Dr.

Surekha Borra Elements of Cyber Security and IoT KSIT

MODULE 2:
PART 1: ATTACKER TECHNIQUES AND MOTIVATIONS

HOW HACKERS COVER THEIR TRACKS (ANTI-FORENSICS)

Introduction
Attackers often try to hide their identity and activities after performing malicious actions.
The techniques used to conceal evidence and avoid detection are called Anti-Forensics.
Anti-forensic methods help attackers:
 Avoid identification
 Hide digital evidence
 Prevent investigators from tracing attacks
 Continue malicious activities without being detected
One of the most common anti-forensic techniques is the use of proxy servers to hide
the attacker’s real Internet Protocol (IP) address.

How and Why Attackers Use Proxies

What is a Proxy?
A proxy server is a system that acts as an intermediary between a user and the
destination server.
Working of a Proxy
The communication process works as follows:
1. The attacker sends a request to a proxy server.
2. The proxy server forwards the request to the target system.
3. The target system sends the response back to the proxy.
4. The proxy forwards the response to the attacker.
Because of this process, the target system only sees the proxy server’s IP address
rather than the attacker’s real IP address.
This makes it difficult for investigators to determine the actual origin of the attack.

Why Attackers Use Proxies

Attackers rely on proxy servers for several reasons.
1. Hiding the Real IP Address
IP addresses can be traced to physical locations. Attackers use proxies to hide their real
IP addresses, preventing investigators from locating them.
2. Increasing Anonymity
Well-configured proxy servers may:
 Not store user logs
 Hide the identity of the user
This allows attackers to perform malicious activities anonymously.
3. Avoiding Law Enforcement Detection
Attackers sometimes use multiple proxies located in different countries. This technique
makes the investigation process extremely difficult because each proxy must be traced
separately.
4. Conducting Fraudulent Activities
Proxies allow attackers to perform activities such as:
 Financial fraud
 Cyberattacks
 Identity theft
Since the activity appears to originate from the proxy, attackers reduce the risk of being
identified.
5. Sending Spam Emails
Attackers often send spam using SMTP proxies or open mail relays to hide the true
sender of the message.

Legitimate Uses of Proxies

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Although proxies are often abused by attackers, they also have legitimate uses.
Some common legitimate uses include:
 Providing online anonymity
 Accessing restricted or blocked websites
 Allowing employees or students to use services blocked by administrators
 Improving network performance through caching
For example, some users access blocked services such as instant messaging or
Internet Relay Chat (IRC) using proxy servers.

How Attackers Exploit Proxies

Attackers may use proxies in several malicious ways.
1. Operating Free Proxy Servers
Some attackers set up free proxy servers and advertise them on the internet.
Users who connect to these proxies unknowingly allow attackers to:
 Monitor network traffic
 Collect login credentials
 Capture sensitive information
Since the proxy handles all communication, attackers can observe all transmitted data.

2. Modifying Victim Proxy Settings

Attackers may modify a victim’s browser or system settings to redirect traffic through a
malicious proxy.
This can happen through:
 Malware
 Social engineering
 Malicious software installation
Once the proxy settings are changed, attackers can monitor and manipulate the user’s
internet activity.
Example: AnonProxy is a malicious proxy tool designed to monitor users and steal social
networking passwords.

3. Installing Local Proxies

Some malicious programs install local proxy servers on the victim’s computer.
Characteristics of local proxies:
 Redirect internet traffic through attacker-controlled systems
 Capture confidential information such as passwords
 Difficult to detect because they do not open network ports
Since traditional network scanning tools check open ports, these proxies often remain
hidden.

TYPES OF PROXIES
Proxy servers can operate using different technologies and protocols.
1. HTTP Proxies
HTTP proxies handle web traffic (HTTP requests).
Characteristics:
 Used for web browsing
 Commonly operate on TCP port 80
 Frequently used in web-based attacks

2. SOCKS Proxies
SOCKS proxies operate at a lower network layer and support many types of applications.
Characteristics:
 Supports multiple protocols
 More flexible than HTTP proxies

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 Common port: 1080

Attackers frequently use SOCKS proxies for activities such as:
 Web scraping
 Anonymous browsing
 Data transfers

3. Squid Proxies
Squid is a popular caching proxy server.
Characteristics:
 Improves network performance through caching
 Often used in enterprise networks
 Common port: 3128
Attackers may misuse Squid proxies if they are improperly configured.

Common Proxy Ports

Attackers often scan the internet for systems running proxy services on commonly used
ports, including:
 80 – HTTP Proxy
 8000 – Web Proxy
 8081 – Alternative Web Proxy
 443 – HTTPS Proxy
 1080 – SOCKS Proxy
 3128 – Squid Proxy
If attackers install their own proxies, they may use random high-numbered ports to avoid
detection.

VPN as an Alternative to Proxies

A Virtual Private Network (VPN) can also function similarly to a proxy.
Instead of configuring individual applications, VPNs tunnel all network traffic through a
secure connection.
Comparison Between SOCKS5 Proxy and VPN
Feature SOCKS5 Proxy VPN
Encryption No encryption Strong encryption
Speed High (no encryption overhead) Moderate
Coverage Application-level Entire system traffic
Setup Manual configuration User-friendly applications
VPNs generally provide better privacy and security than standard proxy servers.

Proxy Services Used by Attackers

Attackers often obtain proxies from different sources.
Sources of Proxy Services
1. Free proxy websites
2. Commercial proxy services
3. Underground hacking forums
These services advertise features such as:
 High anonymity
 Fast connections
 No activity logging
Attackers prefer services that do not keep logs, because logs could reveal their identity
during investigations.
Some proxy services maintain logs for a short period to prevent abuse, while others
completely avoid logging to attract cybercriminals.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Detecting the Use of Proxies

Detecting proxy usage is challenging because attackers may use:
 Custom proxy configurations
 Encrypted communication
 Randomized ports
However, organizations can use several detection methods.

1. Port Scanning
Network administrators can scan internal systems to identify open proxy ports.
If a system is listening on common proxy ports, it may indicate the presence of a proxy
server.

2. Monitoring Proxy Configuration Changes

Unexpected changes in proxy settings may indicate a system compromise.
Example registry location used to control proxy settings in Internet Explorer:
HKCU\Software\Microsoft\Windows\CurrentVersion\InternetSettings\ProxyServer
Monitoring this registry key helps detect unauthorized proxy configuration changes.

3. Intrusion Detection Systems (IDS)

Organizations can deploy Intrusion Detection Systems to monitor network traffic.
IDS systems use predefined rules to detect:
 Suspicious proxy communication
 Unauthorized proxy servers
 Unusual traffic patterns

4. DNS Blacklists (DNSBL)

DNS blacklists contain IP addresses known to host malicious proxies.
Network administrators can block these IP addresses to prevent access from suspicious
proxy servers.

5. DNS and Application-Based Detection

Some web applications detect proxies by comparing two IP addresses:
1. The IP address used for DNS requests
2. The IP address used for HTTP requests
If these IP addresses are different, it may indicate that a proxy is being used.

