Case Study : Adobe Flash Player Buffer Overflow

On April 4th of this year, Microsoft issued security bulletin MS15-034; this security bulletin explains a vulnerability that “could allow remote code execution if an attacker sends a specially crafted HTTP request to an affected Windows system.” Later, on June 9th, Microsoft issued another security bulletin, MS15-056; this security bulletin explains a vulnerability that “could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who

0-day Vulnerabilities Exploitation – an attack that takes advantage of a vulnerability for which no patch is yet available.

The final issue categorically related to fwbase.DLL on a Windows 7 PC results in a window popping-up stating that – “In no way was the procedure entry point able to get located in the dynamic link library”. This fault message does not let Google Chrome to

Windows 7 client Johan Smith from London UK stated “After the installation of the KB3000850 update on my computer, I am getting Windows Imaging Component crashes. The w3wp.exe application crashes seem to have the 0x54504e26 application error code, with the corrupted module hal.dll being mentioned. Restarting the computer, I get the error code 0x54504e26 again with the logonui.exe error and I fail to log onto my computer normally”.

In 15 October, 2014 this attack was identified by Google security team under the vulnerability CVE-2014-3566 in SSLv3 protocol. In this POODLE attack the bug has been found that exploited the intercept data that is supposed to be encrypted between system and the server. According to the researchers who found the bud, an attacker/Hacker interferes between the computer and the server with the handshake process. This handshake process is used to verify which cryptography protocol the server can accept using a “protocol downgrade dance”. By doing this the computers are forced to use the older SSL 3.0 protocol to protect data that is being sent. Hackers can then easily exploit the bug by carrying out a man-in-the-middle (MITM) attack to decrypt secure HTTP cookies, which could let them steal information or take control of the victim’s online accounts. The information to test websites weather they are affected with POODLE was given by the

Which tool and application were used to exploit the identified vulnerability on the targeted Microsoft® Windows 2003 XP server?

The attack performed on the network had the intention of making the online services provided to students unusable during a critical time of need for those systems. The attack was first performed by acquiring the Administrator password for the systems and using each system to perform a large quantity of requests for service to the web servers. By dissecting what occurred steps can be put in place to prevent such an attack in the future. This attack can be summarized in a few bullets:

Heartbleed is a security bug named after the Heartbeat request that is used for communication between computers. This bug was present in OpenSSL that is used in implementation of Transport Layer Security (TLS). It was first noticed in 2012 and was confirmed in 2014. This was registered under Common Vulnerability Exposure (CVE) databases as CVE-2014-0160. This was also known as “buffer over read vulnerability”, condition in which more data is being exposed than required. Heartbleed patch was released on April 7, 2014 and on that day only Heartbleed was disclosed publicly.

To address vulnerability plugin 106800 / KB4074594 Cumulative Update, the Web Developer obtained and installed this on servers: ReportsPW1, GTN-WDS-APP-P01, EGTN-DMZSQL-01, EGTN-WDS-WEB1.

After initial intrusion malicious software is installed on victim host that is re-ferred as RAT (remote access Trojan). RAT takes the responsibility to connect with attacker and regularly performed the actions that instructed by attacker. At this intruder take the full command and control (C2) over target host. The fact is that the initial connection is established by victim host, not by the attacker [6]. This will happens mainly for two reasons: (i) organizations firewall usually allows the connections initialized by internal hosts, and (ii) this will help the attacker to not to detected easily. Because intrusion detection systems [7] can easily detect the extremely suspicious activity such as downloads from outside hosts.

8. Resolution: A final update on how the issue was resolved and how it can be prevented in the future. This will also serve as a reference for similar

The investigation after an incident allows the organization to identify the attacker, tools used in the attack, the vulnerability that was exploited, and the damage caused by the attack. This post-mortem

Injection Attacks where the attacker deposits the scripts into a web request to execute at the client-end (Wadlow, 2009).

or Israel, that Israeli intelligence tested aspects of the worm using centrifuges identical to Iran's at Israel’s Dimona complex. Even Siemens the German company cooperated with Idaho National Laboratories in the US to identify the vulnerabilities of computer controllers that the company sells to operate industrial machinery around the world. Not too long afterwards, those very vulnerabilities were exploited by Stuxnet.

By the year of 2016, investments in online security are expected to reach $86bn (Contu et al, 2012). Although this might seem a large sum of money, it is considered necessary since there is an increase in online risks from all over the world. Professional hackers develop malware on a global scale and on a 24/7 basis. Hackers have five objectives when spreading malware over the Internet: to infect/distribute, to steal, to persist, to control and for intelligence (Morris, 2010).