Introduction to Computer Security Thinking about SecurityPaul KrzyzanowskiFebruary 3, 2019 Computer SecurityComputer security addresses three areas: confidentiality, integrity, and availability. These are known as the CIA triad (sometimes called the AIC triad to avoid confusion with the U.S. Central Intelligence Agency). ConfidentialityConfidentiality refers to keeping data hidden. It can refer to an operating system disallowing you from reading the contents of a file or it may refer to data that is encrypted so that you can read it but cannot make sense of it. In some cases, confidentiality can also deal with hiding the very existence of data, computers, or transmitters. Simply knowing that two parties are communicating may be important for an adversary., the Internet Security Glossary, defines data confidentiality as:“The property that information is not made available or disclosed to unauthorized individuals, entities, or processes i.e., to any unauthorized system entity.”Confidentiality is the traditional focus of computer security and is usually the first thing that comes to mind when people think about the subject.Confidentiality is often confused with privacy.
Privacy limits what information can be shared with others while confidentiality provides the ability to to conceal messages or to exchange messages without others who do not have authorization being able to see them. Privacy controls how others can use information about you.Privacy may also enable one to send messages anonymously.
For instance, you may want to keep your identity hidden when contacting a crisis or crime reporting center., the Internet Security Glossary, citing theU.S. HIPAA Privacy Act of 1964,defines privacy as:The right of an entity (normally a person), acting in itsown behalf, to determine the degree to which it will interact withits environment, including the degree to which the entity iswilling to share its personal information with others.The differences among confidentiality, privacy, and secrecy are difficult to remember since we use often use these terms interchangeably when speaking colloquially. Also, note that the terms “secret” and “confidential” may simply refer to different security clearance classification levels in many governments. The distinctions, particularly between confidentiality and secrecy, can be fluid. Let’s use some working definitions: Secrecy refers to information where there is no intention of ever disclosing it outside of the individual or the organization. For example, a company may have trade secrets. Privacy refers to private matters for real people.
This includes our medical records and financial data. The data is not secret but we want it to be shared only with appropriate entities – ideally in ways we understand and can revoke if necessary. Confidentiality refers to the rules for handling trusted data.
Confidentiality can be thought of as systems-level solutions (policies and mechanisms) to ensure that privacy is preserved.The need for privacy is a reason for implementing confidentiality. IntegrityIntegrity is ensuring that data and all system resourcesare trustworthy. This means that they are not maliciously or accidentally modified. There arethree categories of integrity:.Data integrity is the property that data has not been modified or destroyed in an unauthorized or accidental manner. Someone cannot override or delete your files.Origin integrity is the property that a message has been created by its author and not modified since then. It includes authentication: a personor program proving their identity.System integrity is the property that the entire system is working as designed, without any deliberate or accidental modification of data or manipulation of processing that data.In many cases, integrity is of greater value than confidentiality.
I might not care if you see me transfer money between two of my bank accounts but I want the system to ensure that you cannot impersonate me and do the same. AvailabilityAvailability deals with systems and data being available for use. We want a system to operate correctly on the right data (integrity) but we also want that system to be accessible and capable of performing to its designed specifications. For example, a denial of service ( DoS) or a distributed denial of service ( DDoS) attack is an attack on availability. It does not access any data or modify the function of any processes.
A(n) ____________________ Is An Act Against An Asset That Could Result In A Loss.
However, it either dramatically slows down or completely disallows access to the system, hurting availability.We want all three of these properties in a secure system. For example, we can get confidentiality and integrity simply by turning off a computer but then we lose availability. Integrity on its own is useful, but does not provide the confidentiality that is needed to ensure privacy. Confidentiality without integrity is generally useless since you may access data that was modified without your knowledge or use a program that is manipulating the data in a manner that you did not intend. Thinking about securityAlgorithms, cryptography, and math on their own do not provide security.Security is not about simply adding encryption to a program, enforcing theuse of complex passwords, or placing your systems behind a firewall.Security is a systems issue and is based on all the components of the system:the hardware, firmware, operating systems, application software, networking components,and the people. Consider the problems that arose from the that was discovered in 2018 and affects the firmware of practically every modern microprocessor designed over the past several decades.