Tools to Identify Real IP Addresses

Some tools use browser plugins to bypass proxy settings and reveal the user’s real IP
address.
Examples of plugins used for detection include:
 Word
 Java
 Flash
 QuickTime
 iTunes
These plugins sometimes bypass browser proxy settings and expose the true IP address
of the user.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Conclusion
Proxy servers are widely available and play a significant role in both legitimate and
malicious activities.
Key points:
 Attackers use proxies to hide their identity and physical location.
 Multiple proxies can make tracking attackers extremely difficult.
 Proxies can be used for spam distribution, fraud, and cyberattacks.
 Detecting proxy usage is challenging due to custom configurations and encryption.
 Organizations must rely on network monitoring, IDS systems, configuration checks,
and blacklist databases to detect and mitigate proxy-based attacks.
Despite detection techniques, proxies will continue to be an important tool for attackers
who wish to remain anonymous online.

FRAUD TECHNIQUES
Fraud techniques are methods used by attackers to deceive users and organizations in
order to obtain financial benefits, personal information, or system access.
Common fraud techniques include:
1. Phishing
2. Smishing
3. Vishing
4. Mobile Malicious Code
5. Rogue Antivirus
6. Click Fraud

Phishing, Smishing, Vishing, and Mobile Malicious Code

Phishing attacks aim to trick users into revealing sensitive information such as
passwords, banking details, or personal data.
With the widespread use of mobile devices, phishing has expanded to include SMS and
voice-based attacks.

1. Phishing
Phishing is a social engineering attack in which attackers impersonate legitimate
organizations to obtain sensitive information.
Characteristics
 Uses fake emails, websites, or messages
 Requests personal information
 Often mimics trusted organizations such as banks
Victims are usually directed to fraudulent websites where they unknowingly submit their
personal details.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

2. Smishing (SMS Phishing)

Smishing refers to phishing attacks conducted through Short Message Service (SMS)
messages.
How Smishing Works
Attackers send SMS messages that contain:
 Fraudulent URLs
 Fake phone numbers
 Urgent notifications
Examples of smishing messages include:
 Bank account alerts
 Prize notifications
 Security warnings
When victims click the link or call the number, attackers obtain sensitive information such
as banking credentials.

3. Vishing (Voice Phishing)

Vishing uses voice communication or phone calls to steal personal information.
Methods Used
 Victims call a phone number included in a fraudulent SMS
 Automated voicemail systems request information
 Attackers may personally answer calls to collect data
Information commonly requested during vishing attacks includes:
 Bank account numbers
 Credit card details
 Personal identification numbers (PINs)
Many vishing attacks imitate bank customer service or technical support services.

Common Themes in Smishing and Vishing

Attackers often use social engineering tactics such as:
 Account suspension warnings
 Prize or lottery announcements
 Urgent bank notifications
 Fake promotions
These messages create urgency or excitement, encouraging victims to respond quickly
without verifying authenticity.

4. Mobile Malicious Code

Mobile malicious code refers to malware designed specifically for mobile devices.
Although less common than desktop malware, mobile malware is increasing as
smartphone usage grows.

Example: Mobile Virus Attack

One example involved a virus targeting Symbian S60 mobile devices.
Attack Process
1. Victims receive SMS messages containing malicious URLs.
2. The message encourages users to download a program.
3. After installation, the malware spreads automatically by sending similar SMS
messages to other users.
Example malware: “Sexy View” virus
This virus attempted to convince users to install a malicious file known as SISX
installation file.

Phishing Against Mobile Devices

Mobile phishing attacks often target banks and financial institutions.
Typical Attack Method

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

1. Victim receives a fraudulent SMS.

2. The SMS contains a phone number or URL.
3. Victim calls the number or visits the website.
4. Personal information is collected.
Attackers may use SMS gateways to send large numbers of phishing messages at low
cost.

Challenges in Detecting Mobile Phishing

Mobile phishing is difficult to detect because:
 SMS messages contain limited tracking information
 Attackers can spoof phone numbers
 Mobile browsers often hide full URLs
 Many phones lack advanced phishing protection tools
These limitations increase the risk of successful attacks on mobile users.

Preventive Measures for Mobile Phishing

Organizations should implement the following practices:
 Avoid sending sensitive contact information through SMS
 Clearly publish official contact numbers on their websites
 Educate customers about phishing risks
 Use secure mobile applications for services such as online banking
Financial institutions must also carefully evaluate the use of mobile devices as
authentication tools because the same device may be used for both authentication and
online access.

5. Rogue Antivirus
Rogue antivirus programs are fake security applications designed to trick users into
purchasing fraudulent software.
These programs pretend to detect security threats and then request payment for removing
them.

Characteristics of Rogue Antivirus

Once installed, rogue antivirus software:
 Displays fake virus warnings
 Shows pop-up security alerts
 Modifies system settings
 Requests payment to activate a “full version”
Victims may be charged up to $89.95 for the fake software.

Impact of Rogue Antivirus

Studies estimate that:

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 Approximately 35 million computers are infected each month

 Cybercriminals earn millions of dollars from rogue software attacks
Examples of rogue antivirus programs include Antivirus XP and other similar fake security
tools.

Distribution Methods
Attackers distribute rogue antivirus software using various techniques.
1. Social Engineering
Victims are tricked into installing the program by:
 Fake security alerts
 Fake software updates
 Fake media codecs (e.g., Flash updates)

2. Email Campaigns
Attackers send emails containing:
 Malicious attachments
 Links to infected websites

3. Search Engine Poisoning

Attackers manipulate search results to promote malicious websites.
Users searching for popular topics may be redirected to sites that install rogue antivirus
programs.

4. Web Exploit Kits

Exploit kits automatically install rogue antivirus software when users visit infected
websites.

Pay-Per-Install Model
Many attackers participate in affiliate programs that pay them to install rogue antivirus
software.
Business Model
1. Attacker installs rogue antivirus on victim’s computer.
2. Victim purchases fake software.
3. Affiliate receives a portion of the payment.
This model encourages a large number of attackers to distribute rogue software.

Payment Processing in Rogue Antivirus Attacks

Most rogue antivirus attacks rely on third-party payment processors.
These payment providers:
 Accept credit card payments
 Use legitimate SSL certificates
 Hide the identity of attackers
However, investigators sometimes shut down these payment services after detecting
fraud.

6. Click Fraud
Click fraud is a fraudulent activity that manipulates online advertising systems to
generate illegal revenue.
It primarily affects pay-per-click (PPC) advertising networks.

Pay-Per-Click (PPC) Advertising Model

In PPC advertising, advertisers pay publishers each time a user clicks an advertisement.
Key Participants
1. Advertiser – Company promoting a product or service
2. Publisher – Website displaying advertisements

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

3. Viewer – Internet user who sees or clicks the ad

Revenue is generated when users click advertisements displayed on websites.

Click Fraud
Click fraud occurs when ads are clicked without genuine interest in the product or
service.
The goal is to generate fraudulent advertising revenue or harm competitors.
Studies show that a significant percentage of online ad clicks may involve fraudulent
activity.

Motivations for Click Fraud

1. Financial Gain
Publishers may click ads on their own websites to increase revenue.

2. Competitive Advantage
Competitors may repeatedly click advertisements to increase the advertising costs of rival
companies.

3. Framing Competitors
A publisher may intentionally generate fraudulent clicks on a competitor’s site to cause
them to be banned from the advertising network.

4. Non-Financial Motives
Some individuals perform click fraud to damage the reputation or finances of a company
they dislike.

Click Fraud Techniques

Fraudsters use various techniques to generate large numbers of fraudulent clicks.
1. Manual Clicking
The simplest method involves manually clicking advertisements multiple times.

