Module 2

Topics:
Security in Networks – Concepts, threats in Network, website vulnerabilities, man in the
middle attack, denial of Service attack, distributed denial of service attack, Firewalls –
introduction and design, types of firewalls, personal firewalls, Program Security – non
malicious program errors, malicious program flaws, virus and other malicious code,
prevention of virus infection.
Security in Networks
1. Concepts:
Network security is defined as the activity created to protect the integrity of your network
and data. Network security is the practice of protecting a computer network from
unauthorized access, misuse, or attacks. It involves using tools, technologies, policies, and
procedures to ensure the confidentiality, integrity, and availability of systems and data
within the network to ensure that data traveling over the network is safe and secure,
keeping sensitive information away from hackers and other threats.
1.1 What is a Network Security Key?
A Network Security Key is a set of characters (password) that authorizes a user or device
to access a wireless network. It ensures a secure connection between the serving
network (such as a Wi-Fi router or access point) and the requesting client (such as a
laptop, smartphone, or IoT device).
 It protects the network from unauthorized access.
 It ensures that the data transmitted between the device and the network is
encrypted and secure.
 Commonly referred to as a Wi-Fi password or wireless security key.
1.2 Network security model
For a message to be sent or receive there must be a sender and a receiver. Both the
sender and receiver must also be mutually agreeing to the sharing of the message. Now,
the transmission of a message from sender to receiver needs a medium i.e. Information
channel which is an Internet service.
A logical route is defined through the network (Internet), from sender to the receiver and
using the communication protocols both the sender and the receiver established
communication.
Any security service would have the three components:
1. Transformation of the information which has to be sent to the receiver. So, that
any opponent present at the information channel is unable to read the message.
This indicates the encryption of the message.
It also includes the addition of code during the transformation of the
information which will be used in verifying the identity of the authentic receiver.
2. Sharing of the secret information between sender and receiver of which the
opponent must not any clue. Yes, we are talking of the encryption key which is
 used during the encryption of the message at the sender’s end and also during
the decryption of message at receiver’s end.
3. There must be a trusted third party which should take the responsibility
of distributing the secret information (key) to both the communicating parties
and also prevent it from any opponent.

2. Threats in Network
2.1 Malware Threats
Malware is malicious software made to damage or take over your computer. It can
spread fast and cause big problems.
 Viruses are self-replicating programs that attach themselves to other programs or
files on host computers. They spread through infected media like songs, videos, or
software downloads. Notable examples include file viruses, macro viruses, boot
sector viruses, and stealth viruses.
 Worms share self-replicating capabilities with viruses but operate independently
without attaching to host programs. Their key distinction is network awareness—
they can travel between connected computers, typically consuming system
resources and slowing performance rather than causing direct damage.
 Bots represent an advanced form of worms, once deployed by an attacker, can
operate automatically without further human intervention on each infected
machine.
2.2Privacy and Surveillance Threats
Some threats quietly spy on what you do and steal your personal information. Being
aware helps you keep your privacy safe.
  Adware may not be explicitly malicious, but it violates user privacy by displaying
advertisements on desktops or within programs. These programs often accompany
free software and monitor user interests to display targeted ads. Attackers can
embed malicious code within adware to monitor system activities and potentially
compromise machines.
 Spyware consists of programs that monitor computer activities and transmit
collected information to interested parties. These programs are typically
distributed through trojans, viruses, or worms. Keyloggers represent a common
spyware example, recording user keystrokes with timestamps to capture sensitive
information like usernames, passwords, and credit card details.
 Zombies operate similarly to spyware but focus on awaiting commands from
hackers rather than stealing information. These infected systems can be remotely
controlled to participate in coordinated attacks.
2.3Extortion and Deception Threats
Some attacks trick or scare you into paying money or giving access. Protecting yourself
means staying alert and using good security tools.
 Ransomware encrypts files or locks computer systems, making them partially or
completely inaccessible. Victims receive demands for payment in exchange for
system restoration, making this one of the most financially motivated cyber
threats.
 Scareware masquerades as legitimate system repair tools but actually infects or
destroys systems upon execution. These programs display frightening messages to
pressure users into paying for fake system fixes.
  Rootkits are designed to gain administrative privileges within user systems. Once
root access is obtained, attackers can steal private files, access sensitive data, or
maintain persistent system control.
3. website vulnerabilities
Vulnerabilities are weaknesses in a system that allow threats to compromise an
individual's or an organization’s assets. As the attackers are leveling up their attacking
mechanisms, the number of vulnerable assets is increasing, too. These could include
code, human weaknesses, unpatched software, and improper authentication
mechanisms, among others.
Type of Vulnerabilities
1. Hardware Vulnerability:
Weaknesses or flaws in physical devices (like computers or routers) that hackers can
exploit to gain unauthorized access or cause damage.
For example:
 Physical Attacks: Hardware devices like servers, laptops, or smartphones are
susceptible to physical attacks. Attackers may gain access to critical systems by
stealing or tampering with hardware.
 Firmware Vulnerabilities: The software that runs on hardware, known as firmware,
can have vulnerabilities. Flaws in firmware can lead to persistent attacks, as they
are not always detected or patched as frequently as software.
Causes of Hardware Vulnerability
 Old versions of systems or devices
 Unprotected storage
 Unencrypted devices.
2. Software Vulnerability:
Flaws or bugs in software (such as apps or operating systems) that can be used by
hackers to compromise the system, often due to coding mistakes or outdated software.
For example:
 Unpatched Software: One of the most common vulnerabilities is the failure to
install security updates or patches. Software vendors frequently release updates to
address security flaws, and neglecting to apply these patches can leave systems
open to exploitation.
 Buffer Overflow: A buffer overflow occurs when data is written beyond the
boundaries of a buffer, leading to unexpected behavior and allowing attackers to
inject malicious code into the system.
Causes of Software Vulnerabilities
 Lack of input validation
 Unverified uploads
 Cross-site scripting
 Unencrypted data
3. Network Vulnerability:
Weak points in a computer network, like unsecured Wi-Fi, open ports, or misconfigured
firewalls, that attackers can be exploited to gain unauthorized access or intercept
sensitive information.
