Intrusion detection systems and models

Joseph S. Sherif, Tommy G. Dearmond, California Institute of Technology

Mahoney, M., “Computer Security: A Survey of Attacks and Defenses” Hyperlink docshow.net/ids.htm, 2000.

http://cs.fit.edu/~mmahoney/ids.html

According to Mohoney, there exists at least six types of attacks to the system

1. Worms - self replicating programs that spread across a network.
The three security flaws that the worms exploited were
a. a backdoor in the sendmail server program that allowed clients to execute remote commands on the server
b. a buffer overflow vulnerability in the fingerd server
c. weak passwords

2. Viruses - programs that replicate when a user performs some action such as running a program.
types discussed in this paper include the following
a. Boot sector infectors
b. File infectors
c. Email viruses

3. Server attacks - a client exploits a bug in the server to cause it to perform some unintended action.
Examples,
a. Microsoft IIS 4.0 web server
b. Cold Fusion web server
c. lpd attack
d. Sendmail buffer overflow
e. rpc.statd buffer overflow

4. Client attacks - a server exploits a bug in a client to cause it to perform some unintended action.
a. Microsoft Office 2000 UA Control
b. Microsoft Outlook

5. Network attacks (denial of service) - a remote attacker exploits a bug in the network software or weakness in the protocol to cause a server, router, or network to fail.
a. Winnuke
b. IRDP spoofing
c. Teardrop
d. Land
e. Ping of death
f. Smurf
g. Vengeance
h. SYN flood
i. Local network attacks
j. SNMP attacks

6. Root attacks - a user on a multiuser operating system obtains the priveliges of another user (usually root) by either
- Obtaining the other user's password, or
- Bypassing controls that restrict access.

NT attacks - NT password weaknesses
UNIX attacks - Shell script attacks, Dynamic library attacks, Directory tree escapes, Symbolic links in /tmp, Console attacks
Password Capture - Sniffer attacks, Weak encryption, Trojan attacks, Backdoor passwords, Stored passwords, Hardware key attacks