2. Fake Websites
Attackers create websites that display advertisements and then generate fraudulent clicks
on them.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

3. Botnets
Botnets are networks of infected computers controlled by attackers.
Each infected computer:
 Has a different IP address
 Can generate ad clicks automatically
This makes click fraud more difficult to detect.

Detecting Click Fraud

Advertising networks use several techniques to identify fraudulent clicks.
1. IP Address Monitoring
Multiple clicks from the same IP address within a short period may indicate fraud.

2. Cookie Tracking
Cookies help determine whether the same user is repeatedly clicking advertisements.

3. Bounce Rate Analysis

A bounce occurs when a visitor clicks an ad but immediately leaves the website.
High bounce rates may indicate fraudulent clicks.

4. Geographic Analysis
Clicks from locations where the advertised product is not available may indicate click fraud.

Conclusion
Fraud techniques such as phishing, smishing, rogue antivirus, and click fraud pose serious
threats to individuals and organizations.
Key observations include:
 Mobile devices have become a major target for phishing attacks.
 Rogue antivirus software generates large profits for cybercriminals.
 Click fraud exploits online advertising systems for financial gain.
 Advanced techniques such as botnets make fraud detection difficult.
Organizations must implement security awareness, monitoring, and fraud detection
mechanisms to reduce the risk of these attacks.

THREAT INFRASTUCTURE

Botnets
Introduction
A botnet refers to a network of compromised computers or devices that are controlled by an attacker,
often without the knowledge of the device owners. These compromised devices, known as bots or
zombies, are connected through the Internet and are used collectively to perform malicious activities.
Botnets are a major concern in network security because they allow attackers to control many devices
remotely and use them for coordinated attacks.

Structure of a Botnet
A botnet typically consists of three main elements working together.
At the core is the attacker or botmaster, who controls the entire network. The botmaster sends
instructions to the infected devices.
The infected devices, known as bots, act as agents that execute the commands received. These
devices may include computers or other network-connected systems.
Between the botmaster and bots, there is usually a communication mechanism, which allows
commands to be transmitted and responses to be received. This communication enables coordinated
actions across all compromised devices.

Working of Botnets
The operation of a botnet begins with the infection of devices. This is usually done through malicious
software that spreads across systems.
Once a device is infected:

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 It becomes part of the botnet

 It establishes communication with the controlling system
 It waits for instructions from the botmaster
When commands are issued, all bots in the network execute them simultaneously. This coordinated
behavior allows attackers to perform large-scale activities efficiently.

Uses of Botnets
Botnets are commonly used for various malicious purposes. Since they involve many devices, they
can generate significant impact.
One of the primary uses is launching distributed attacks, where multiple devices target a single
system at the same time. This can overwhelm the target and disrupt its normal functioning.
Botnets may also be used to:
 Send large volumes of unwanted messages
 Spread malicious software further
 Exploit network resources
These activities can cause serious damage to systems, networks, and organizations.

Impact of Botnets
The impact of botnets is significant due to their scale and coordination.
They can:
 Disrupt services and networks
 Cause financial and operational losses
 Compromise data and system integrity
Since botnets operate using many devices simultaneously, they are difficult to detect and control. Their
distributed nature makes them a major challenge in cybersecurity.

A centralized botnet infrastructure is a type of botnet architecture in which all the compromised
devices (bots) are controlled through a single central entity. This central point acts as the command
center from which the attacker manages and coordinates the activities of the entire botnet.
This model is one of the earliest and simplest forms of botnet design, where communication between
the attacker and the bots is organized through a centralized system.
In a centralized botnet, all infected devices are connected to a central command system. The attacker,
often referred to as the botmaster, sends instructions to this central system, which then distributes the
commands to all the bots in the network.
Thus, communication follows a structured pattern:
Botmaster → Central Server → Bots
Each bot regularly communicates with the central server to:
 Receive commands
 Send status updates
This centralized control makes it easier for the attacker to manage many devices efficiently.
Working of Centralized Botnet
The operation of a centralized botnet begins with the infection of multiple devices. Once these devices
are compromised, they are programmed to connect to a central server.
After establishing the connection:
 Bots continuously listen for instructions
 The central server sends commands issued by the botmaster
 Bots execute the commands simultaneously
This allows the attacker to coordinate actions across all devices in a synchronized manner.
The centralized server therefore acts as the single point of communication and control for the entire
botnet.
Characteristics of Centralized Botnet Infrastructure
 A centralized botnet infrastructure has certain distinguishing features.
 It provides simple and efficient control, as all commands originate from one location. This makes it
easy for the attacker to monitor and manage the botnet.
 Communication is also direct and organized, since all bots interact with the same central system.
This reduces complexity in command distribution.
 However, this architecture also introduces a single point of dependency, as the entire network relies
on the central server for instructions.
Advantages of Centralized Botnet

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

The centralized model offers some operational benefits to the attacker.

It allows:
 Easy coordination of bots
 Quick distribution of commands
 Simplified management of the network
Since all bots connect to a single system, monitoring their activity and controlling them becomes
straightforward.
Limitations of Centralized Botnet
Despite its simplicity, centralized botnet infrastructure has significant limitations.
The most important drawback is the presence of a single point of failure. If the central server is detected
and taken down:
 The entire botnet becomes ineffective
 Bots lose connection with the botmaster
This makes centralized botnets more vulnerable to detection and disruption by security systems.
Types of Centralized Bots:

In a centralized botnet infrastructure, all bots are controlled through a command-and-control system.
However, this centralized model can be implemented in different ways depending on how the control
is organized and distributed.
Based on the structure of control and communication, centralized botnet infrastructures are
commonly classified into:
 Basic centralized model
 Multi-server model
 Hierarchical model
Each of these represents an evolution in design to improve efficiency and overcome limitations.

1. Basic Centralized Botnet

The basic centralized botnet is the simplest form of architecture.
In this model, all bots connect directly to a single central server, which is controlled by the botmaster.
The server sends commands to all bots, and the bots respond back to the same server.
The communication pattern can be understood as:
Botmaster → Single Server → Bots
This model is easy to design and manage because:
 All control is handled at one place
 Communication is straightforward

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

However, it has a major limitation. Since the entire botnet depends on a single server, it becomes a
single point of failure. If this server is detected and taken down, the whole botnet stops functioning.

2. Multi-Server Centralized Botnet

To overcome the limitation of a single point of failure, the multi-server centralized botnet was
introduced.
In this model, instead of relying on one server, the botnet uses multiple central servers. Bots may
connect to different servers, and all these servers are controlled by the botmaster.
This structure provides:
 Better load distribution
 Reduced dependency on a single server
 Improved reliability
Even if one server is shut down, other servers can continue to control the bots. This makes the botnet
more robust compared to the basic centralized model.
However, control is still centralized in nature, as all servers are ultimately managed by the botmaster.

3. Hierarchical Centralized Botnet

The hierarchical botnet introduces a more structured and layered approach to centralized control. In
this model, bots are organized in multiple levels:
 A top-level server controlled by the botmaster
 Intermediate nodes or servers
 Lower-level bots
Commands are passed from the top level down through intermediate layers to the bots.
The communication flow becomes:
Botmaster → Higher-level servers → Intermediate nodes → Bots
This layered structure provides several advantages:
 Better scalability for large botnets
 Reduced direct communication load on the main server
 Improved organization and control
At the same time, it still maintains centralized control, as commands ultimately originate from a single
authority.