For example:
 Open Ports: Unnecessary or open ports on a device can serve as gateways for
attackers to exploit. Proper configuration of firewalls is essential to ensure only
necessary ports are open and accessible.
 Man-in-the-Middle (MITM) Attacks: In MITM attacks, attackers intercept and alter
the communication between two parties. If sensitive information such as login
 credentials or financial data is transmitted unencrypted, it can be captured and
misused.
Causes of Network Vulnerability
 Unprotected communication
 Malware or malicious software (e.g.: Viruses, Keyloggers, Worms)
 Social engineering attacks
 Misconfigured firewalls.
4. Human Vulnerabilities
Security risks caused by human behavior, such as falling for phishing attacks, using weak
passwords, or not being aware of security threats, making it easier for hackers to exploit
the system.
For Example:
 Social Engineering: Human behavior is often the weakest link in cyber security.
Attackers use social engineering tactics to manipulate individuals into disclosing
confidential information or performing actions that compromise security. Phishing,
baiting, and pretexting are common social engineering methods.
 Negligence: Employees or users may inadvertently introduce vulnerabilities
through negligence, such as using weak passwords, sharing login credentials, or
failing to lock their devices when not in use. This makes them easy targets for
attackers.
 Lack of Security Awareness: A lack of training and awareness about cyber security
best practices can leave individuals and organizations vulnerable to attacks. Users
may fail to recognize phishing emails or may click on malicious links without
thinking.
4. Man in the middle attack
A man-in-the-middle (MitM) attack is a form of cyberattack in which criminals exploiting
weak web-based protocols insert themselves between entities in a communication
channel to steal data.

1. Email hijacking
As its name implies, in this type of attack, cyber criminals take control of the email
accounts of banks, financial institutions, or other trusted companies that have access to
sensitive data—and money. Once inside, attackers can monitor transactions and
correspondence between the bank and its customers.
In more malicious scenarios, attackers spoof, or fake, the bank's email address and send
customers emails instructing them to resend their credentials—or worse, send money—
to an account controlled by the attackers. In this MitM attack version, social engineering,
or building trust with victims, is key for success.
2. Wi-Fi eavesdropping
In Wi-Fi eavesdropping, cyber criminals get victims to connect to a nearby wireless
network with a legitimate-sounding name. But in reality, the network is set up to engage
in malicious activity. The wireless network might appear to be owned by a nearby
business the user frequents or it could have a generic-sounding, seemingly harmless
name, such as "Free Public Wi-Fi Network." In some cases, the user does not even need
to enter a password to connect.
Once victims are connected to the malicious Wi-Fi, the attacker has options: monitor the
user's online activity or scrape login credentials, credit or payment card information, and
other sensitive data.
To guard against this attack, users should always check what network they are connected
to. With mobile phones, they should shut off the Wi-Fi auto-connect feature when
moving around locally to prevent their devices from automatically being connected to a
malicious network.
3. DNS spoofing
Domain Name System (DNS) spoofing, or DNS cache poisoning, occurs when
manipulated DNS records are used to divert legitimate online traffic to a fake or spoofed
website built to resemble a website the user would most likely know and trust.
As with all spoofing techniques, attackers prompt users to log in unwittingly to the fake
website and convince them that they need to take a specific action, such as pay a fee or
transfer money to a specific account. The attackers steal as much data as they can from
the victims in the process.
4. Session hijacking
Session hijacking is a type of MitM attack in which the attacker waits for a victim to log in
to an application, such as for banking or email, and then steals the session cookie. The
attacker then uses the cookie to log in to the same account owned by the victim but
instead from the attacker's browser.
A session is a piece of data that identifies a temporary information exchange between
two devices or between a computer and a user. Attackers exploit sessions because they
are used to identify a user that has logged in to a website. However, attackers need to
work quickly as sessions expire after a set amount of time, which could be as short as a
few minutes.
5. Secure Sockets Layer (SSL) hijacking
Most websites today display that they are using a secure server. They have "HTTPS,"
short for Hypertext Transfer Protocol Secure, instead of "HTTP" or Hypertext Transfer
Protocol in the first portion of the Uniform Resource Locator (URL) that appears in the
browser's address bar. Even when users type in HTTP—or no HTTP at all—the HTTPS or
secure version will render in the browser window. This is a standard security protocol,
and all data shared with that secure server is protected.
SSL and its successor transport layer security (TLS) are protocols for establishing security
between networked computers. In an SSL hijacking, the attacker intercepts all data
passing between a server and the user’s computer. This is possible because SSL is an
older, vulnerable security protocol that necessitated it to be replaced—version 3.0 was
deprecated in June 2015—with the stronger TLS protocol.
[Link] cache poisoning
The Address Resolution Protocol (ARP) is a communication protocol used for discovering
the link layer address, such as a media access control (MAC) address, associated with a
given internet layer address. The ARP is important because it translates the link layer
address to the Internet Protocol (IP) address on the local network.
In this scheme, the victim's computer is tricked with false information from the cyber
criminal into thinking that the fraudster's computer is the network gateway. As such, the
victim's computer, once connected to the network, essentially sends all of its network
traffic to the malicious actor instead of through the real network gateway. The attacker
then utilizes this diverted traffic to analyze and steal all the information they need, such
as personally identifiable information (PII) stored in the browser.
7. IP spoofing
IP spoofing is similar to DNS spoofing in that the attacker diverts internet traffic headed
to a legitimate website to a fraudulent website. Instead of spoofing the website’s DNS
record, the attacker modifies the malicious site's IP address to make it appear as if it is
the IP address of the legitimate website users intended to visit.
8. Stealing browser cookies
In computing, a cookie is a small, stored piece of information. A browser cookie, also
known as an HTTP cookie, is data collected by a web browser and stored locally on a
user's computer. The browser cookie helps websites remember information to enhance
the user's browsing experience. For example, with cookies enabled, a user does not have
to keep filling out the same items on a form, such as first name and last name.
