1-1-2 Threats (or Perils)

Highlighted text? Practice this concept. Highlighted passages and figures open related questions.

Practice related questions (15)Progress & bookmarks

Current section

p. 354

Practice this section 15 linked exam questions with default filters

Progress

Not marked complete

1-1-2 Threats (or Perils)

Threats (or perils) are things which may cause loss to information assets. Examples of threats that pertain to the Internet and other networks include the following.

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: • Tapping The interception of data by a third party with malicious intent • Falsification The fraudulent rewriting of information in e-mail or web pages • Spoofing The performance of fraudulent actions by impersonating another person (e.g., authorized user) • Theft — p. 354 · Enlarge

Spoofing · 1 practice questions

p. 355

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: The theft of files or data by a third party with malicious intent • Destruction The fraudulent destruction or erasure of files or data — p. 355 · Enlarge

Threats are classified into three types as follows:

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: • Personal threat This is the type of threat that is caused by human behavior (with or without malicious intent). • Technological threat This is the type of threat in which a third party with malicious intent uses computer technology to make attacks. • Physical threat This is the type of threat against equipment itself or against the buildings in which equipment is located. — p. 355 · Enlarge

Specific examples of each type of threat are presented below. A case that corresponds to more than one type of threat is included among the type of threat that displays its characteristics most strongly.

(1) Personal threats

Typical examples of personal threats include the following. In particular, the acts that are recognized as fraudulent are sometimes termed fraudulent behavior.

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: • Information leakage This is the leakage of information to a third party. It includes intentional leakage with the aim of receiving payment for information provision, and unintentional leakage of important information accidentally overheard by a third party. In addition, information in discarded equipment may be restored and leaked if not physically deleted (i.e., destroyed). • Loss / Theft / Damage This means that IT devices, such as PCs and USB memory, where information is stored are left behind, stolen, or destroyed during use. • Error / Incorrect operation This is data erasure or such other error that is caused by wrong operation. It includes the leakage of important information through mistaken entry of recipient e-mail addresses. — p. 355 · Enlarge

p. 356

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: • Social engineering This is the act of stealing information through everyday and common means. • Trashing (scavenging, dumpster diving) This is the act of stealing important information from memos thrown away in the garbage bin, data left in memory or cache, etc. It is also used as a method of foot printing for prior collection of information about the target of attacks. • Spoofing This is the impersonation of a person by a third party. The spoofer may pretend to be a customer or a supervisor in order to ask for PINs (PIN Numbers) or passwords. • Peeping This is the act of sneaking a peek at keyboard operation of a person who is entering a password, or classified information displayed on another person’s screen. In particular, the act of sneaking a peek at information over a person’s shoulder is called shoulder hacking. • Cracking This is the act of intruding into another person’s PC with malicious intent, to steal or destroy data. A person who engages in cracking is called a cracker. Note that the software package used by a cracker after unauthorized intrusion is called a rootkit, and the path installed to facilitate later intrusion is called a back door. • Targeted attack This is the act of attacking a specific organization or person as a target. Since humans select the target of the attack, this is classified as a personal threat. However, the attack method itself is primarily classified as a technological threat. — p. 356 · Enlarge

(2) Technological threats

Typical examples of technological threats include unauthorized access or denial of service using computer technology, and computer crime. The compromise of safety due to advances in computer technology can also be called a technological threat. Typical attack methods using computer technology, which are classified as technological threats, include the following.

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: • DoS attack (Denial of Service) This is an attack that sends a large amount of data continually to the target server to place an excessive load on the server’s CPU and memory, and thereby obstructs service. In addition, there is also a DDoS (Distributed DoS) attack in which malicious programs used for targeted attacks are used to attack the single target all at once from multiple PCs. — p. 356 · Enlarge

p. 357

• Key logger
This is an attack that uses the mechanism (e.g., software) that records keyboard input, and fraudulently acquires information (e.g., password) entered by another person. · 1 question
• Clickjacking
This is an attack that sets up a web page with some sort of function that causes a user’s click to execute operations not intended by the user.
• Phishing
This is an attack that leads a user to a fake website through means such as e-mail pretending to be sent from a real company (e.g., financial institution), and defrauds the user of the credit card number, a bank account number, a PIN, and other personal information. · 1 question
• Cache poisoning
This is an attack that fraudulently overwrites cache information. In particular, DNS cache poisoning, which overwrites DNS cache, is used to lead users to fake websites for phishing. · 3 questions
• IP spoofing
This is an attack that sends packets to another party with the source IP address disguised. This is used in actions including leading users to fake websites for phishing.
• XSS (Cross Site Scripting)
This is an attack where a vulnerable target website is used as a stepping stone; a malicious script is sent to a user who is accessing the target website, and then executed on the user’s browser to enable the theft of information. · 2 questions
• CSRF (Cross Site Request Forgery)
This is an attack which, when a user is logged in to a website and then accesses another website that has a trap installed, causes a malicious request to be sent to and executed by the logged-in website in the guise of a request from the user (i.e., as a forgery).
• Session hijacking
This is an attack that takes over a session (i.e., a series of communications between specified parties) during communication between correctly authorized users.
• Directory traversal
This is an attack that accesses normally undisclosed directories (or files) by appending “../” to file names, to traverse upward through directories.
• Drive-by download
This is an attack that causes a user to download a malicious program, without permission during website browsing.
• SQL injection

p. 358

Original Security textbook callout or table, preserving the original labels, values, symbols and spatial arrangement. Source text: This is an attack that falsely modifies a database or fraudulently obtains information by providing part of an SQL statement as a parameter to a program (CGI program) in the website that is linked to the database. • Side channel attack This is an attack that obtains confidential information by measuring and analyzing some additional information (i.e., side channel information), such as the electric power consumption or radiated electromagnetic waves of active IC chips. • Zero-day attack This is an attack that takes advantage of a vulnerability in software before a fix for the vulnerability can be released by the software vendor. • Password cracking This is an attack that fraudulently decodes or otherwise obtains the password of a true user. • Dictionary attack This is a method that uses a file (i.e., a dictionary file) that contains character strings likely to be used as passwords, to try such words in sequence. • Brute force attack This is a brute-force method that attempts every combination of characters. It is used as an attack method of performing the exhaustive search for a decryption key. • Third-party relay This is an attack that abuses a freely usable server (e.g., mail server) as a “stepping stone” to transmit e-mail and other data. • Gumblar This is an attack that falsifies the website of a famous company or public institution, and infects the computer of a user who is browsing the falsified website with a computer virus. • Buffer overflow This is an attack that continually sends long character strings or such other data to flood the memory area (i.e., buffer) secured by a program, for the purpose of seizing access privileges to the program and creating malfunctions. — p. 358 · Enlarge

Brute-force decryption-key search · 2 practice questions

Fraudulent programs (i.e., malware) created with malicious intent are also classified as technological threats. The following are typical examples of malware.

p. 359