Virus 1062020 1 Memoryresident virus Runs whenever certain

  • Slides: 22
Download presentation
Virus 10/6/2020 1

Virus 10/6/2020 1

Memory-resident virus Runs whenever certain interrupts occur. 10/6/2020 2

Memory-resident virus Runs whenever certain interrupts occur. 10/6/2020 2

Encrypted virus To conceal signature. 10/6/2020 3

Encrypted virus To conceal signature. 10/6/2020 3

Unix address space Low address Program Statically allocated data Stack High address 10/6/2020 4

Unix address space Low address Program Statically allocated data Stack High address 10/6/2020 4

Procedure call E. g. , finger aabbcc [PC] aa bb cc ret para 2

Procedure call E. g. , finger aabbcc [PC] aa bb cc ret para 2 para 1 Stack 10/6/2020 Buffer area allocated by called fingerd (512 bytes) Return address High address 5

Buffer overflow E. g. , finger aabb…zz zz [PC] aa bb cc … …

Buffer overflow E. g. , finger aabb…zz zz [PC] aa bb cc … … zz para 2 para 1 Malicious program (binary) Return address Stack 10/6/2020 6

Epidemic rsh attack Bootstrap finger attack sendmail attack Worm proper Upload request Worm proper

Epidemic rsh attack Bootstrap finger attack sendmail attack Worm proper Upload request Worm proper New victim 10/6/2020 Infested machine 7

Firewall location Intranet Internet Intranet -Packet filter and/or - Application gateway 10/6/2020 8

Firewall location Intranet Internet Intranet -Packet filter and/or - Application gateway 10/6/2020 8

Typical configurations DMZ 10/6/2020 9

Typical configurations DMZ 10/6/2020 9

(a) Filtering router Mail server (port=25) Filtering router Internet Intranet 10/6/2020 10

(a) Filtering router Mail server (port=25) Filtering router Internet Intranet 10/6/2020 10

Filtering router implementation Action Our host Port Their host Port Block * * SPIGOT

Filtering router implementation Action Our host Port Their host Port Block * * SPIGOT * Allow Our-Mail. Serv 25 * * Allow Our-Web. Serv 80 * * 10/6/2020 11

(b) Filtering router and Bastion host Internet Protected Intranet Router only permits traffic to/from

(b) Filtering router and Bastion host Internet Protected Intranet Router only permits traffic to/from bastion host 10/6/2020 12

(c) Demilitarized Zone (DMZ) Modem access Bastion host inside router Protected intranet Internet outside

(c) Demilitarized Zone (DMZ) Modem access Bastion host inside router Protected intranet Internet outside router Web server DMZ 10/6/2020 13

HTTP proxy 10/6/2020 14

HTTP proxy 10/6/2020 14

Local HTTP proxy Proxy Server Internet (B) HTTP (A) Proxy HTTP www. company. com:

Local HTTP proxy Proxy Server Internet (B) HTTP (A) Proxy HTTP www. company. com: 80 Client (A) is configured to use proxy HTTP via (B) Sends GET page. html to http: //www. company. com/ on behalf of (A). 10/6/2020 15

RMI thru firewall HTTP server Internet client_stub RMI server port POST “data” to www.

RMI thru firewall HTTP server Internet client_stub RMI server port POST “data” to www. company. com: 80/cgi-bin/ java-rmi. cgi? forward=<rmi. Server. Port> 10/6/2020 16

Private network 10/6/2020 17

Private network 10/6/2020 17

Hybrid network 10/6/2020 18

Hybrid network 10/6/2020 18

Virtual private network 10/6/2020 19

Virtual private network 10/6/2020 19

Addressing in a VPN 10/6/2020 20

Addressing in a VPN 10/6/2020 20

Tunneling 10/6/2020 21

Tunneling 10/6/2020 21

Virtual Private Network (VPN) Intranet A Internet Intranet B Tunneling Router RA Router RB

Virtual Private Network (VPN) Intranet A Internet Intranet B Tunneling Router RA Router RB RB 200 Station 100 10/6/2020 Data encrypted Station 200 22

WMO 1 1062020 1 1 WMO 1062020 2WMO 1 1062020 1 1 WMO 1062020 2
Whenever the weather is cold Whenever the weatherWhenever the weather is cold Whenever the weather
Whenever the weather is cold Whenever the weatherWhenever the weather is cold Whenever the weather
OUR MOTTO Whenever the weather is cold WheneverOUR MOTTO Whenever the weather is cold Whenever
VIRUS Pengertian virus Replikasi virus Siklus Virus backVIRUS Pengertian virus Replikasi virus Siklus Virus back
Checkpointing MemoryResident Databases Kenneth Salem Hector GarciaMolina 97Checkpointing MemoryResident Databases Kenneth Salem Hector GarciaMolina 97
Shuttle Runs How to do this Shuttle RunsShuttle Runs How to do this Shuttle Runs
PRACTICE RUNS TRAINING Temple University IRB Practice RunsPRACTICE RUNS TRAINING Temple University IRB Practice Runs
Dry Runs and Trace Tables Dry Runs AnDry Runs and Trace Tables Dry Runs An
WW Threshold scan runs and Z pole runsWW Threshold scan runs and Z pole runs
Elijah Runs HE RUNS IN VICTORY AND THENElijah Runs HE RUNS IN VICTORY AND THEN
A river runs through it A RIVER RUNSA river runs through it A RIVER RUNS
Certain physical properties associated with certain space groupsCertain physical properties associated with certain space groups
Certain physical properties associated with certain space groupsCertain physical properties associated with certain space groups
VIRUS Lo No Vivo Los Virus Los virusVIRUS Lo No Vivo Los Virus Los virus
Virus Virus Principali caratteristiche dei virus Sono agentiVirus Virus Principali caratteristiche dei virus Sono agenti
Virus ARN 2 Virus de la rage VirusVirus ARN 2 Virus de la rage Virus
INFLUENZA VIRUS Influenza virus is a RNA virusINFLUENZA VIRUS Influenza virus is a RNA virus
Virus Virus biological particle pathogen virus comes fromVirus Virus biological particle pathogen virus comes from
Virus dellepatite Virus epatite A Virus epatite BVirus dellepatite Virus epatite A Virus epatite B
VIRUS TANAMAN Oleh Irda Safni Definisi Virus VirusVIRUS TANAMAN Oleh Irda Safni Definisi Virus Virus