5. Denial of Service attack
The term DOS refers to a form of attacking computer system over a network. It is
normally a malicious attempt to make a networked system unable to function but
without permanently damaging it.  A Denial of Service attack aims at preventing
legitimate users from authorized access to a system resource. The attacker uses
specialized software to send a flood of data packets to the target computer with the aim
of overloading its resources  Denial of Service is currently the most expensive computer
crime for victim organizations:
Classification of DoS Attacks
1. Volume Based attacks or Bandwidth attacks:
 Attacks will consume all available network bandwidth. Every site is given with a
particular amount of bandwidth for its hosting, say for example 50 GB. Now if
more visitors consume all 50 GB bandwidth then the hosting of the site can ban
this site.
 The attacker does the same. Attacker will open 100 pages of a site and keeps on
refreshing and consuming all the bandwidth, thus the site become out of service.
 Eg: UDP floods, ICMP floods, spoofed packet floods
2. Application layer attacks or Programming flaws:
Failures of applications or OS components to handle exceptional conditions
(unexpected situations or unusual inputs that the software isn’t designed to handle.)
For example:
Oversized Input
Malformed Requests (incomplete HTTP request e.g., GET /[Link] HTT instead of
GET /[Link] HTTP/1.1 )
Unexpected Data Type
Malicious Queries
 Resource-Exhausting Requests (Sending thousands of HTTP GET requests for large
files)
The goal of this attack is to crash the web server.
3. Protocol attacks or Resource starvation:
 Attacks will consume system resources (mainly CPU, memory, storage space)
 Protocols here are rules that are to be followed to send data over network. These
kind of attacks exploit a specific feature or implementation bug of some protocol
installed at the victim’s system to consume excess amount of its resources.
 Eg: TCP SYN floods, fragmented packet attacks, Ping of death, Smurf attack etc..
TCP SYN Flood
 Normally:
1. You → send SYN (Hello, I want to connect).
2. Server → replies with SYN-ACK (Okay, ready).
3. You → send ACK (Thanks, let’s start). ✅ Connection ready.
 Attacker:
o Sends thousands of SYN requests but never completes step 3.
o Server keeps waiting with “half-open” connections → memory fills up →
can’t serve real users.
Ping of Death
 Normal ping packet = small (say 64 bytes).
 Attacker: sends a ping packet that’s too big (more than the allowed 65,535
bytes).
 Old systems couldn’t handle it → system crash or freeze.
Smurf Attack
  Attacker sends a spoofed ICMP request (ping) to a network’s broadcast
address (like shouting in a hall).
 Every computer replies to the victim (thinking they asked).
 Victim is buried in replies → CPU overloaded.
Fragmented Packet Attack
 Normal data is broken into small packets.
 Attacker sends weirdly cut packets that don’t reassemble properly.
 Server wastes CPU/memory trying to reassemble them → resource exhaustion.
4. Unintentional DoS Attack
 A friendly or unintentional DoS attack is when a website experiences such heavy
traffic that users can no longer access the website. This is done when many people
flood to the website and cause the server to crash.
 This may be due to a sudden enormous spike in popularity of a particular website.
 For eg: A celebrity shares a link of a particular website in his/her own social media
page so that a large no of followers visit that particular website and finally leads to
server crash.
6. Distributed denial of service attack
Distributed Denial of Service (DDoS) is a type of DOS attack where multiple systems,
which are trojan infected, target a particular system which causes a DoS attack. A DDoS
attack uses multiple servers and Internet connections to flood the targeted resource. A
DDoS attack is one of the most powerful weapons on the cyber platform. When you
come to know about a website being brought down, it generally means it has become a
victim of a DDoS attack.
Types of DDoS Attacks
There are various types of DDoS attacks mentioned below:
 Volumetric Attacks: Volumetric Attacks are the most prevalent form of DDoS
attacks. They use a botnet to overload the network or server with heavy traffic but
exceed the network’s capabilities of processing the traffic. This attack overloads
the target with huge amounts of junk data. This leads to the loss of network
bandwidth and can lead to a complete denial of service.
 Protocol Attacks: TCP Connection Attacks exploit a vulnerability in the TCP
connection sequence which is commonly referred to as the three-way handshake
connection between the host and the server. The work is explained as follows. The
targeted server receives a request to start with the handshake. In this attack, the
handshake is never accomplished. This leaves the connected port as busy and
unavailable to process any further requests. Meanwhile, the cybercriminal
continues to send multiple requests overwhelming all the working ports and
shutting down the server.
 Application Attacks: Application layer attacks (Layer 7 attacks) target the
applications of the victim in a slower fashion. Thus, they may initially appear as
legitimate requests from users and the victim becomes unable to respond. These
 attacks target the layer where a server generates web pages and responds to HTTP
requests. Application-level attacks are combined with other kinds of DDoS attacks
targeting applications, along with the network and bandwidth. These attacks are
threatening as it is more difficult for companies to detect.
 Fragmentation Attacks: The cybercriminal exploits frangibility in the datagram
fragmentation process, in which IP datagrams are divided into smaller packets,
transferred across a network, and then reassembled. In such attacks, fake data
packets are unable to be reassembled.
Firewalls
1. Introduction and Design
A firewall is a type of network security device that filters incoming and outgoing
network traffic with security policies that have previously been set up inside an
organization. A firewall is essentially the wall that separates a private internal network
from the open Internet at its very basic level.

Working of Firewall
 Firewall match the network traffic against the rule set defined in its table. Once
the rule is matched, associate action is applied to the network traffic. For
 example, Rules are defined as any employee from Human Resources department
cannot access the data from code server and at the same time another rule is
defined like system administrator can access the data from both Human Resource
and technical department.
 Rules can be defined on the firewall based on the necessity and security policies
of the organization.
 From the perspective of a server, network traffic can be either outgoing or
incoming. Firewall maintains a distinct set of rules for both the cases. Mostly the
outgoing traffic, originated from the server itself, allowed to pass. Still, setting a
rule on outgoing traffic is always better in order to achieve more security and
prevent unwanted communication. Incoming traffic is treated differently.
 Most traffic which reaches on the firewall is one of these three major Transport
Layer protocols- TCP, UDP or ICMP. All these types have a source address and
destination address. Also, TCP and UDP have port numbers. ICMP uses type
code instead of port number which identifies purpose of that packet.
