What is eavesdropping?

Secure – охороняти, захищати, забезпечувати, гарантувати

threat – загроза, небезпека

exploit – засіб (програма) атаки

eavesdropping – підслуховування, перехват

social engineering – “соціальна інженерія”, соціотехніка

human error – суб’єктивна помилка, помилка оператора

indirect attack – непряма (опосередкована ) атака

backdoor – лазівка, потайні двері, чорний хід

direct access attack – атака прямого доступу

accomplishment – виконання, досягнення

chunk of data – порція даних

bug – помилка (в програмі), дефект, збій

glitch – програмна помилка, глюк

occur–траплятися, відбуватися

Frequently - часто

Privilege – право доступу, привілей, повноваження

Escalation – поширення, ескалація, ріст, загострення

Denial of service attack – атака (системи) з метою порушення нормального обслуговування користувачів

Ensure – гарантувати, забезпечити

Release – розблокувати, випустити

Fail – не вдаватися, не мати доступу

Flaw – дефект

Remote – віддалений, дистанційний

Surreptitious – таємний

Faint – слабкий

Malicious – злісний, злий, шкідливий, зі злими намірами

Penetrate – проникати, долати захист

Take advantage of – скористатися (чимось)

Carelessness – неуважність, халатність, необережність, легковажність, недбалість, недотримання правил безпеки

Deliberately – навмисне, свідомо

Deceive – обманювати

Deception – обман, брехня

Gain unauthorized access – отримати несанкціонований доступ

Render – представляти

Deny – заперечувати, відмовляти (в чомусь)

Guess – відгадати, вгадати

Consecutive – послідовний

Prevent – попереджати, запобігати, відвертати

Compromise – компрометувати (займатися несанкціонованим розкриттям чи отриманням захищеної інформації)

Botnet – ботнет (мережа комп’ютерів, вражених програмою, яка підтримує зв’язок з її розробниками для того, щоб надсилати пошту без запиту, атакувати вебсайти і т.д.)

Flood – наповнити, затопити; повінь

Target system – цільова система

Thus – так, таким чином

Resource exhaustion – спустошення (витрата) ресурсів

Exhaust – виснажувати, вичерпувати

Attack amplifier — підсилювач атак

FTP – (File Transfer Protocol) протокол передачі файлів,

Протокол FTP

DNS – 1) Domain Name System – служба імен доменів

Domain Name Server – сервер доменних імен

In order to – для того, щоб

Launch – запускати , починати

Commonly – зазвичай, як правило, переважно

Merely – тільки, лише, просто

Malfunction – несправно працювати, не спрацьовувати; несправна робота, аварійний режим

Crash – зазнати аварії (збою); аварійна відмова, збій, крах

Denial-of-service – перешкоджання санкціонованому доступу, відмова в обслуговуванні

Anonymize – діяти анонімно

Cryptosystem – криптосистема

Bypass – обходити, обхід

Authentication – підтвердження автентичності, перевірка

Remote access – віддалений (дистанційний) доступ

Plain text – незашифрований текст

Obtain – одержувати, здобувати

Attempt – пробувати, намагатися; спроба, намагання

Remain undetected – залишатися невиявленим

Rootkit – руткіт (програмні засоби, що приховують наслідки злому та ховають засоби, що використовують зловмисники, від антивірусного програмного забезпечення)

Hook into – проникати

Fake – підробляти, дурити

Keylogger – логер клавіатури (програма чи апаратний пристрій, що реєструє кожне натискання клавіш на клавіатурі комп’ютера)

Covert – таємний, невидимий, секретний

Backup media – резервні носії

Key drive – флеш-пам’ять

Boot – завантажувати, виконувати початкове завантаження

Bootable media – завантажувальний носій

Hard drive – жорсткий диск, дисковод, вінчестер

Defeat – перемогти, ліквідувати, анулювати

Exercise 28. Read and translate the text.

