniffers Capture data from information packets as they travel over networks Rootkit Used to hide the presence of trap doors, sniffers, and key loggers; conceal software that originates a denial-of-service or an e-mail spam attack; and access user names and log-in information Superzapping Unauthorized use of special system programs to bypass regular system controls and perform illegal acts, all without leaving an audit trail Copyright © 2012 Pearson Education 6 -13