2. Types of Firewall
2.1. Packet Filtering Firewall:
Packet filtering firewall is used to control network access by monitoring outgoing and
incoming packets and allowing them to pass or stop based on source and destination IP
address, protocols, and ports. It analyses traffic at the transport protocol layer (but
mainly uses first 3 layers). Packet firewalls treat each packet in isolation. They have no
ability to tell whether a packet is part of an existing stream of traffic. Only It can allow or
deny the packets based on unique packet headers. Packet filtering firewall maintains a
filtering table that decides whether the packet will be forwarded or discarded
2.2. Stateful Inspection Firewall:
Stateful firewalls (performs Stateful Packet Inspection) are able to determine the
connection state of packet, unlike Packet filtering firewall, which makes it more
efficient. It keeps track of the state of networks connection travelling across it, such as
TCP streams. So the filtering decisions would not only be based on defined rules, but
also on packet’s history in the state table.
2.3. Application Layer Firewall:
Application layer firewall can inspect and filter the packets on any OSI layer, up to the
application layer. It has the ability to block specific content, also recognize when certain
application and protocols (like HTTP, FTP) are being misused. In other words, Application
layer firewalls are hosts that run proxy servers. A proxy firewall prevents the direct
connection between either side of the firewall, each packet has to pass through the
proxy.
2.4. Next Generation Firewalls (NGFW):
NGFW consists of Deep Packet Inspection, Application Inspection, SSL/SSH inspection
and many functionalities to protect the network from these modern threats.
2.5. Circuit Level Gateway Firewall:
This works as the Sessions layer of the OSI Model's . This allows for the simultaneous
setup of two Transmission Control Protocol (TCP) connections. It can effortlessly allow
data packets to flow without using quite a lot of computing power. These firewalls are
ineffective because they do not inspect data packets; if malware is found in a data
packet, they will permit it to pass provided that TCP connections are established
properly.
2.6. Software Firewall:
A software firewall is any firewall that is set up locally or on a cloud server. When it
comes to controlling the inflow and outflow of data packets and limiting the number of
networks that can be linked to a single device, they may be the most advantageous. But
the problem with software firewall is they are time-consuming.
2.7. Hardware Firewall:
They also go by the name "firewalls based on physical appliances." It guarantees that
the malicious data is halted before it reaches the network endpoint that is in danger.
2.8. Cloud Firewall:
These are software-based, cloud-deployed network devices. This cloud-based firewall
protects a private network from any unwanted access. Unlike traditional firewalls, a
cloud firewall filters data at the cloud level.
3. Personal firewalls
 A personal firewall is an application which controls network traffic to and from a
computer, permitting or denying communications based on a security policy.
[1]
Typically it works as an application layer firewall.
 A personal firewall differs from a conventional firewall in terms of scale. A personal
firewall will usually protect only the computer on which it is installed, as compared
to a conventional firewall which is normally installed on a designated interface
between two or more networks, such as a router or proxy server.
 personal firewalls allow a security policy to be defined for individual computers,
whereas a conventional firewall controls the policy between the networks that it
connects.
 The per-computer scope of personal firewalls is useful to protect machines that are
moved across different networks.
 For example, a laptop computer may be used on a trusted intranet at a workplace
where minimal protection is needed as a conventional firewall is already in place,
and services that require open ports such as file and printer sharing are useful.
  The same laptop could be used at public Wi-Fi hotspots, where it may be necessary
to decide the level of trust and reconfigure firewall settings to limit traffic to and
from the computer. A firewall can be configured to allow different security policies
for each network.
Program Security
Non-malicious program errors
Being human, programmers and other developers make many mistakes, most of which
are unintentional and non-malicious.
Many such errors cause program malfunctions but do not lead to more serious security
vulnerabilities.
The most important classes of non-malicious program errors are:
 Buffer Overflow Errors
 Incomplete Mediation
 Race Conditions (Time-of-Check to Time-of-Use)
 Poor Error Handling
Buffer Overflow Error
A buffer (or array or string) is a space in which data can be held. A buffer resides in
memory. Because memory is finite, a buffer's capacity is finite. For this reason, in many
programming languages, the programmer must declare the buffer's maximum size so
that the compiler can set aside that amount of space.
For Example:
char sample[10];
sample[10] = 'A';
The subscript is out of bounds (that is, it does not fall between 0 and 9), so we have a
problem
In some programming languages, buffer sizes need not be predefined.
C and similar languages do not perform array bound checking
Similar problems caused by pointers for which there is no way to define a proper limit
Damage caused by Buffer Overflow
Overwrites:
 User’s data.
 User’s code (instructions).
 System data (OS data).
 System code (OS instructions).
Implications of buffer overflow
 Attacker can insert malicious data values/instruction codes into overflow space.
 C programming language specifications do not specify how data is to be laid out
in memory.
 Some implementations of C may leave space between arrays and variables on
the stack, for instance, to minimize aliasing effects.
Incomplete Mediation
Failure to validate or check input/output data completely before processing.
Security Implication: Unchecked inputs become serious vulnerabilities.
Example 1 – Data Type Errors
Passing invalid values like 1800Feb30 or 2048Min32 may cause:
 Data type errors.
 Incorrect results.
 Unexpected program behavior.
Example 2 – E-commerce Site
 A genuine order:
[Link]
final&custID=101&part=555A&qy=20&price=10&ship=boat&shipcost=5&total=205
 An attacker manipulates it to reduce the price:
[Link]
final&custID=101&part=555A&qy=20&price=1&ship=boat&shipcost=5&total=25
The attacker could order products at any price.
Key Problem
 Such flaws can remain undetected for long periods, leading to financial and data
loss.
Race Conditions
A race condition happens when the system’s output depends on the sequence or
timing of events that run in parallel.
If two processes or threads access the same data without proper synchronization, the
result may be unexpected or wrong.
Ex: Time-of-Check to Time-of-Use, TOCTTOU
Definition: Occurs when there is a delay between checking a condition and using the
result, allowing attackers to alter the state in between.
Also known as a serialization flaw or synchronization error.
Example:
Initial state: X = 10
Program 1 steps: Program 2 steps (happening at the same time):
1. Reads X = 10. 1. Reads X = 10
2. Plans to update X as X = X + 5 → (before Program 1 writes the new value).
(10 + 5 = 15). 2. Plans to update X as X = X + 3 →
3. Intends to write 15 back (10 + 3 = 13).
into memory. 3. Writes 13 back into memory.