Vulnerabilities

To understand the techniques for securing a computer system, it is important to first understand the various types of "attacks" that can be made against it. The threats can typically be classified into these seven categories: exploits, eavesdropping, social engineering and human error, denial of service attacks, indirect attacks, backdoors, direct access attacks.

Exploits. An exploit (from the same word in the French language, meaning "achievement", or "accomplishment") is a piece of software, a chunk of data, or sequence of commands that take advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized). This frequently includes such things as gaining control of a computer system or allowing privilege escalation or a denial of service attack. Many development methodologies rely on testing to ensure the quality of any code released; this process often fails to discover extremely unusual potential exploits. The term "exploit" generally refers to small programs designed to take advantage of a software flaw that has been discovered, either remote or local. The code from the exploit program is frequently reused in trojan horses and computer viruses. In some cases, a vulnerability can lie in certain programs' processing of a specific file type, such as a non-executable media file.

Eavesdropping. Eavesdropping is the act of surreptitiously listening to a private conversation. Even machines that operate as a closed system (i.e. with no contact to the outside world) can be eavesdropped upon via monitoring the faint electro-magnetic transmissions generated by the hardware such as TEMPEST. The FBI's proposed Carnivore program was intended to act as a system of eavesdropping protocols built into the systems of internet service providers.

Social engineering and human error. A computer system is no more secure than the human systems responsible for its operation. Malicious individuals have regularly penetrated well-designed, secure computer systems by taking advantage of the carelessness of trusted individuals, or by deliberately deceiving them, for example sending messages that they are the system administrator and asking for passwords. This deception is known as social engineering.

Denial of service attacks. Unlike other exploits, denial of service attacks are not used to gain unauthorized access or control of a system. They are instead designed to render it unusable. Attackers can deny service to individual victims, such as by deliberately guessing a wrong password 3 consecutive times and thus causing the victim account to be locked, or they may overload the capabilities of a machine or network and block all users at once. These types of attack are, in practice, very hard to prevent, because the behaviour of whole networks needs to be analyzed, not only the behaviour of small pieces of code. Distributed denial of service (DDoS) attacks are common, where a large number of compromised hosts (commonly referred to as "zombie computers", used as part of a botnet with, for example; a worm, trojan horse, or backdoor exploit to control them) are used to flood a target system with network requests, thus attempting to render it unusable through resource exhaustion. Another technique to exhaust victim resources is through the use of an attack amplifier — where the attacker takes advantage of poorly designed protocols on third party machines, such as FTP or DNS, in order to instruct these hosts to launch the flood. There are also common vulnerabilities in applications that cannot be used to take control over a computer, but merely make the target application malfunction or crash. This is known as a denial-of-service exploit.

Indirect attacks. An indirect attack is an attack launched by a third party computer. By using someone else's computer to launch an attack, it becomes far more difficult to track down the actual attacker. There have also been cases where attackers took advantage of public anonymizing systems.

Backdoors. A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing remote access to a computer, obtaining access to plain text, and so on, while attempting to remain undetected. The backdoor may take the form of an installed program (e.g., Back Orifice), or could be a modification to an existing program or hardware device. A specific form of backdoors are rootkits, which replace system binaries and/or hook into the function calls of the operating system to hide the presence of other programs, users, services and open ports. They may also fake information about disk and memory usage.

Direct access attacks. Common consumer devices can be used to transfer data surreptitiously. Someone who has gained access to a computer can install any type of devices to compromise security, including operating system modifications, software worms, keyloggers, and covert listening devices. The attacker can also easily download large quantities of data onto backup media, for instance CD-R/DVD-R, tape; or portable devices such as key drives, digital cameras or digital audio players. Another common technique is to boot an operating system contained on a CD-ROM or other bootable media and read the data from the hard drive(s) this way. The only way to defeat this is to encrypt the storage media and store the key separate from the system.

Exercise 29. Answer the following questions.

1. Why is it important to first understand the various types of "attacks" that can be made against a computer system?

2. How many categories can threats typically be classified into?

What is an exploit?

What is eavesdropping?

Поиск по сайту: