The next slide lists the consequences of a relatively recent attack of a global virus called Conficker
We'll analyze the ways in which the virus can be fought in the next module of the seminar.
For now I would only like to point out the conflict spreads things to the gullibility of the users.
Once again it's an example of social engineering.
The right hand side of the slide presents a window that popped up whenever a user connected a memory
stick to a computer which was infected with Conficker.
Is it really how the Windows Vista auto play window looks while the window contains a well-known message
prompting the user to open the folder to view the files.
The default option which the user knows and has selected many times before is highlighted as well.
Please note however that the heading above this option says installer run the program the virus modified
and auto run file which you can see in the upper right corner of the slide in order to use auto play
to get users to run this code.
The lesson Aereo we will discuss is an attack targeted at a specific service we want to elaborate on
it because it's not an automated attack.
It doesn't use a virus or an exploit
for this kind of attack.
The attacker needs only the information that the victim uses a certain version of the server created
by such and such a company then the attacker sets up the very same version of an FPP server in his own
computer.
Initially the attacker will try to conduct the attack on his own server.
This means that the future victim is oblivious to his actions.
Also it will allow the attacker to analyze the server's responses in real time using a debugger or a
program monitoring the activity of server processes.
All this can allow the attacker to find a server air for example a buffer overflow air using his own
copy of the software used by the victim.
The attacker can prepare a specific attack.
For example the attacker can create an exploit and test it on his own version of the server.
Once the attack is tried out it can be reproduced on the victim's computer.
In such cases the virus scanner will prove useless.
It won't detect any viruses because the attack will be conducted with the use of an original program
that doesn't appear in the scanners database.
If the firewall is used as an application firewall it won't be much help either.
Whether such a firewall detects the attack or not depends on how invasive the attack is.
There is a great possibility that the firewall won't notice the attack even the correct configuration
of the server won't prevent the attack from happening.
Strictly following the producers instruction won't ensure security either.
Because the attack exploits software bugs not configuration mistakes.
The problem wasn't reported to the producer so it couldn't have had the chance to issue an update fixing
that bug.
However the probability of such an attack is substantially small although there are more and more threats
out there.
Defense in depth security model gives you the chance to detect an attack when you still have time to
react.
And even if the attack is successful its scope will be limited.
It will allow you to limit the attack to a given server only and to prevent it from spreading to the
whole computer system or the network the server is connected to
thank you for your attention.