Sequence of events (interleaved):
1. Program 1 reads X = 10.
2. Program 2 reads X = 10.
3. Program 2 writes X = 13.
4. Program 1 writes X = 15.
Final Value in Memory: X = 15
But logically, if both operations had been executed in sequence (one after the other),
we expect: X = 10 + 5 + 3 = 18
But due to the race condition, the actual result is: X=15, One program’s update
overwrites the others.
Why is this a Security Risk?
Incorrect Results: The value stored is wrong because the operations overlapped.
Access Control Risk:
Imagine Program 1 checks, “Is user allowed to access File A?” → answer = YES.
Before Program 1 actually uses File A, an attacker replaces File A with File B (bait and
switch).
Now Program 1 uses File B without re-checking permissions.
This is exactly the TOCTTOU flaw: Time of Check is different from Time of Use
Example 1: File System Exploit:
A privileged program checks if a file is safe.
An attacker quickly swaps the file with a malicious one before the program opens it.
The malicious file now runs with elevated privileges.
Example 2: Banking Transaction:
System checks balance = ₹1000.
Two withdrawal requests (₹800 and ₹400) come simultaneously.
Both are approved since both checked the balance before any update.
Account ends up negative, which should never happen
Prevention
 Locking/Serialization: Ensure only one process can access the resource at a
time.
 Atomic Operations: Perform check-and-update as a single indivisible step.
 Digital Signatures/Certificates: Lock values after verification, so they can’t be
swapped later.
TOCTTOU errors occur when there’s a time gap between checking a condition and
using the result. Attackers exploit this gap to change things in between.
Poor Error Handling
Error handling is how a program responds to unexpected situations (e.g., invalid
input, missing files, failed network connections).
 Good error handling → Program handles gracefully, hides sensitive details, logs
properly.
 Poor error handling → Program exposes sensitive system details, crashes, or
behaves unpredictably.
Why It’s a Security Problem?
 Attackers often use error messages to gather information about the system.
 Poorly handled errors may lead to:
o Information disclosure.
o Application crashes.
o Exploitation of vulnerabilities.
Examples of Poor Error Handling
1. Detailed Error Messages Revealing System Info
Example:
Error: SQL syntax error near 'username=admin'
Reveals the system is using SQL database, and even part of the query.
Attackers can use this for SQL injection attacks.
2. Application Crashes on Invalid Input
 If a program crashes when given unexpected input, attackers may repeatedly
test it to find buffer overflows or memory leaks.
3. Uncaught Exceptions
 In Java/Python/C#, if exceptions are not caught, the system may print a full
stack trace, exposing:
o File paths.
o Function names.
o Library versions.
o Which can help attackers plan further attacks.
4. Default Error Pages in Web Applications
 Example: A 404 error page showing:
Apache Tomcat/9.0.21 - Error report
Reveals the exact web server software and version, which can be targeted with
known exploits.
Security Implications
 Information Disclosure: Attackers learn about database type, server software,
file paths, etc.
 Denial of Service (DoS): If errors cause crashes, attackers can repeatedly
trigger them.
  Privilege Escalation: Improperly handled errors may let attackers bypass
restrictions.
Best Practices / Prevention
1. Generic Error Messages for Users
o Show simple messages like:
o "Something went wrong. Please try again later."
o Do not reveal system details to end-users.
2. Detailed Logging for Administrators
o Internally record:
 Timestamp.
 Error type.
 Stack trace.
o Logs should be protected (only admins can access).
3. Validate Input Before Processing
o Prevents errors caused by malicious/unexpected inputs.
4. Fail-Safe Defaults
o If an error occurs, deny access instead of granting it by mistake.
5. Secure Coding Practices
o Catch exceptions properly.
o Avoid verbose debug information in production.
o Use structured error-handling techniques (e.g., try-catch blocks).
Malicious Program Flaws
Unlike non-malicious errors (which are unintentional mistakes by developers),
malicious program flaws are introduced deliberately by attackers, insiders, or even
careless programmers with harmful intent.
They are designed to damage systems, steal data, or bypass security controls.
A virus is a program that can pass on malicious code to other non-malicious programs
by modifying them.
The term "virus" was coined because the affected program acts like a
biological virus: It infects other healthy subjects by attaching itself to the
program and either destroying it or coexisting with it.
A good program can be modified to include a copy of the virus program, so
The infected good program itself begins to act as a virus, infecting other
programs.
Flaws that attackers deliberately exploit or insert:
Logic Bombs
A Logic Bomb is a piece of malicious code hidden inside a legitimate program,
designed to execute a harmful function, triggered when certain conditions are met
(like a specific date, user action, or system event).
It stays dormant until its trigger condition activates
Once triggered, performs harmful actions (delete files, corrupt data, disable
systems).
Trigger conditions can be:
 A specific date or time (e.g., April 1st).
 A specific event (e.g., user deletes a file, system restart).
 A system state (e.g., CPU usage > 90%).
Once activated, it performs malicious actions such as:

 Deleting or corrupting files.

 Formatting disks.
 Shutting down services.
  Disabling security software.

Example: Employee Revenge Case

An insider inserts a logic bomb:
“If my name is removed from payroll, delete all HR records.”
 Trigger condition: employee’s termination.
 Effect: wipes out the company’s employee database.
 Security Risk:
o Hard to detect because it looks like normal code.
 Prevention:
o Code reviews and integrity checks.
o Separation of duties in development teams.
Backdoors (Trapdoors)
A hidden entry point in a program that bypasses normal authentication and security
controls.
 Purpose: Originally used for debugging/testing, but attackers exploit or
intentionally insert them.
Example:
A programmer writes:
if (username == "admin" && password == "letmein") { grant_access(); }
 Security Risk:
o Attackers use backdoors for unauthorized access.
o Often installed by malware after infection.
 Prevention:
Regular Code Audits: Inspect source code for hidden accounts or insecure logic.
Vulnerability Scanning: Detect known backdoor patterns in software.
Trojan Horses
A Trojan Horse is a type of malicious software that appears to be useful or legitimate
but secretly performs harmful actions.