This is a company that was created by the creators of the first public key encryption algorithm, sold security products, including SecurID authentication tokens, and hosts security conferences. Data on around 40 million. The attacker sent two different targeted phishing emails over a two day period and attack used a Flash object embedded in an Excel file. We do not know exactly what data was stolen, although RSA warned customers that stolen data could be potentially used to reduce the effectiveness of their authentication product.Yahoo, who in 2016 announced that over a billion accounts were compromised in 2013 and 2014, revealing names, telephone numbers, dates of birth, encrypted passwords and unencrypted security questions that could be used to reset a password.TJX, the parent company of TJ Maxx, announced in March 2007 that it had 45.6 million credit cards stolen over a period of 18 months. Court filings later revealed that at least 94 million customers were affected.
The incident cost the company $256 million.Sony Pictures was hacked in 2014 and personal information about employees, their families, salaries, email, and unreleased films was disclosed.744,408 BTC ($350 million at the time) was stolen in 2010 from one of the first and largest Bitcoin exchanges, Japan’s Mt. Government, the secret level applies to information whose unauthorized disclosure could be expected to cause serious damage to national security. The confidential level applies to information whose unauthorized disclosure could be expected to cause damage to national security.
I do not know where the boundary lies between “damage” and “serious damage.”.,.,.,.,.,.Ross J. Anderson, 2nd edition, Wiley pub. 2008.Bruce Schneier, 1st edition, Wiley pub., 2004.February 2, 2012,.Freedom fighter or terrorist? It depends whose side you are on. © 2003-2019 Paul Krzyzanowski.
Network security is a critical component in the day-to-day IT operations of nearly every organization in business today. Before learning how to plan, design, and implement network security, it is important to understand the larger topic of information security and how the components of network security fit into this topic.
Additionally, the field of information security has matured in the last 20 years and become so large that those who don’t understand these concepts risk being unable to make the best business decisions regarding network security. This chapter offers an overview of the entire field of information security and its effects on network security. Network security - The protection of networking components, connections, and contents, which is the primary focus of this textbook. Physical security - The protection of the physical items or areas of an organization from unauthorized access and misuse. Personal security - The protection of the people who are authorized to access the organization and its operations. Operations security - The protection of the details of a particular operation or series of activities. Communications security - The protection of an organization’s communications media, technology, and content.
Access - A subject or object’s ability to use, manipulate, modify, or affect another subject or object. Authorized users have legal access to a system. Access controls regulate this access. Asset - The organizational resource that is being protected. An asset can be “logical,” such as a Web site, information, or data, or it can be “physical,” such as a person, computer system, or other tangible object.
Assets, and particularly information assets, are the focus of security efforts; they are what those efforts are attempting to protect. Attack - An intentional (disengaja) or unintentional act that can cause damage to or otherwise compromise the information and/or the systems that support it.
Attacks can be active or passive, intentional or unintentional, and direct or indirect. Someone casually reading sensitive information not intended (dimaksudkan) for his or her use is a passive attack. A hacker attempting to break into an information system is an intentional attack. A lightning strike that causes a fire in a building is an unintentional attack.
A direct attack is a hacker using a personal computer to break into a system. An indirect attack is a hacker compromising a system and using it to attack other systems—for example, as part of a botnet (slang for robot network). This group of compromised computers, running software of the attacker’s choosing, can operate autonomously or under the attacker’s direct control to attack systems and steal user information or to conduct (mengadakan) distributed denial-of-service attacks.
Direct attacks originate from the threat itself. Indirect attacks originate from a compromised system or resource that is malfunctioning or working under the control of a threat. Control, safeguard (Menjaga), or countermeasure (tindakan balasan) - Security mechanisms, policies, or procedures that can successfully counterattack, reduce risk, resolve vulnerabilities, and otherwise improve the security within an organization. The various levels and types of controls are discussed more fully in the following chapters.
Exploit - A technique used to compromise a system. This term can be a verb or a noun. Threat agents may attempt to exploit a system or other information asset (informasi bernilai) by using it illegally for their personal gain. Alternatively, an exploit can be a documented process used to take advantage of a vulnerability or exposure, usually in software, that is either inherent in the software or created by the attacker. Exploits make use of existing software tools or custom-made software components. Exposure - A condition or state of being exposed. In information security, exposure exists when a vulnerability known to an attacker is present.
Intellectual Property - Often referred to as IP, intellectual property is defined as works of the mind, such as inventions, literature, art, logos, names, symbols, and other creative works. IP is protected by law, and any use, whether or not it requires payments or permission, should be properly credited. Loss - A single instance of an information asset suffering damage, unintended or unauthorized modification, or disclosure. When an organization’s information is stolen, it has suffered a loss.
