Freedom9 freeGuard Blaze 2100, Руководство пользователя

Страница: 85 / 224

. . . . .
A T T A C K D E T E C T I O N A N D P R E V E N T I O N
Detecting an Attack
Version 3R2 Security Appliance User Guide
5-3
Table 5-1 lists the range of network and operating system-specific
attacks that the security appliance can detect and defend against.
Table 5-1: Network and operating system-specific attacks
Attack Name Description
Back Orifice Attack Occurs when a hacker attempts to drop a Trojan horse
communicating over port 31337 onto a remote computer. If
the attempt is successful, a hacker can take screen captures,
execute keyboard commands, make file transfers and install
applications on the victim computer.
Inikiller Attack Communicates over port 9989 and allows an attacker to
destroy .ini files on remote workstations.
IP Spoof An attacker forms and sends messages to a computer, as if
they were communicating on the same trusted network. A
hacker enlists a number of techniques to find a trusted host,
modify the IP header information and attempt to spoof.
ICMP Router Discovery
Protocol (IRDP)
An attacker supersedes the default route for the host by
inserting a more specific route. Once the new route is added,
an attacker can forward all traffic from the host in order to
gather information, launch a man-in-the-middle attack or
create a DoS by adding or restoring default routes.
Netbus Attack Affects Windows 95, 98 and NT operating systems. A netbus
attack allows hackers to install a Trojan horse that enables
them to open and close CD-ROM drives, start applications and
redirect URLs.
NetSpy Attack Hackers install a Trojan horse enabling control of a remote
system via port 1024.
Senna Spy Attack A Trojan horse attack that allows the hacker to take control of
a remote workstation via port 13000. Allows the attacker to
perform illicit activity on that machine.
Striker Attack Form of a Trojan horse attack that allows a hacker to crash a
system over port 2565.
Sub Seven Attack: Attackers send a Trojan horse over ports 6667, 6711 and
27374. Allows the hacker to perform illicit activities on the
remote machine. This attack is particularly dangerous
because IRC messages can be sent back to the hacker letting
them know if the system is up or down.
Port Scan A hacker sends requests to all ports, one at a time, to
determine whether the port is in use by a system. This allows
the hacker to take advantage of weaknesses in a specific
system. Port scanning is used by hackers to gather
information about a specific network or range of IP addresses.
Priority Attack A hacker communicates over port 16969. The hacker drops a
Trojan horse to enable illicit activity on a remote machine.