Characteristics of Centralized Bot Types

Regardless of the communication method, centralized bots share some common characteristics.
They all:
 Depend on the central server for control
 Follow a structured communication model
 Allow coordinated execution of commands
At the same time, they all suffer from a common limitation:
 The central server becomes a single point of failure
Based on the communication mechanism used between the bots and the central server.
IRC-Based Bots
One of the earliest and most common types of centralized bots is based on Internet Relay Chat (IRC).
In this architecture, bots connect to an IRC server and join a specific channel created by the attacker.
The botmaster sends commands through this channel, and all connected bots receive and execute
them.
The IRC server acts as the central communication hub, enabling:
 Real-time communication
 Easy group control of bots
This type of botnet is simple to implement and allows quick command distribution. However, since all
communication passes through a known server, it can be detected and shut down, making it
vulnerable.

HTTP-Based Bots
Another widely used type is the HTTP-based bot.
In this approach, bots communicate with the central server using web protocols (HTTP/HTTPS).
Instead of connecting to a chat server, bots periodically send requests to a web server to receive
commands.
This method provides certain advantages:

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 Communication appears similar to normal web traffic

 It is harder to detect compared to IRC-based bots
The central web server acts as the command center, and bots fetch instructions in a structured manner.
This makes HTTP-based botnets more flexible and relatively stealthier.
Decentralized Botnet Infrastructure
A decentralized botnet infrastructure is a type of botnet architecture in which there is no central
command-and-control server. Instead of relying on a single controlling entity, all bots in the network
communicate with each other in a distributed manner.
This model is designed to overcome the limitations of centralized botnets, particularly the problem of
a single point of failure.

Basic Concept
In a decentralized botnet, control is distributed across multiple nodes rather than being concentrated
at one central location.
Each bot in the network can:
 Act as both a client and a server
 Communicate with other bots directly
The communication typically follows a peer-to-peer (P2P) model, where commands are propagated
across the network from one bot to another.
Thus, instead of a structured path like:
Botmaster → Server → Bots
the communication becomes:
Bot ↔ Bot ↔ Bot (peer-to-peer interaction)

Working of Decentralized Botnet

The operation of a decentralized botnet begins with the infection of devices, like other botnets. Once
a device becomes part of the botnet, it connects to other infected devices rather than a central server.
When the botmaster wants to issue a command:
 The command is injected into the network through one or more bots
 The instruction spreads across the network from peer to peer
 Each bot receives and forwards command to others
This distributed communication ensures that commands eventually reach all bots in the network
without requiring a central control system.

Characteristics of Decentralized Botnet

A decentralized botnet has distinct features that differentiate it from centralized models.
It provides:
 No single point of failure, since there is no central server
 High resilience, as the network continues functioning even if some nodes are removed

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 Distributed control, making it difficult to trace the botmaster

At the same time, communication is less structured compared to centralized systems, as it depends
on peer-to-peer interactions.

Advantages of Decentralized Botnet

The decentralized model offers several advantages over centralized botnets.
It improves:
 Robustness, since the network does not collapse if one node fails
 Stealth, as there is no central server to detect and shut down
 Scalability, because new bots can join the network easily
These features make decentralized botnets more difficult to control and eliminate.

Limitations of Decentralized Botnet

Despite its advantages, decentralized botnets also have certain limitations.
Since there is no central control:
 Managing the network becomes more complex
 Communication may be slower due to multi-hop transmission
 Coordinating actions across all bots can be less efficient
Thus, while decentralized botnets are more resilient, they may sacrifice some level of control and
simplicity.

Fast Flux
Fast Flux is a technique used in botnet-based infrastructures to hide malicious servers and increase
their resilience. It is primarily associated with decentralized or advanced botnet operations, where
attackers attempt to make their systems difficult to detect and shut down.
The main idea behind fast flux is to frequently change the mapping between domain names and IP
addresses, thereby making it hard for security systems to track the actual source of malicious activity.

Basic Concept
In a normal network setup, a domain name is associated with a fixed IP address. However, in fast flux,
this mapping changes rapidly.
Instead of pointing to a single server:
 A domain name is linked to multiple IP addresses
 These IP addresses are changed frequently
As a result, when a user or system tries to access a domain:
 It resolves different IP addresses at different times
 These IPs usually belong to compromised machines (bots)
Thus, fast flux creates a constantly changing network of nodes that act as intermediaries.

Working of Fast Flux

The working of fast flux involves continuous rotation of IP addresses associated with a domain.
When a request is made to a domain:
 The Domain Name System (DNS) returns one of many available IP addresses

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 After a short time, the mapping changes to another IP

 This process repeats continuously
These IP addresses correspond to bots in the network, which act as proxies or relays. The actual
malicious server remains hidden behind these layers of changing nodes.
This dynamic behavior makes it difficult to identify and block the real source of malicious activity.
Purpose of Fast Flux
The primary purpose of fast flux is to:
 Increase anonymity of attackers
 Prevent detection and shutdown of servers
 Maintain continuous availability of malicious services
Even if some IP addresses are identified and blocked, new ones quickly replace them, ensuring
uninterrupted operation.
Characteristics of Fast Flux
Fast flux systems exhibit certain key characteristics.
They involve:
 Rapid and frequent IP address changes
 Use of multiple compromised hosts
 Short lifespan of individual IP mappings
These features make the infrastructure highly dynamic and difficult to trace.

Impact of Fast Flux

Fast fluxes significantly increase the effectiveness of botnets by making them more resistant to security
measures.
It:
 Complicates tracking and investigation
 Delays detection and response
 Enhances the survivability of malicious networks
As a result, it is widely used in activities such as hosting malicious content or coordinating botnet
operations.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Single Flux, Double Flux, and Hydra Flux

Fast flux techniques are used in botnet infrastructures to hide the actual source of malicious services
and make detection difficult. Based on how the IP address mappings are managed and distributed,
fast flux can be categorized into single flux, double flux, and hydra flux.
These techniques differ in the level of complexity and the degree of protection they provide to the
malicious infrastructure.
Single Flux
In single flux, the mapping between a domain name and its IP addresses changes frequently, but only
at one level.
In this approach:
 A single domain name is associated with multiple IP addresses
 These IP addresses are rotated rapidly
 Each IP corresponds to a compromised machine (bot)
When a request is made to the domain, different IP addresses are returned at different times. These
bots act as intermediaries and forward the request to the actual malicious server.
Thus, the real server remains hidden behind a constantly changing set of nodes. However, the backend
infrastructure remains relatively stable, making it somewhat easier to trace compared to more
advanced techniques.

Double Flux
Double flux extends the concept of single flux by adding another layer of dynamism.
In this technique:
 Not only do the IP addresses of the domain change frequently
 But the DNS servers responsible for resolving the domain also change
This means:
 Both the service layer and the DNS infrastructure are constantly shifting
 Bots are used not only as proxies but also as DNS servers
As a result, tracking the source becomes significantly more difficult because the entire communication
chain is dynamic. Even if some nodes are identified, new ones quickly replace them.

Hydra Flux
Hydra flux is a more advanced and complex variation of fast flux.
In this approach:
 Multiple layers of redirection and distribution are used
 A large number of nodes participate in routing and communication
 The infrastructure is highly distributed and adaptive
Unlike simpler models, hydra flux does not rely on a limited set of rotating IPs. Instead, it creates a
highly dynamic and multi-headed structure (hence the name “hydra”), where:

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 Multiple nodes can act as entry and relay points

 The network continuously reorganizes itself
This makes detection and shutdown extremely difficult, as there is no fixed structure to target.

Comparison Insight
The three techniques represent increasing levels of complexity:
 Single Flux: Changes only IP addresses
 Double Flux: Changes both IP addresses and DNS servers
 Hydra Flux: Uses highly distributed and multi-layered dynamic infrastructure
As we move from single to hydra flux, the system becomes:
 More resilient
 Harder to detect
 More difficult to dismantle

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

PART 2: EXPLOITATION:
SHELLCODE
In cybersecurity, shellcode refers to a small piece of malicious code used by attackers to exploit
software vulnerabilities and gain control over a system. It is typically injected into a vulnerable program
and executed to perform unauthorized actions.
The term “shellcode” comes from its original purpose:
to open a command shell on a compromised system
However, modern shellcode can perform many other actions beyond just opening a shell.

Basic Concept
Shellcode is usually written in low-level machine code or assembly language, so that it can be executed
directly by the system’s processor.
It is commonly used in:
 Buffer overflow attacks
 Memory corruption exploits
The attacker injects this code into a program’s memory and then manipulates the program so that it
executes the injected code instead of its normal instructions.

Working of Shellcode
The working of shellcode typically follows a sequence of steps.
Initially, a vulnerability (such as a buffer overflow) is exploited to insert the shellcode into the memory
of a running program. The attacker then redirects the program’s execution flow to the location where
the shellcode is stored.
Once execution reaches the shellcode:
 It runs with the privileges of the compromised program
 It performs its intended malicious function
This function may include opening a command interface, accessing files, or controlling the system
remotely.

Types of Shellcode
Shellcode can be classified based on its functionality.
One common type is local shellcode, which runs on the target system and provides local access to the
attacker.
Another type is remote shellcode, which establishes a connection between the attacker and the
compromised system, allowing remote control.
In many cases, shellcode is designed to be compact and efficient so that it can fit within limited memory
space and avoid detection.

Characteristics of Shellcode
Shellcode has certain important characteristics that make it effective in attacks.
It is:
 Small, to fit into memory constraints
 Position-independent, so it can run from any memory location
 Efficient, to execute quickly without errors
These features ensure that the shellcode can successfully execute even in restricted environments.

Purpose of Shellcode
Although originally designed to open a shell, modern shellcode can perform various tasks such as:
 Gaining unauthorized access
 Downloading additional malicious programs
 Modifying system behavior
Thus, shellcode acts as the initial payload that enables further exploitation.
Both Linux and UNIX: Use system calls. Also uses interrupt to request them.
A system call is a way for a program to ask the operating system to do something.
Examples:
Open a file, read data, Send data over the internet
Uses system calls to perform tasks
Works with the same permission as that program
In Linux/UNIX: Shellcode uses interrupt: INT 0x80

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Windows Shellcode Works Differently

 Windows does have system calls
 They are limited
 Their numbers change between versions
This makes Windows shellcode less reliable if it depends directly on system calls
Windows programs usually interact with the system using API (Application Programming Interface)
These APIs are stored in DLLs (Dynamic Link Libraries): Libraries of ready-made functions
Instead of writing code to open a file, A program can just call a function from a DLL
Important Windows DLL: [Link]
This provides basic functions like:
 File handling
 Memory management
 Process control

Reliable Windows shellcode usually finds [Link] using two important functions:
LoadLibraryA → to load other DLLs, GetProcAddress → to find functions inside DLLs
This allows shellcode to access many system features
Runs with the same permissions as the program it infects
If injected into an admin program it gets admin access
How Does Shellcode Find [Link]?
1. Using PEB (Process Environment Block)
A structure that stores process information
Contains a list of loaded DLLs
Important fact: [Link] is usually the second loaded module
Shellcode Looks inside PEB, Finds [Link] location
2. Using SEH (Structured Error Handling)
Programs have error-handling mechanisms
Shellcode: Scans these handlers
Finds one pointing to [Link], Looks for special starting bytes → "MZ"
3. Using TEB (Thread Environment Block)
Similar to PEB but for threads
Shellcode: searches memory for "MZ"
Identifies [Link]
"MZ" are special magic bytes found at the start of Windows executable files, help identify where a DLL
begins
After Finding [Link]…Shellcode still needs specific function addresses. To do this, it checks:
• Export Directory
• Import Address Table (IAT)
These contain:
• Locations of functions in memory

Limitations of Shellcode
Although shellcode is a powerful tool used in exploiting vulnerabilities, it is subject to several practical
limitations during real-world attacks. These limitations arise due to constraints in memory, input
handling, and system protections.
To ensure successful execution, attackers often design shellcode carefully to overcome these
restrictions.
1. NULL Byte (0x00) Limitation
One of the primary limitations of shellcode is the presence of NULL bytes (0x00).
In many vulnerable programs, especially those using string-handling functions, a NULL byte is treated
as the end of input. If shellcode contains such bytes, the copying process stops prematurely,
preventing the full payload from being injected.
To overcome this issue, shellcode is written in a way that avoids NULL bytes. Instead of using direct
values, alternative instructions such as operations that compute values at runtime are used. For
example, logical operations can be used to generate required values without embedding NULL bytes
directly in the code.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

2. Input Filtering Restrictions

Another challenge arises from input filters implemented by programs or systems.
Some applications restrict user input to only certain characters, such as:
 Letters
 Numbers
This prevents the direct injection of raw binary shellcode, which often contains a wide range of byte
values.
To bypass this limitation, attackers use specially designed alphanumeric shellcode, which is
constructed using only permitted characters. This type of shellcode is encoded in a way that it passes
input validation and later decodes itself during execution.

3. Limited Buffer Space

Shellcode is often injected into memory regions such as buffers, which have limited size.
If the shellcode is too large:
 It may not fit into the available space
 It may overwrite unintended memory regions and cause failure
To address this, attackers use compact and optimized shellcode. In cases where larger functionality is
required, a technique called stage loading is used.
In stage loading:
 A small initial shellcode (stage 1) is injected
 This code then loads a larger payload (stage 2) from another location
This approach allows complex operations to be performed despite space limitations.

Stage Loading, Buffer Overflow Attack, and NOP Sled

Stage Loading
Concept
In many exploitation scenarios, shellcode cannot be very large due to memory constraints. To
overcome this limitation, a technique called stage loading is used, where the payload is divided into
multiple stages.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Instead of injecting a large piece of code at once, a small initial code (Stage 1) is used to load a more
complex payload (Stage 2).
Stage 1 (Loader Stub):
This is a small piece of shellcode designed to:
 Fit within limited buffer space
 Execute quickly
 Prepare the system to load additional code
Its main purpose is not to perform the attack itself, but to fetch or locate the main payload.
Stage 2 (Full Payload):
This is the actual, more complex shellcode that performs the intended malicious actions, such as:
 Opening a shell
 Establishing a remote connection
 Executing commands

Methods of Stage Loading

Stage 1 can retrieve Stage 2 using different techniques.
One common method is downloading from a remote server, where the initial shellcode connects to a
server and fetches the full payload.
Another method is egghunting, where the small shellcode searches the system’s memory for a specific
pattern (called an “egg”) that marks the location of the larger payload. Once found, execution is
transferred to it.