The name comes from the Greek myth of the “Trojan Horse,” where attackers hid
inside a wooden horse to sneak into Troy.
Similarly, a Trojan tricks users into installing it voluntarily, not realizing it contains
hidden malicious code.
Characteristics:
 Disguised as games, utilities, apps, or free downloads.
 Users voluntarily install them, not knowing the hidden intent.
 Often spread through email attachments, fake websites, or pirated software.
 Do not replicate themselves like viruses or worms.
 Rely on social engineering (tricking the user) to get installed
Example:
A "Free Antivirus" download that secretly steals passwords.
Other examples include fake “system cleaners,” “cracked games,” or “free
music/video downloads
 Security Risk:
o Data Theft: Trojans can steal passwords, banking details, or private files.
o Backdoor Installation: Some Trojans open secret access points for
hackers.
o Spyware/Ransomware Delivery: Trojans often serve as a delivery
method for other malware.
o System Damage: May delete files, slow down systems, or disable security
software.
  Prevention:
o Download software only from trusted sources.
o Use antivirus and endpoint detection.
o Keep software updated: Patch vulnerabilities that Trojans might exploit.
o Firewall Protection: Block Trojans from communicating with remote
servers.
Worms
A worm is a type of malicious program that can self-replicate and spread
automatically across networks without any user interaction.
 Characteristics:
o Self-Replicating: Copies itself across systems without human help.
o Network-Based: Often spread through emails, shared files, or direct
exploitation of network protocols.
o Resource Consumption: Use bandwidth, CPU, and memory, slowing
down networks and devices.
 Famous Examples:
o ILOVEYOU Worm (2000)
 Spread via infected email attachments disguised as a love letter.
 Caused billions in damages worldwide by overwriting files.
o Conficker Worm (2008)
 Exploited Windows vulnerabilities.
 Created a massive botnet of millions of infected computers.
 Security Risk:
o Network congestion, Worms flood networks, slowing down internet and
communication.
 o Overload servers or networks until they crash.
o attackers often load the worm with a “payload” — extra malicious code.
 Prevention:
o Keep systems patched.
o Firewalls and IDS/IPS.
o Email filtering.
Rootkits
A rootkit is a set of malicious tools or programs designed to give attackers hidden,
privileged (root-level) access to a computer or network.
The word comes from “root” (administrator access in Unix/Linux) + “kit” (a collection
of software tools).
 Characteristics:
o Stealthy Operation: Hides files, processes, registry entries, and network
activity.
o Persistence: Survives reboots and stays active for long periods.
o Modification of System Components: May replace system binaries or
drivers with malicious versions to avoid detection.
o Privilege Escalation: Provides attackers with administrator/root-level
control.
 Example:
o Attacker installs a rootkit to hide keyloggers and ensure persistence
even after reboots.
 Security Risk:
o Hard to Detect: Rootkits operate at a very low level (kernel or firmware),
making them nearly invisible to traditional antivirus.
 o Administrator-Level Access: Attackers can do anything: steal data,
disable security, control applications.
o Persistence: Rootkits can reinstall themselves after reboot or even
survive OS reinstallation if in firmware.
o Backdoor Creation: Allow attackers to secretly reconnect to the system
at any time.
 Prevention:
o Use secure boot and OS integrity checks.
o Fix vulnerabilities that rootkits exploit.
o Reinstall OS if compromised.
Viruses and Other Malicious Code
Computer Virus
A computer virus is a type of harmful program. When it runs, it makes copies of itself
and adds its code to other programs and files on your computer. These viruses come
in different types, and each type can affect your device differently.
A virus can have unexpected or harmful outcomes during this procedure, such
as destroying system software by corrupting data. Some viruses are made to mess
things up by deleting files, messing up programs, or even wiping out your hard
drive completely.
Types of Viruses
 File Infector Viruses: File infector viruses are those that infect other files or
programs on your system.
Once the original 'host' program is run, the virus can stay resident or 'live'
inside your systems memory (RAM) and infect programs as they are opened, or
 they can lay dormant inside another program. Each time that program is run,
the virus will infect another program or file.
A second, more complex file infector does not alter the program itself, but
alters the route a computer takes to open a file. Suppose a program or file that
is infected with a file infector virus is passed from one computer to another,
over a network or via floppy disk for example. In that case, the virus will begin
infecting the 'clean' computer as soon as the file or program is opened.
 Boot Sector Virus: boot sector viruses can infect hard drives and removable
disks, such as floppy disks. The boot sector is an area at the beginning of a hard
drive or other disk where information about the drive or disk structure is
stored. Symptoms of a boot sector virus may be a computer that is unbootable
or gives
error messages upon booting. Frustratingly, boot sector viruses may be
present with no noticeable problems.
 Macro Virus: Macro viruses are by far the most common type of malicious
code found today. This is due to the popularity of software such as Microsoft
Office and others such as Corel Draw, which use the macro programming
languages extensively in the products. Macro viruses use an application's own
macro programming language to distribute themselves. Macro viruses do not
infect programs; they infect documents.
 Polymorphic Virus: Changes its form every time it installs to avoid detection by
antivirus software.
 Email Virus: Hides in email messages and activates by clicking a link, opening
an attachment, or interacting with the email.
  Encrypted Virus: Uses encryption to hide from antivirus software, includes a
decryption algorithm to run before executing.
 Direct Action Virus: Tied to an executable file, it activates when the file is
opened but does not delete files or affect system speed; blocks file access.
Worms:
A computer worm is a type of harmful software that copy itself and spread from one
computer to another without requiring any user intervention. Worms often spread
through email attachments that may seem safe, but they can actually cause a lot of
trouble. Once a computer is infected, the worm can send itself to the person's
contacts, using their email account. This way, it keeps spreading to more and more
computers. They cause a variety of problems, including slowing down network
performance, consuming system resources, stealing sensitive information, or even
damaging and disrupting computer systems.
Types of Computer Worms
 Email Worms: Email worms spread through email attachments or links. They
trick people into opening infected attachments or clicking on malicious links in
emails.
 Network Worms: Network worms move through computer networks by
exploiting security weaknesses in network services or protocols. They infect
many systems quickly by scanning and copying themselves automatically.