Protection profile or security posture - The entire set of controls and safeguards (including policy, education, training and awareness, and technology) that the organization implements (or fails to implement) to protect the asset. The term “security program” also gets used for this, but it often includes managerial aspects of security, including planning, personnel, and subordinate programs. Risk - The probability that something unwanted will happen. Organizations must minimize risk to match their risk appetite—the quantity and nature of risk the organization is willing to accept.
Subjects and objects - A computer can be either the subject of an attack—an agent entity used to conduct (mengadakan) the attack-or the object of an attack—the target entity, as shown in Figure 1-2. A computer can be both the subject and object of an attack when, for example, it is compromised by an attack (object) and is then used to attack other systems (subject). Threat - A category of objects, persons, or other entities that presents a danger to an asset. Threats are always present and can be purposeful (sengaja) or undirected.
For example, hackers purposefully threaten unprotected information systems, whereas severe storms incidentally threaten buildings and their contents. Threat agent - The specific instance of a threat or a particular component of a threat.
For example, all hackers in the world present a collective threat, and Kevin Mitnick, who was convicted (dihukum) for hacking into phone systems, is a specific threat agent. Likewise, a lightning strike, hailstorm, or tornado is a threat agent that is part of the threat of severe storms.
Vulnerability - Weaknesses or faults in a system or protection mechanism that open it to the possibility of attack or damage. Examples of vulnerabilities include a flaw (cacat) in a software package, an unprotected system port, and an unlocked door. Well-known vulnerabilities are those that have been examined, documented, and published; others remain latent (or undiscovered). Critical Characteristics of InformationThe value of information comes from the characteristics it possesses (dimiliki).
When a characteristic of information changes, the value of that information either increases or, more commonly, decreases. Although information security professionals and end users share an understanding of the characteristics of information, tensions can arise when the need to secure information from threats conflicts with the end users’ need for unhindered access to the information. The following are important terms describing the characteristics of information:. Availability enables authorized users—persons or computer systems—to access information without interference or obstruction, and to receive it in the required format.
Accuracy means that information is free from mistakes or errors and has the value that the end user expects it to have. Authenticity is the quality or state of being genuine or original rather than a reproduction or fabrication. Information is authentic when it is the information that was originally created, placed, stored, or transferred. Confidentiality is the protection of information from disclosure or exposure to unauthorized individuals or systems.
This means that only those with the rights and privileges to access information are able to do so. To protect any breach in the confidentiality of information, a number of measures can be used:. Information classification.
Secure document storage. Application of general security policies. Education of information custodians and end users.
Data owners are those responsible for the security and use of a particular set of information. They are usually members of senior management and could be CIOs. The data owners usually determine the level of data classification associated with the data.
The data owners work with subordinate managers to oversee the day-to-day administration of the data. Data custodians work directly with data owners and are responsible for the storage, maintenance, and protection of the information. Depending on the size of the organization, the custodian may be a dedicated position, such as the CISO, or it may be an additional responsibility of a systems administrator or other technology manager. The duties of a data custodian often include overseeing data storage and backups, implementing the specific procedures and policies laid out in the security policies and plans, and reporting to the data owner. Data users are end users who work with the information to perform their daily jobs supporting the mission of the organization, and who therefore share the responsibility for data security.
Integrity means that information remains whole, complete, and uncorrupted. The integrity of information is threatened when the information is exposed to corruption, damage, destruction, or other disruption of its authentic state. Utility is the quality or state of having value for some purpose or end. To have utility, information must be in a format meaningful to the end user. For example, U.S.
Census data can be overwhelming and difficult to understand; however, the data, when properly interpreted, reveals information about the voters in a district; which political parties they belong to; their race, gender, and age; and so on. Possession is the ownership or control of some object or item. Information is said to be in one’s possession if one obtains it, independent of format or other characteristics. Privacy means that information is used in accordance with the legal requirements mandated for employees, partners, and customers.
In the rush to protect data from theft or mischief, organizations often trample the rights of individuals. For example, customers may not want a company to use their names and personal information for marketing purposes. ASecurity ModelsAn information security model allows professionals to map abstract security goals to concrete ideas and blueprints for how to implement proper security controls. Current information security models evolved from a concept known as the C.I.A. Triad, which was developed by the computer security industry.
