week#03 Lecture #02.pptx, computer scien

week#03 Lecture #02.pptx, computer scien

• 1.
  Information Security SE- 308 Week3(Lecture#02)
• 2.
  Software Attacks – Introduction –Attack – Types of Attacks – Active Attacks – Passive Attacks
• 3.
  Active Attacks (Cont’d) 10.Man-in-the-Middle attack • In a Man-in-the-Middle (MitM) attack, the attacker places himself between two communicating persons or systems, serving as an intermediate to stop and change the shared data without their knowledge. • MitM attacks can occur in several scenarios, such as on unsecured Wi-Fi networks, compromised routers, or through the use of malicious software.
• 4.
  Man-in-the-Middle
• 5.
  Active Attacks (Cont’d) 11.Spam • Spam is unwanted advertisements or promotional e-mails. • Sometimes, spam emails can also be dangerous because they might contain viruses or other harmful software. • Many organizations try to manage these spam emails by using e-mail filtering technologies.
• 6.
  Active Attacks (Cont’d) 12.Mail Bombing • In a Mail Bombing attack, the attacker sends a large volume of emails to a target their email server or mailbox. • The goal is to damage the email service, consume server resources, and potentially make the target's email account or system inaccessible to users.
• 7.
  Mail Bombing
• 8.
  Active Attacks (Cont’d) 13.Phishing • In a phishing attack, attackers use fake emails, links or messages pretending to be from trusted places to trick you into giving away personal information such as usernames, passwords, or credit card details. • Relies on fake emails or websites that mimic trusted institutions (like banks, social media sites). • Example: • You receive an email claiming to be from your bank, asking you to click a link to verify your account. The link directs you to a fake website designed to steal your login details.
• 9.
  Active Attacks (Cont’d) 14.Social Engineering Attack: • Social engineering involves manipulating or tricking people into revealing confidential information. • Attackers use psychological manipulation to convince victims to provide sensitive data or perform actions (e.g., sharing passwords or installing malware). • This can happen through direct interaction, like a phone call, physical interactions, or indirectly through email or messaging. Example: • If someone calls you pretending to be from your bank and informs you about an issue with your ATM card, asking you to verify or provide personal details to unblock it, be careful. This could be a social engineering strategy aimed at tricking you into revealing sensitive information.
• 10.
  Passive Attacks 1. Trafficanalysis • Traffic analysis is a method used to monitor and analyze patterns, volumes, and trends in network traffic without capturing the actual content of the data packets. • Instead of examining the content of communications, traffic analysis focuses on observing communication patterns to gain insights into network behavior, user activities, and communication dynamics.
• 11.
  Passive Attacks (Cont’d) 2.Release of message content • The release of message content refers to the unauthorized disclosure, or exposure of the actual content of a message, communication, or data transmission to unauthorized entities. • This can occur when sensitive or confidential information in a message is exposed, made public, or accessed without authorization.
• 12.
  Release of messagecontent
• 13.
  Passive Attacks (Cont’d) 3.Sniffer • The attacker captures and analyzes the actual data packets transmitted over a network to inspect their content for extraction of information especially on TCP/IP networks where they are often referred to as packets. • Example: Capturing and examining the data packets exchanged between a user's device and a web server.
• 14.
  Passive Attack (Cont’d) 4.Timing Attack • A timing attack is a type of attack where an attacker attempts to observe secret information such as a cryptographic or secret key by analyzing the time taken by a system to perform cryptographic operations.
• 15.
  Passive Attack (Cont’d) 5.Shoulder Surfing • Observing or spying on individuals as they enter or view sensitive information such as passwords, and personal identification numbers PINs in public places or shared environments. • Example: • An example of shoulder surfing would be if you're at an ATM and someone behind you is watching as you enter your PIN. They can later use that information to access your bank account.
• 16.
  Shoulder Surfing
• 17.
  Passive Attack (Cont’d) 6.Video Surveillance: • Monitoring and recording video footage of individuals, locations, or activities using surveillance cameras, CCTV systems, or other monitoring devices without their knowledge or consent. Example: • Use hidden cameras or surveillance systems to spy on employees, customers, or visitors in public or private spaces.
• 18.
  Thank you