 File-Sharing Worms: File Sharing worms target shared folders or peer-to-peer
file-sharing networks. They pretend to be normal files and trick users into
downloading and running them. Once executed, they can spread to other
shared areas or connected computers.
  Instant Messaging (IM) Worms: IM worms spread through instant messaging
platforms. They send infected links or files to a person's contacts. By tricking
users into clicking on these links, they can infect more systems.
Trojan Horse:
The name "Trojan Horse" is taken from a classical story of the Trojan War. It is a type
of malware that disguises itself as legitimate code or software. Once inside the
network, attackers are able to carry out any action that a legitimate user could
perform, such as exporting files, modifying data, deleting files, or otherwise altering
the contents of the device. Trojans may be packaged in downloads for games, tools,
apps, or even software patches. Many Trojan attacks also leverage social
engineering tactics, as well as spoofing and phishing, to prompt the desired action in
the user.
Features of a Trojan Horse
 Steals Information: Trojan horses are often designed to steal sensitive
information such as passwords, banking details, and other personal data
stored on the victim's computer.
 Remote Access: A Trojan horse can grant remote access to an attacker,
allowing them to control the infected system and perform actions without the
user's knowledge or consent.
 Data Deletion: Some Trojan horses are capable of deleting or corrupting data
on the user's computer, causing data loss or system instability.
Methods of Propagation
1. Email Attachments:
Spammers often send emails with attachments that appear to be legitimate
but actually contain Trojan malware. When the user opens the email and
 downloads the attachment, the Trojan installs itself and runs automatically
every time the infected device is turned on or the email is accessed.
2. Social Engineering:
Cybercriminals use social engineering techniques to trick individuals into
installing malicious software. They may disguise Trojans in internet links, pop-
up ads, or banner advertisements. These deceptive methods increase the
likelihood of the user clicking on malicious content.
3. Infection Through Infected Devices:
Once a device is infected, it can propagate the Trojan to other computers. The
hacker can turn the infected device into a zombie computer, allowing remote
access without the user's knowledge. These compromised devices are often
used to spread malware to other systems, forming a botnet.
Types of Trojan Horse
Trojans are designed to enter a system without being detected and execute malicious
actions. They can be classified based on specific targets and action as follows
 backdoor Trojan: It is designed to bypass normal security mechanisms and
secretly open a “backdoor” into the victim’s system. Once installed, it allows
attackers remote access, enabling them to steal sensitive files, monitor user
activities, control the system, or even use it as part of a botnet for larger
cyberattacks. Because it operates in the background, users often remain
unaware of its presence, making it one of the most dangerous forms of
Trojans.
 Ransom Trojan: This Trojan functions like ransomware, encrypting files or
locking the entire system so that the victim cannot access their own data. The
attacker then demands a ransom, usually in cryptocurrency, in exchange for
 the decryption key. It puts victims under pressure by threatening permanent
data loss if payment is not made within a set time. Ransom Trojans cause
financial loss, emotional stress, and in the case of organizations, can bring
critical operations to a halt.
 Trojan Banker: A Trojan banker is specifically created to steal banking and
financial data from users. It can capture online banking credentials, intercept
one-time passwords (OTPs), and even redirect victims to fake banking
websites. Once this sensitive data is stolen, attackers can perform
unauthorized transactions or sell the credentials on the dark web. It is
especially dangerous for individuals and businesses relying on online financial
services.
 Trojan Downloader: Trojan downloaders are small malicious programs whose
main purpose is to download and install other malware onto the victim’s
computer. Once inside the system, they silently connect to a command-and-
control server and fetch additional malicious software such as adware,
spyware, ransomware, or updated Trojan variants. This makes them a
“gateway” for continuous reinfection, keeping the system vulnerable.
 Trojan Dropper: A Trojan dropper is a malicious carrier program that delivers
and installs other types of malware while concealing their presence from
antivirus software. It is often the first stage in an attack, ensuring that harmful
files such as rootkits, viruses, or other Trojans are successfully placed on the
victim’s machine. Its ability to hide malware makes it very difficult for
traditional security tools to detect.
 Trojan GameThief: This type of Trojan is targeted specifically at online gamers.
It steals gaming account credentials, virtual currency, or in-game items that
 may have real-world monetary value. Attackers often sell stolen accounts or
rare digital assets on underground markets. Beyond financial loss, it can also
cause emotional distress to gamers who lose progress or valuable
achievements in their favorite games.
 Trojan I’s (Trojan-Spy): Trojan-Spy, also known as Trojan I’s, is designed to
gather sensitive information such as usernames, passwords, and login
credentials. It often uses methods like keylogging, screen capturing, or fake
login windows to trick users. Once this information is stolen, attackers gain
unauthorized access to email, social media, or corporate systems, which can
lead to identity theft, data breaches, and further exploitation.
Spyware/Adware:
Adware is software that automatically displays or downloads advertisements on a
user's computer or mobile device, typically without the user's consent. It often
comes bundled with free software and generates revenue by displaying ads. Some
adware is harmless and annoying, while others can be more malicious.
Spyware is a type of malicious software designed to secretly monitor and collect
information from a user's device without their knowledge or consent. It can track
activities such as browsing habits, keystrokes, login credentials, and even personal or
financial information like passwords, bank account details, and credit card numbers.
What Does Spyware Do?
 Data Collection: It reveals personal account credentials, current balance, and
other numerators in the form of text, along with other personal details. This
data can be used for identity theft or fraud.
 Keystroke Logging: It gets every keystroke that you input into the computer,
even passwords, emails, and chat messages.
  Tracking Activity: Closely tracks your online activity, including websites you
visit, search terms used, social media activity for advertising, or identifying
patterns.
 Screen Capturing: It saves snaps of your device’s screen. Sometimes these
snaps contain important information that must not be exposed to the public.
 Remote Control: Dial an unauthorized user right into your device, and they can
spy on the files and activities of the device in real time. They can view files,
manipulate them, and even install additional malicious software.
Types of spyware
Here are some common types:
 Keyloggers: These record keystrokes typed in by the user, and they can record
passwords and other sensitive messages.
 Adware: Though not necessarily badware, adware provides advertisements
that are not wanted and tracks your Internet activity to provide relevant
advertisements.