It is typically displayed as a triangle, as shown in Figure 1-3. Triad has been the industry standard for computer security since the development of the mainframe. It is based on three characteristics of information that form the foundation for many security programs: confidentiality, integrity, and availability. These three characteristics are still important today, but the C.I.A. Triad no longer adequately represents all the key security concepts that are used to address the constantly changing environment of the computer industry. Today’s evolving threats—accidental or intentional damage or destruction, theft, unintended or unauthorized modification, and other misapplication—have prompted the development of a more robust security model that addresses the complexities of the current information security environment.The definition of information security presented earlier in this chapter is based in part on a document called the U.S. National Training Standard for Information Security Professionals NSTISSI No.
4011, which was published by the U.S. Committee on National Security Systems (CNSS).1 This document presents a comprehensive model for information security, known as the McCumber Cube, which is becoming a standard for the discussion of security of information systems.Created by John McCumber in 1991, the McCumber Cube provides a graphical description of the architectural approach widely used in computer and information security.2 As shown in Figure 1-4, it is a representation of a 3 x 3 x 3 cube, with the 27 cells representing areas that must be addressed to secure today’s information systems. For example, the intersection between the technology, integrity, and storage areas requires a control or safeguard that addresses the need to use technology to protect the integrity of information while it is in storage. One such control is a system for detecting host intrusion, which protects the integrity of information by alerting the security administrators to the potential modification of a critical file. Balancing Information Security and AccessInformation security must effectively balance protection and availability.
Even with the best planning and implementation, it is impossible to obtain perfect information security; information security is a process, not a goal. A completely secure information system—if one existed— would not allow anyone access, ever, resulting in a complete lack of availability. On the other hand, it is possible to permit unrestricted access to a system, so that it is available to anyone, anywhere, anytime, through any means.
However, this poses a danger to the confidentiality and integrity of the information.To achieve balance—that is, to operate an information system to the satisfaction of the user and the security professional—the level of security must allow reasonable access, yet protect against threats. An imbalance between access and security can occur when the needs of the end user are undermined by too heavy a focus on protecting and administering the information systems. Both information security technologists and end users must exercise patience and cooperation when interacting with one another, as both groups share the same overall goals of the organization: to ensure that the data is available when, where, and how it is needed, with minimal delays or obstacles. Threats to Information SecurityAround 500 BC, the Chinese general Sun Tzu wrote a treatise on warfare called the Art of War. It contains military strategies that are still studied by military leaders and students. In one of his most famous passages, Sun Wu writes, “If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat.
If you know neither the enemy nor yourself, you will succumb in every battle.”3 In the battle to protect information, you must know yourself—that is, be familiar with the information that needs protecting and the systems that store, transport, and process it. You must also know the enemy—that is, be informed about the various threats facing the organization, its people, applications, data, and information systems.To understand the wide range of threats that pervade the interconnected world, researchers have interviewed practicing information security personnel and examined the information security literature on threats. Although the categorizations may vary, threats are relatively well researched and, consequently, fairly well understood.The Computer Security Institute (CSI) Computer Crime and Security Survey is a representative study. The study found that approximately 50 percent of the organizations responding (skewed to primarily larger organizations) had experienced at least one security incident, with 45.6 percent of those respondents reporting that they had been the subject of a targeted attack.Table 1-1 presents 12 categories that are a clear and present danger to an organization’s people, information, and systems, listed in order from most severe to least severe, as determined by the study’s participants.
Each organization must prioritize the dangers it faces, based on the particular security situation in which it operates, its organizational strategy regarding risk, and the exposure levels in which its assets operate. You’ll notice that many of the threat examples could be listed in more than one category. For example, an act of theft performed by a hacker falls into the theft category, but such acts are often accompanied by defacement actions to delay discovery, thus they may also be placed within the sabotage-or-vandalism category. Password AttacksA number of attacks attempt to bypass access controls by guessing passwords; this is sometimes called password cracking. Such attacks range from making educated guesses based on the individual’s background to guessing every possible combination of letters, numbers, and special characters. The most common password attacks are examined here:Rainbow TablesOne popular password attack, variously called a rainbow attack, a precomputed hash attack, or a time-memory tradeoff attack, uses a database of precomputed hashes (or rainbow tables) derived from sequentially calculated passwords to look up the hashed password and read out the text version. A rainbow attack is used when a copy of the hash of the user’s password has been obtained.
