Chapter 2 - Telecommunications and Network Security Flashcards Preview

high number of half open connections

Not depending on size of packet

First Phase - compromise as many machines as possible. Components - client, handler, agent, target

Does not encrypt

Bots are zombies controlled by shadowy figures - largest shource of spam e-mail

ip fragments are constructed so that the target host calculates a negative fragment length

subvert packet filters that only inspect the first fragment of a fragmented packet.

sender specifies path

use broadcasts to create DoS attacks. Smurf misuses ICMP. Fraggel uses UDP

basic authentication method easy to exploit

NNTP - main shortcoming authentication

last log in time of a user and whether currently logged in

NTP sychronizes computer clocks

overload with excessive traffic

DoS against the inital handshake - overloads the target's connection table

bogus source address

unatuhorized insertion of packets into a data stream

Data Link Layer

Perimeter Surveillance and intelligence gathering

man in the middle attack

Traffic Filtering

On the network perimeter to alert the network administrator of all suspicious activity

fileserver, ip phone, security camera

more difficult to wiretap

firewall, proxy server, host based intrusion detection system

Lack of physical access controls

SSIDs are not for authentication

provides mechanisms for authentication and encryption

aggreagates logs from security devices and application servers looking for suspiious activity

lack of authenticationof servers and therby the authenticity of records