 Trojans: These are rogue programs that disguise themselves as genuine
applications, but in reality, they contain spyware that spies on or steals
information.
 Tracking Cookies: These are small data files that are created on your browser
by the sites that you visit to keep track of your browsing history and
preferences. They can be useful for advertising purposes since the users of
these gateways would prefer only this kind of content.
 System Monitors: These capture user activity relative to the online mode and
use of the system for other ill intentions.
  Data Harvesters: These are intended for the capture and transfer of messages
or data, which may be in the form of personal identity, log-in data, or even a
credit card number, among others.
 Browser hijackers: These make changes to your browser, like the home page
or search page, and can forward you to sites that contain malware.
 Remote Access Trojans (RATs): These grant the attackers full control of your
device from a distance that they cannot be noticed, and they have access to all
files, among other things.

Ransomware:
Ransom malware, or ransomware, is a type of malware that prevents users from
accessing their system or personal files and demands ransom payment in order to
regain access.
How Does Ransomware Work?
Ransomware operates more or less through a specific cycle before the targeted user
is fully aware that they have been diagnosed with a malware infection.
Here's a breakdown of the common stages:
 Infection: The primary attack vector is believed to occur through phishing
emails and other lures, links, drive-by downloads, and compromised software.
Targeted users install the ransomware into their system without their
knowledge.
 Execution: After installation of the malware, the program then delivers a
payload that circulates the system, searching for files of value and then
encrypting them with nearly uncrackable security encryption.
  Encryption: Files are protected with the key known only by the violator. The
victims will receive a message or a warning that the attackers want to get a
ransom in exchange for the decryption key.
 Ransom Demand: The attacker shows the victim how the ransom is to be paid,
the usual from being anonymous form of currency being bitcoins.
 Decryption (If Ransom Is Paid): If the victim agrees to pay, this sends the
decryption key to the attackers, but data retrievals may not be recovered.
Types of Ransomware
There are various types of ransomware, each with different tactics:
 Crypto Ransomware: This type infects files on the victims’ system and then
request for payment for the key that would decrypt the files. It is widely
employed by the attackers because of its high level of encryption.
 Locker Ransomware: Unlike some other cyber threats that encrypt files, locker
ransomware leaves the user with no access to their device or any of its
functions, unless the ransom is paid.
 Scareware: Some of them pretend to have infected your PC and ask you to pay
to get the ‘problem’ solved, despite the fact there may actually be no problem.
 Ransomware as a Service (RaaS): It is a business model adapted by cyber
criminals that allow outsourcing of ransomware to other cyber criminals who
are paid some commission on any extraction of ransoms.
 Doxware (Extortionware): Criminals using their knowledge to extort money
from the victim by stating that they will expose a variety of new information if
the ransom is not met.
Common Symptoms of a Computer Virus
Identifying the signs of a computer virus early is crucial to prevent further damage
and protect your data. Here are some common symptoms that may indicate your
computer is infected with a virus,
1. Slow Performance: If your computer suddenly becomes slower than usual,
struggles to open programs, or lags frequently, it could be a sign that a virus is
consuming your system’s resources.
2. Frequent Crashes or Freezes: Viruses can cause your computer to crash or
freeze unexpectedly. If your system is regularly rebooting or applications are
closing without reason, this could be a sign of infection.
3. Unusual Pop-ups or Ads: If you notice frequent pop-ups, especially ones that
you didn’t enable, or if they appear even when you’re offline, this can be a sign
of malware or adware infection.
4. Programs Opening or Closing Automatically: A virus might take control of your
computer and cause programs to open, close, or behave erratically without
your input.
5. Unknown Programs or Files: If you find new, unfamiliar files or programs that
you didn’t install, a virus may have created them on your system.
Prevention of Virus Infections
1. Install Reliable Antivirus Software
One of the first steps in how to prevent viruses on computers is to install a reliable
antivirus program. Antivirus software is designed to detect, block, and remove
malware before it can cause any harm. It works by scanning files, downloads, and
emails for known threats and alerting you if any malicious activity is detected.
Many antivirus programs also offer features like real-time protection and automatic
updates, ensuring that you’re protected from the latest cyber threats. Be sure to
choose an antivirus solution from a trusted vendor and ensure it’s updated regularly
to provide maximum protection.
2. Keep Your Operating System and Software Updated
A key factor in preventing viruses on computers is keeping your operating system
and software up to date. Hackers often exploit security vulnerabilities in outdated
software to gain unauthorized access to systems. Software developers release
regular updates that fix these security flaws, so it’s essential to perform risk
assessment as soon as they become available.
Enable automatic updates for your operating system, web browsers, and antivirus
software to ensure that you are always protected against new threats. Staying up-to-
date minimizes the risk of your computer being targeted by hackers using known
vulnerabilities.
3. Be Wary of Phishing Emails and Malicious Links
Phishing emails are a common way for viruses and malware to spread. These
fraudulent emails are designed to look legitimate, but they often contain malicious
links or attachments. When clicked, these links can download malware to your
computer without your knowledge.
To prevent viruses, avoid clicking on links or downloading attachments from
unknown or suspicious emails. Always verify the sender’s identity before opening any
attachments, and use email security features, such as spam filters, to block potential
threats.
4. Use a Secure Firewall
Another critical measure in how to prevent viruses on computers is using a firewall. A
firewall acts as a barrier between your computer and external networks, blocking
unauthorized access and preventing malicious traffic from entering your system.
Most operating systems come with a built-in firewall, but you can also use third-party
software for enhanced protection.
Ensure that your firewall is always enabled, and configure it to allow only trusted
applications and connections. A well-configured firewall is a key part of your defense
strategy, reducing the risk of malware infecting your system.
5. Avoid Downloading Files from Untrusted Sources
One of the easiest ways to introduce viruses to your computer is by downloading
software or files from untrusted websites. Cybercriminals often disguise viruses as
legitimate files, tricking users into downloading harmful software.
To prevent viruses, only download software and files from reputable sources, such as
official websites or trusted app stores. Avoid downloading pirated software, as it is
often bundled with malware. Always scan downloads with your antivirus software
before opening them to ensure they are safe.