When a match is found, the password has been cracked.Brute Force AttacksUsing computing and network resources to try every possible combination of available characters, numbers, and symbols for a password is called a brute force attack. Because this often involves repeatedly guessing the passwords to commonly used accounts, it is sometimes called a guessing attack. If attackers can narrow the field of target accounts, they can devote more time and resources to attacking fewer accounts. That is one reason to change the names of common accounts from the manufacturer’s default names.Although often effective against low-security systems, brute force attacks are often not useful against systems that have adopted the usual security practices recommended by manufacturers. Controls that limit the number of attempts allowed per unit of elapsed time are very effective at combating these attacks.
Defenses against brute force attacks are usually adopted early on in any security effort and are thoroughly covered in the SANS/FBI list of the Top 20 Most Critical Internet Security Vulnerabilities.Dictionary A variation on the brute force attack, the dictionary attack narrows the fieldby selecting specific target accounts and using a list of commonly used passwords (the dictionary) instead of random combinations. Organizations can use similar dictionaries to disallow passwords during the reset process and, thus, guard against easy-to-guess passwords. In addition, rules requiring additional numbers and/or special characters make the dictionary attack less effective.Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) AttacksIn a denial-of-service (DoS) attack, the attacker sends a large number of connection or information requests to a target (see Figure 1-5). So many requests are made that the target system cannot handle them along with other, legitimate requests for service. The system may crash, or it may simply be unable to perform ordinary functions.
A distributed denial-of-service (DDoS) launches a coordinated stream of requests against a target from many locations at the same time. Most DDoS attacks are preceded by a preparation phase in which many systems, perhaps thousands, are compromised. The compromised machines are turned into zombies (or bots), machines that are directed remotely (usually via transmitted command) by the attacker to participate in the attack. DDoS attacks are the most difficult to defend against.
There are, however, some cooperative efforts to enable DDoS defenses among groups of service providers; among them is the Consensus Roadmap for Defeating Distributed Denial of Service Attacks To use a popular metaphor, DDoS is considered a weapon of mass destruction on the Internet. Any system connected to the Internet that provides TCP-based network services (such as a Web server, FTP server, or mail server) is a potential target for denial-of-service attacks. Note that in addition to attacks launched at specific hosts, these attacks can be launched against routers or other network server systems if these hosts enable (or turn on) other TCP services (e.g., echo).
Even though such attacks make use of a fundamental element of the TCP protocol used by all systems, the consequences of the attacks may vary, depending on the system.SpoofingSpoofing is a technique used to gain unauthorized access to computers, wherein the intruder sends messages whose IP addresses indicate to the recipient that the messages are coming from a trusted host. To engage in IP spoofing, a hacker must first use a variety of techniques to find an IP address of a trusted host and then modify the packet headers (see Figure 1-6) so that it appears that the packets are coming from that host.10 Newer routers and firewall arrangements can offer protection against IP spoofing.
Man-in-the-Middle AttacksIn the well-known man-in-the-middle attack, an attacker monitors (or sniffs) packets from the network, modifies them using IP spoofing techniques, and inserts them back into the network, allowing the attacker to eavesdrop as well as to change, delete, reroute, add, forge, or divert data.11 In a variant attack, the spoofing involves the interception of an encryption key exchange, which enables the hacker to act as an invisible man-in-the-middle—that is, eavesdropper—in encrypted exchanges. Figure 1-7 illustrates these attacks by showing how a hacker uses public and private encryption keys to intercept messages. E-Mail AttacksA number of attacks focus on the use of e-mail to deny service to the user (a form of DoS), exploit the inexperience or vulnerability of the user, or trick the user into installing backdoors or viruses.
In general, e-mail is more the vehicle for the attack than the attack itself. However, there are also specific e-mail attacks, including spam and mail bombing.Spam Spam, or unsolicited commercial e-mail, has been used as a means of making malicious code attacks more effective. In some cases, malicious code is embedded in files that are included as attachments to spam.12 The most significant impact of spam, however, is the waste of both computer and human resources. Many organizations attempt to cope with the flood of spam by using filtering technologies to stem the flow. Other organizations simply tell users of the mail system to delete unwanted messages.Mail Bomb Another form of e-mail attack is a mail bomb, in which an attacker routes large quantities of e-mail to the target system. This can be accomplished through social engineering (to be discussed shortly) or by exploiting various technical flaws in the Simple Mail Transport Protocol (SMTP).