Buffer Overflow Attack

A buffer is a region of memory used to store data temporarily. A buffer overflow occurs when more data
is written into the buffer than it can hold.
When this happens:
 Extra data spills into adjacent memory
 Important information gets overwritten
How the Attack Works
In a buffer overflow attack:
 The attacker provides more input than expected
 This input overwrites critical memory locations
 Control of program execution is altered
Stack Buffer Overflow
A common type is the stack buffer overflow, which affects the program’s call stack.
In this case:
 The return address of a function is overwritten
 Instead of returning to the original code, execution is redirected
The attacker replaces the return address with the address of the shellcode, causing the program to
execute malicious code.
NOP Sled: A NOP sled is a technique used to increase the chances that the processor successfully
reaches the shellcode. NOP (No Operation) is an instruction that does nothing except move execution
to the next instruction.

Working
In memory, a NOP sled looks like:
[NOP][NOP][NOP] … [Shellcode]
When execution jumps to any point within the NOP sequence:
 The processor simply executes NOP instructions
 Eventually, it “slides” into the actual shellcode

Purpose
The exact memory address of shellcode may not always be known precisely. The NOP sled helps by:
 Providing a larger target area
 Reducing the need for exact address calculation
Thus, even if the jump is not accurate, the CPU will still reach the shellcode.
Tools & Resources, Detection Methods, and Detection Challenges in Shellcode
In cybersecurity, shellcode plays a crucial role in exploitation, and attackers often rely on various tools
and repositories to create or obtain it. At the same time, security systems attempt to detect such

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

malicious code using different techniques. However, detection is not always straightforward due to
several challenges, which have led to the development of more advanced detection methods.
Tools and Resources (Shellcode Repositories)
Attackers do not always write shellcode from scratch. Instead, they often use specialized tools and
online repositories that provide ready-made or customizable shellcode.
One such resource is [Link], which provides examples and generators for shellcode. It serves
as a repository where attackers can find prewritten payloads or learn how to construct them.
Another widely used tool is the Metasploit Framework. It includes built-in modules that can generate
shellcode for multiple platforms such as Windows, Linux, and UNIX. This makes it highly versatile for
exploit development.
Similarly, ShellForge is a tool that converts high-level C programs into shellcode. It also includes
features to generate specialized shellcode, such as:
 NULL-free shellcode
 Alphanumeric shellcode
These tools simplify the process of creating shellcode that can bypass common restrictions.
In addition to this, a large amount of ready-made shellcode is available online, allowing attackers to
reuse existing payloads instead of developing new ones.

Detection Methods
To defend against shellcode-based attacks, systems use various detection mechanisms.
One common method involves Intrusion Detection Systems (IDS) and Intrusion Prevention Systems
(IPS). These systems monitor network traffic and look for known patterns or signatures associated with
malicious code.
Another approach is the use of antivirus software, which scans files and system activity to detect the
presence of malicious code, including shellcode.
Both methods rely largely on identifying known patterns of attacks.

Detection Problems
Despite the availability of detection mechanisms, several challenges make detection difficult.
One major issue is false positives, where legitimate programs or data are incorrectly identified as
malicious. This can reduce the reliability of detection systems.
Another significant problem is that encrypted or obfuscated shellcode can bypass detection. Since
traditional systems rely on known signatures, any modification or encoding of shellcode can make it
unrecognizable to these systems.
These challenges highlight the limitations of conventional detection techniques.

Advanced Detection Techniques

To overcome these limitations, more advanced detection methods have been developed.
One such technique is emulation, where suspicious code is executed in a controlled or virtual
environment rather than on the actual system.
Tools such as libemu simulate the execution of code and observe its behavior. Instead of relying on
static patterns, they detect malicious activity based on:
 What the code does
 How it behaves during execution
This approach is more effective against obfuscated or previously unknown shellcode.

Integer Overflow Vulnerabilities

An integer overflow vulnerability occurs when a program attempts to store a numerical value that
exceeds the maximum limit of the data type used to represent it. Since computers allocate a fixed
number of bits for integers, any value beyond this limit causes the number to “wrap around,” leading
to unexpected results.
Such vulnerabilities are important in cybersecurity because they can lead to incorrect calculations,
memory allocation errors, and even system exploitation.

Basic Concept
In programming, integers are stored using a fixed number of bits. For example:
 A typical integer type has a limited range
 If this range is exceeded, the value does not increase further
 Instead, it wraps around to a lower or negative value
This behavior is known as overflow.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

For instance, if a variable reaches its maximum value and one more is added, it may reset to a
minimum value. This unexpected change can disrupt program logic.

How Integer Overflow Occurs

Integer overflow typically occurs during arithmetic operations such as:
 Addition
 Multiplication
 Subtraction
If proper checks are not performed, calculations may exceed the allowed range.
In many programs, user input or external data is used in calculations. If this input is not validated, an
attacker can intentionally supply values that trigger overflow.

Impact of Integer Overflow

The consequences of integer overflow can be serious.
It may lead to:
 Incorrect program behavior
 Logical errors in calculations
 Security vulnerabilities
One critical impact is related to memory allocation. If a program calculates the size of memory
incorrectly due to overflow:
 It may allocate less memory than required
 This can lead to buffer overflow conditions
Thus, integer overflow can indirectly enable other attacks.

Integer Overflow in Security Context

In cybersecurity, attackers exploit integer overflow to manipulate program behavior.
For example:
 A program calculates buffer size using an integer
 Overflow causes the calculated size to be smaller than expected
 The attacker then provides large input, leading to memory corruption
This allows attackers to:
 Overwrite memory
 Inject malicious code
 Gain control over the system

Example Scenario
Consider a situation where a program multiplies two values to determine memory size. If the result
exceeds the maximum limit of the integer type, the computed value becomes incorrect.
As a result:
 The allocated memory is insufficient
 Writing beyond this memory leads to overflow
 This creates an opportunity for exploitation

Prevention of Integer Overflow

To prevent integer overflow vulnerabilities, programs must include proper validation and checks.
This involves:
 Verifying input values before performing operations
 Using appropriate data types with sufficient range
 Implementing boundary checks during calculations
These measures help ensure that values remain within safe limits.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Stack-Based Buffer Overflow

Introduction
A stack-based buffer overflow is a type of vulnerability that occurs when a program writes more data
into a buffer located on the stack memory than it can hold. This excess data overwrites adjacent
memory locations, including critical control information.
In cybersecurity, this vulnerability is significant because it allows attackers to manipulate program
execution and potentially run malicious code.
Understanding Stack Memory
The stack is a region of memory used for:
 Function calls
 Local variables
 Return addresses
Whenever a function is called:
 A stack frame is created
 It stores parameters, local variables, and the return address
When the function completes execution, control returns to the address stored in this stack frame.
Basic Concept of Stack-Based Buffer Overflow
A buffer overflow occurs when:
 A buffer (temporary memory space) has a fixed size
 More data is written than it can store
In the case of stack-based overflow:
 The extra data spills into nearby memory
 It can overwrite the return address
If the return address is altered, the program may jump to a location chosen by the attacker instead of
returning normally.
Working of the Attack
The attack typically follows a sequence.
First, the attacker identifies a vulnerable program that does not properly check input size. Then,
specially crafted input is provided that: Fills the buffer completely, continues writing beyond it
This overflow overwrites the return address on the stack. The attacker replaces this address with the
location of malicious code (shellcode).
When the function returns:
 Instead of going back to normal execution
 The program jumps to the attacker’s code
Thus, control of execution is gained.

