Speaker : ???

1
?????????

• Speaker ???
• E-mail dou_at_wns.ice.cycu.edu.tw

2
??

• ??
• ???????
• ????
• ????
• ????
• ??
• ???????

3
??

• ????????????????,??????
• ?????????
• ?????????????????????,??????????
• ????????????????
• ??????,???Windows??????
• ????????
• ???????????

4
(No Transcript)
5
????

• ????????????????????
• ?????? (ex. whois?nslookup ) ?????IP address
• ????????????alive???????

6
??/??

• ????????????,?????????(??????????????),???????????
  ???????,?????????
• IP spoofing
• ?? spoofing ??????????? IP ??,???????(??????)?????

7
??

• ??????????,???????,????????????????
• ????????????????????????????????????????
• ??????????????????????????,??????????

8
??

• ???????????(?Sniffer?)?????????????????,??????????
  ,??????????,?????????
• ????,??????????????,?????????(?????????)?????,????
  ?????????????????

9
(No Transcript)
10
?????

• ?????????,???????????,??????????????,?????????????
  ??
• ???????????????????????,??????,????(Dictionary
  File)??????????????,???????????????

11
????

• ???????????????????,?????????,????????????????????
  ??????????????,???????(buffer overflow)??????

12
????

• ?????????????(??????????),????????????????,???????
  ????

13
????

• ??????????????????????????
• ????????????????,??????,????????????????,?????????
  ,???????????,?????????????????

14
(No Transcript)
15
????

• ??????????,?????????,??????????????,????????????,?
  ????????????
• ??????????????,?????????????,?????????????????

16
??

• ??
• ???????
• ????
• ????
• ????
• ??
• ???????

17
????

• ???? (Scanning attack)
• ????? (Trojan Horse)
• ???? (Phish attack)
• ??????
• ??????? (Buffer Overflow attack)
• ?????? (Denial of Service attack, DoS)
• DDoS

18
???? (Scanning attack)

• ?????????,????????????????????????????
• ???????????,???????,??????????????,???????????????
  ?????

19
????? (Trojan Horse)

• ???????????????????,???????????????,??????????????
  ??????????
• ?????????????(port) ,??????????????????????????
• ??????????????????,??????????????
• ?????????????,???????
• ?????????????,??????????
• FTP ??????????????????????????????

20
????(Phish attack)

• ????????????,????????????????????????
• ?????????????

21
??????

• ??????????????????????,???????,??????????????????
• ????????????????????,???????????????????????
• IIS (Internet Information Services)
• ???????????????????,?????????????,??Web?????????II
  S 5.0???????,????????????????
• ??IIS??????????IIS???????????
• Codered, Nimda

22
??????? (Buffer Overflow attack)

• ???????????????????,??????????buffer????????????,?
  ????????????,??????????
• ??????,??????????,?????????????????????

23
?????? (Denial of Service attack, DoS)

• ??TCP/IP????????????????????????????????????,?????
  ??????,???????
• Bandwidth consumption???????packet,?victim??????,
  ????????????
• System resource starvation???????????????,???????
  ????????,?????????????????
• Exceptional condition exploitation???????????????
  ??????????????,??????????,????????????????
• Routing and Domain Name Service(DNS)
  manipulation????????,??????????????????

24
?????????(Distributed Denial of Service, DDoS)

• ???????????????,?????????????????????,??????

25
??

• ??
• ???????
• ????
• ????
• ????
• ??
• ???????

26
????

• Netcat
• Sniffer(???)
• Microsoft Baseline Security Analyzer
• Ethereal

27
Netcat

• Netcat?TCP/UDP????,Netcat???????????????
• ?????????,??????????
• ?????????TCP/UDP??
• ??????????????????,??????????????
• ????????????,???????

28
Sniffer(???)

• ?????????????????,??????LAN?????????,?????
• ????????

29
Microsoft Baseline Security Analyzer

• ????(????????)?????Microsoft????,?????????????,???
  ??????????
• Windows vulnerabilities?? Windows(2000/XP/2003)?
  Office(2000/XP/2003)???????
• Weak passwords?? Windows??????????
• IIS vulnerabilities?? Internet Information
  Services ???????
• SQL vulnerabilities?? SQL Server ???????
• Security Updates????????????????????

30
Ethereal (Wireshark)

• ???????????,???????????????
• ???????????????????????????
• ????????

31
(No Transcript)
32
??

• ??
• ???????
• ????
• ????
• ????
• ??
• ???????

33
????

• ???????????,????Windows?Fedora ????????
• ???????????????

34
????

• ????????????????,????????????????????????????????
• ???????????????,??????Ethereal????????????
• ????????,????????????????,?????????????????????

35
??

• ??
• ???????
• ????
• ????
• ????
• ??
• ???????

36
????

• ?????????
• ??????????
• ??????,?????????
• Shellcode, ??????????
• Ethereal????????
• ??????????

37
??????

• Cgichk/Cgichk-11b/Cgiscan
• ????????????CGI???
• Httpver
• ?????IP??,????????????????
• Inetinfo
• ???????????????,?????????????????????????

38
??????

• Snakdos
• ???????????,????????9889??????
• ??????????????????????????????

39
Phish ????

• Ntlm_telnetd
• ??????????????,????????telnet???????????
• ?????IP???????,?????,????IP??????????

40
????????

• IIS-zang
• ????IIS 4.0 and 5.0??????,?????????URL,??????????
  ???
• ???????????,??????????,?????????
• MS05-002
• ????????????????,???????????????????????,????????
  ???
• ??????????????

41
Buffer overflow ????

• dcom
• ????Microsoft Windows DCOM RPC??????????
• ????????
• Ex_servu
• ??Serv-U MDTM??,??????????????????MDTM???????????
  
• ????????

42
DoS ???? (Ping of Death)

• ???? ping ????65536 bytes???, ?? buffer overflow
• ??ping server ?? or ?? reset

43
DoS ???? (SYN Flooding Attack)

• ???? three way handshake ?????????IP,?? server
  ?? SYN ?????IP????,server ???? ACK ??????????
  server ??????? (half-open) ???????? server
  ????????
• ???????????,????????????

44
DoS ???? (Land Attack)

• ??DoS ??
• ???????????,????IP Spoofing????????????????????
  
• ???????

45
DoS ???? (Teardrop Attack)

• ??DoS ??
• ??????????????,???????????
• ???????

46
??

• ??
• ???????
• ????
• ????
• ????
• ??
• ???????

47
??

• ????????????????????,???????
• ???????????
• ??????????
• ????????????????????

48
??

• ??
• ???????
• ????
• ????
• ????
• ??
• ???????

49
??

• ??????,???????
• ?????????log? ????
• dou_at_wns.ice.cycu.edu.tw
• ??????????(ex.??????9627000)
• ???????????
• ???????????(ice_summer)
• Dateline8/20

50
????

• ??(?????????)
• ????
• ????
• ????
• ????
• ????
• Shellcode
• ?????
• ????
• ??Ethereal log??????,???
• ??

51
????

• ????
• http//www.cert.org/
• http//www.securityfocus.com/
• http//nvd.nist.gov/
• http//www.icst.org.tw/
• ????
• http//www.securityforest.com/cgi-bin/viewcvs.cgi/
  
• http//www.security.nnov.ru/
• http//milw0rm.com
• https//forum.eviloctal.com/