I also control a portion of Denmark, and since the previous ruler who owned the majority of this land just passed away and his sons did not inherit his fathers powerful allies, it is time to invade. Ohh well I guess Venice looks ripe for another sacking for now:PAnd speaking of a throne of swords, since it is mentioned in the post above mine, someone has made a Game of Thrones mod for this game, I have not checked it out yet, but I saw it and it did pique my curiosity. I also strive to have the entire map look like the image above of the Nomans, except all Norse.We're honestly more Greek and German than Norman at this point. One problem, my councilor has not been able to forge a cassus belli, and it is still in the first decade of the game so there are not that many random title claimants to lure into my court. Centuries of marrying your heirs off to Holy Roman and Byzantine Princesses can have a tendency to muddy the gene-pool a bit.On the bright side though, it did eventually give me the claim on the Byzantine Empire I needed to be able to restore Pax Romana.
The target of the attack receives unmanageably large volumes of unsolicited e-mail. By sending large e-mails with forged header information, attackers can take advantage of poorly configured e-mail systems and trick them into sending many e-mails to an address chosen by the attacker. If many such systems are tricked into participating in the event, the target e-mail address is buried under thousands or even millions of unwanted e-mails.SniffersA sniffer is a program or device that monitors data traveling over a network. Sniffers can be used both for legitimate network management functions and for stealing information from a network. Unauthorized sniffers can be extremely dangerous to a network’s security because they are virtually impossible to detect and can be inserted almost anywhere. This makes them a favorite weapon in the hacker’s arsenal. Sniffers often work on TCP/IP networks, where they are sometimes referred to as packet sniffers.13 Sniffers add risk to the network because many systems and users send information on local networks in clear text.
A sniffer program shows all the data going by, including passwords, the data inside files (such as word-processing documents), and screens full of sensitive data.Social EngineeringWithin the context of information security, social engineering is the process of using social skills to convince people to reveal access credentials or other valuable information to the attacker. This can be done in several ways, and usually involves the perpetrator posing as a person higher in the organizational hierarchy than the victim. To prepare for this false representation, the perpetrator may have used social engineering against others in the organization to collect seemingly unrelated information that, when used together, makes the false representation more credible. For instance, anyone can call the main switchboard of a company and get the name of the CIO, but an attacker may find it just as easy to get even more information by calling others in the company and asserting (false) authority by mentioning the CIO’s name. Social engineering attacks may involve individuals posing as new employees or as current employees who pathetically need assistance to avoid getting fired. Sometimes, attackers threaten, cajole, or beg to sway the target.The Advance Fee Fraud (AFF), internationally known as the “419” fraud, is an example of a social engineering attack.
Named after a section of the Nigerian penal code, these schemes often involve fictitious companies, such as the Nigerian National Petroleum Company, but the perpetrators may invent other entities as well—a bank, a government agency, or a nongovernmental organization, such as a lottery corporation. Funds are stolen from individuals who think they’re participating in money-making ventures; first, they’re asked to send money up front, then they’re charged an endless series of fees. Some 4-1-9 schemes are suspected of involving kidnapping, extortion, and murder, and they have, according to the Secret Service, bilked over $100 million from unsuspecting Americans lured into disclosing personal banking information.The infamous hacker Kevin Mitnick had this to say about attacks: “People are the weakest link. You can have the best technology, firewalls, intrusion-detection systems, biometric devices, then somebody calls an unsuspecting employee. That’s all she wrote, baby.
They got everything.”Buffer OverflowA buffer overflow is an application error that occurs when more data is sent to a buffer than it can handle. During a buffer overflow, the attacker can make the target system execute instructions, or the attacker can take advantage of some other unintended consequence of the failure.
Sometimes, this is limited to a denial-of-service attack, when the attacked system crashes and is (until it is restarted) rendered unavailable to users. In either case, data on the attacked system loses integrity.15 In 1998, Microsoft revealed that Internet Explorer it had been vulnerable to a buffer overflow problem, as described here:Microsoft acknowledged that if you type a res:// URL (a Microsoft-devised type of URL) which is longer than 256 characters in Internet Explorer 4.0, the browser will crash. No big deal, except that anything after the 256th character can be executed on the computer. This maneuver, known as a buffer overrun, is just about the oldest hacker trick in the book.
Tack some malicious code (say, an executable version of the Pentium-crashing FooF code) onto the end of the URL, and you have the makings of a disaster. Timing AttacksThe timing attack works by measuring the time required to access a Web page and deducing that the user has visited the site before by the presence of the page in the browser’s cache. Another attack by the same name is a side channel attack on cryptographic algorithms using measurements of the time required to perform cryptographic functions.