Subsections of Stack-Based Buffer Overflow

1. Stack Frame Structure
Each function call creates a stack frame, which contains:

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 Local variables (including buffers)

 Saved registers
 Return address
The buffer is usually located before the return address in memory. When overflow occurs, the return
address becomes a target for overwriting.
Understanding this structure is crucial for exploiting or preventing such vulnerabilities.

2. Overwriting the Return Address

The most critical part of the attack is overwriting the return address.
Normally:
 The return address points to the next instruction in the program
During overflow:
 The attacker replaces it with an address pointing to shellcode
As a result:
 Control flow is redirected
 Malicious code gets executed

3. Shellcode Injection
In many cases, the attacker includes shellcode within the overflow data itself.
This shellcode is placed in memory along with the input. Once the return address is overwritten:
 Execution jumps to the shellcode
 The shellcode performs actions like opening a shell or executing commands

4. NOP Sled Usage

To improve the success rate of the attack, attackers often use a NOP sled.
A sequence of “do nothing” instructions is placed before the shellcode:
[NOP][NOP][NOP] … [Shellcode]
If the return address points anywhere within this region:
 Execution slides through NOPs
 Eventually reaches the shellcode
This reduces the need for precise address targeting.

5. Exploitation Outcome
Once the attack is successful:
 The attacker gains control of program execution
 The system may execute unauthorized commands
 Security of the system is compromised
The level of impact depends on the privileges of the affected program.

Stack-Based Buffer Overflow – Subsections

1. Stacks upon Stacks
In a program’s execution, the stack is not static; it continuously grows and shrinks as functions are
called and returned. Each function call creates a new stack frame, and multiple such frames are placed
one over another, forming a layered structure.
This is often described as “stacks upon stacks”, where:
 Each function has its own stack frame
 Frames are arranged in a last-in, first-out manner
 The most recently called function is placed at the top
Within each stack frame:
 Local variables (including buffers) are stored
 Control information such as return addresses is maintained
Because these frames are closely packed in memory, an overflow in one frame can affect adjacent
data, making the stack particularly vulnerable to attacks.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

2. Crossing the Line

The phrase “crossing the line” refers to the situation where input data exceeds the allocated boundary
of a buffer and starts overwriting adjacent memory.
In a stack-based buffer:
 A fixed size is allocated for storing input
 If the input stays within limits, the program behaves normally
 If the input exceeds the limit, it “crosses the boundary”
When this happens:
 Nearby variables may get corrupted
 More importantly, critical control data such as the return address can be overwritten
This boundary crossing is the core reason why buffer overflow vulnerabilities become exploitable, as
it allows attackers to interfere with the normal execution flow of the program.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

3. Protecting Against Stack-Based Buffer Overflows

To prevent such vulnerabilities, several protective measures can be implemented during software
development and execution.
The most fundamental approach is input validation, where programs ensure that input data does not
exceed the buffer size. By enforcing strict limits, overflow conditions can be avoided.
Another important method is the use of safe programming practices, such as:
 Using bounded functions that restrict input size
 Avoiding unsafe operations that do not perform boundary checks
Additionally, modern systems employ runtime protections that monitor memory usage and detect
abnormal behavior. These protections help prevent unauthorized modification of stack data.
Overall, protection focuses on ensuring that memory boundaries are respected and critical data
remains intact.

4. Stack-Based Buffer Overflow Mitigation

Mitigation techniques go beyond basic protection and aim to reduce the impact of an attack even if a
vulnerability exists.
One common approach is to make the stack non-executable, so even if shellcode is injected, it cannot
be executed.
Another technique involves placing special values or markers between buffers and control data. If
these markers are altered, the system detects a potential overflow and stops execution.
Memory layout randomization is also used, where the location of stack elements changes each time,
a program runs. This makes it difficult for attackers to predict the exact address needed to execute
shellcode.
These mitigation strategies do not eliminate vulnerabilities completely but significantly reduce the
chances of successful exploitation.

FORMAT STRING VULNERABILITIES

Format string vulnerabilities occur in the printf() print formatting function and similar functions. These
vulnerabilities can put the stack, a critical component of program execution, at risk of corruption.
The printf() Function
The printf() function (Print Formatted Output) is used to print output to the screen. It accepts a
parameter that specifies how the function should interpret and display data.
For example, a programmer may print:
 The character A
 The decimal value of A (65)
 The hexadecimal representation of A (0x41)
The function prototype is:
int printf(const char *format, ...)
Format Specifiers
The first parameter, format, is a string that contains formatting instructions.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Common format specifiers include:

Specifier Purpose
%s String
%d Decimal number
%x Hexadecimal value
%n Writes the number of bytes printed so far to a memory location
The %n specifier is particularly important because it allows the printf function to write to an arbitrary
memory location with the number of bytes written so far.

Variable Number of Parameters

The "..." in the function definition allows printf() to accept an unknown number of parameters.
A va_list structure is used to store these parameters.
Normally, a compiler checks whether the number of arguments passed to a function matches its
definition. However, printf() and similar functions are exceptions because the number of required
arguments depends on the format string itself.
Using only one parameter with printf() can become dangerous if a user can influence that parameter.

Legitimate Use of printf()

Example:
string = "hello";
decimal = 1234;

printf("%s : %d", string, decimal);

Total parameters passed: Three
1. Format string
2. string
3. decimal
Output:
hello : 1234
Before calling printf(), the program pushes the parameters onto the stack.
The printf() function then examines the format string %s : %d and determines how many variables must
be removed from the stack to fill the specified formats.

Vulnerable Program Example

A simple vulnerable program directly passes user input to the format parameter:
printf(input);
In this case, the user controls the format string.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Format String Attack

An attacker executes the vulnerable program with specially crafted input:
$ ./format_string_vulnerable `perl –e 'print "AAAA";
print "%.8x"x 100'`
The attack input contains:
 AAAA
 Repeated %.8x format specifiers
The %x specifier instructs printf() to display values in hexadecimal form.
The resulting output reveals many hexadecimal values from memory.
Example excerpt:
AAAA.00000400.080485d0...
...
41414141...
The value:
41414141
represents:
AAAA
in hexadecimal notation.

Purpose of Using AAAA

The attacker uses AAAA because its hexadecimal representation is easy to recognize:
AAAA = 0x41414141
By locating 41414141 in the output, the attacker can determine where the supplied string resides on
the stack.
This helps the attacker:
1. Identify the position of the input string on the stack.
2. Attempt to locate the value representing the return address.

Stack Behavior During the Attack

In this attack:
 Only a format string is supplied.
 No additional parameters are provided.
Normally, each %.8x in the format string would correspond to a variable placed on the stack.
However, because no matching variables exist, printf() begins reading other contents already present
on the stack.
As more %x specifiers are processed, additional stack contents are disclosed.
Eventually, the output may reveal the location of the return address.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Consequences of User-Controlled Format Strings

When a user controls the format parameter, the user can:
 Specify formats that remove extra data from the stack.
 View memory contents.
 Request any number of variables through the format string.
This occurs because printf() relies entirely on the format string to determine how many values to retrieve
from the stack.
As a result, sensitive stack data may be disclosed.

Key Points for Exams

 Format string vulnerabilities occur in printf() and similar functions.
 They can corrupt or expose information from the stack.
 The first parameter of printf() is the format string.
 Common specifiers are %s, %d, %x, and %n.
 The %n specifier can write to a memory location and is important in exploitation.
 The ... notation allows printf() to accept a variable number of parameters using va_list.
 A vulnerable call is:
printf(input);
 Attackers often use repeated %x specifiers to read stack contents.
 The value 0x41414141 corresponds to the string AAAA.
 By locating 41414141 in memory output, attackers can determine the stack position of their
input.
 User-controlled format strings can disclose memory contents and potentially reveal return
addesses.

SQL INJECTION
Structured Query Language (SQL) Injection is one of the most common and dangerous vulnerabilities
in web applications. These attacks result from failing to validate user inputs. In recent years, SQL
injection attacks have increased significantly and often target thousands of websites at a time. Attackers
commonly use search engines to identify vulnerable sites and then use SQL injection to alter website
content by inserting malicious IFrames or downloading malicious code to visitors of compromised sites.
SQL injection is simple for attackers to perform and can often be prevented by validating user-submitted
strings or using prepared statements.
Definition :
SQL injection is fundamentally an input validation error. It occurs when an application that interacts
with a database passes data to an SQL query in an unsafe manner. The consequences of a successful
SQL injection attack may include:
 Sensitive data leakage
 Website defacement
 Destruction of the entire database

SQL and Database Queries

SQL is a computer language used by programs to interact with relational databases such as MySQL
and Microsoft SQL Server. To retrieve, insert, or update information, programmers create SQL queries
that access specific data from the database.
Example of a Simple Query

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

SELECT text FROM blog_entries;

This query returns the data stored in the text column of all rows in the blog_entries table.
Example of a More Specific Query
SELECT text,user,timestamp FROM blog_entries
WHERE user = 'user1';
This query retrieves:
 Blog text
 Username of the author
 Time of publication
The WHERE clause ensures that only entries written by user1 are returned.

Dynamic SQL Queries

Web applications often create dynamic queries using programming languages such as PHP, Perl, or
ASP.
Example pseudocode:
#Get Username
username = getInputFromUser()

#Create SQL Query containing username

sql_query = "SELECT text,user,timestamp FROM blog_entries
where user = '" + username + "';"

#Execute complete query

[Link](sql_query);
The program:
1. Obtains the username from the user.
2. Concatenates the username with the query.
3. Executes the completed query in the database.
This approach is vulnerable because it does not properly validate user input.

SQL Injection Attack

An attacker can supply input that the database interprets as SQL code rather than ordinary data.
Normal Query
SELECT text, user, timestamp
FROM blog_entries
WHERE user = 'user1';
Malicious Query
SELECT text, user, timestamp
FROM blog_entries
WHERE user = 'x';
SELECT uname, pwd FROM users; --';
Attacker Input
x'; SELECT uname,pwd FROM users; --
The attack string contains:
 x followed by a single quotation mark
 A semicolon to terminate the original query
 A second SQL statement
 -- to comment out the remainder of the original query
The database executes the attacker’s query and returns usernames and passwords instead of the
expected blog information.

Impact of SQL Injection

A successful SQL injection attack can:
 Retrieve sensitive information such as usernames and passwords.
 Modify database contents using an UPDATE command.
 Destroy the entire database using a DROP command.
Since early 2007, attackers have launched widespread SQL injection attacks that insert malicious
IFrames into websites. When users visit these compromised sites, the malicious IFrames attempt to
infect visitors. This transforms a trusted website into a malicious one through SQL injection.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Protecting Against SQL Injection

Protecting against SQL injection requires ensuring that data used in SQL queries are valid and are not
executed as code by the database engine. Programmers generally use two methods.
1. Input Sanitization and Validation
Programmers ensure that user input does not contain special characters such as single quotation marks
that could cause the database to treat data as executable code.
One commonly used function is:
mysql_real_escape_string
This function places a backslash before special characters, causing the database to interpret them as
data rather than executable commands.
Another approach is to allow only valid data into the application. For example, fields that should contain
only letters and numbers can be validated using regular expressions before being included in SQL
queries.

2. Parameterized Queries
Parameterized queries allow programmers to define SQL code separately from user data, avoiding
dangerous string concatenation.
Example pseudocode:
#Get Username
username = getInputFromUser()

#Create Parameterized Query

sql_query =
"SELECT text,user,timestamp FROM blog_entries
where user = %s;"

#Execute Query
[Link](sql_query, (username));
With parameterized queries, the database can distinguish between code and data, preventing SQL
injection attacks. However, this capability is not available in all programming languages.

Web Application Firewall (WAF)

Organizations that cannot adequately audit or test their applications may use a Web Application
Firewall (WAF).
 A WAF can filter incoming requests for SQL injection and other attacks.
 ModSecurity is an open-source WAF that can function as a reverse proxy between a web
server and the Internet.

Conclusion
SQL injection attacks have become extremely common. Automated attacks launched by botnets
continuously scan the Internet for vulnerable web pages and attempt to compromise them. Protecting
databases requires ensuring that SQL queries contain properly validated data that cannot be interpreted
as executable code. Although the defenses against SQL injection are simple to implement, they are
often overlooked. Administrators should test web applications for SQL injection vulnerabilities whenever
possible and consider deploying a WAF when testing is not feasible.

Exam-Oriented Key Points

 SQL injection is an input validation error.
 It occurs when applications pass user data to SQL queries in an unsafe manner.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 Consequences include:
o Sensitive data leakage
o Website defacement
o Database destruction
 Dynamic queries created through string concatenation are vulnerable.
 Attackers can inject SQL commands that are executed by the database.
 SQL injection attacks may retrieve, modify, or destroy database data.
 Protection methods:
1. Input sanitization and validation
2. Parameterized queries
3. Web Application Firewalls (WAFs)
 Proper validation ensures that user input is treated as data rather than executable SQL code.

MALICIOUS PDF FILES

Portable Document Format (PDF) files are extremely common, and users often do not realize the
potential danger they pose. Adobe Acrobat is commonly installed on Microsoft Windows computers.
PDF files are risky because many users have vulnerable PDF viewers that attackers can exploit to
install malicious code. Attackers also use PDF files in targeted attacks because victims can often be
convinced to open a PDF document. Multiple previously unknown or unpatched PDF vulnerabilities
allowed attackers to launch targeted attacks against high-priority victims as of 2009.
To make matters worse, web browsers automatically load PDF files. As a result, a malicious PDF file
can exploit a user's computer without any interaction once the user visits a malicious website.
Commercial web attack toolkits commonly include PDF exploits because PDF viewers are widely
installed and can affect multiple browsers, including Internet Explorer and Firefox.

Characteristics of Malicious PDF Files

Malicious PDF files usually contain JavaScript, although many exceptions exist that can execute
arbitrary code without JavaScript.
Attackers commonly use JavaScript because:
 It can allocate large blocks of memory (heap spraying).
 It allows attackers to reliably jump to certain memory addresses after exploiting a vulnerability.
 It helps hide the intent of malicious code.
 Functions such as eval() can dynamically execute statements when the JavaScript code runs.

PDF File Format

The PDF file format is largely based on plain text tags, although many stream objects use
compression. When a PDF file is opened in a hex editor, it contains numbered objects such as:
1 0 obj
Other sections of the PDF file can reference these objects by number.
Components of a PDF File
Each object contains attribute tags describing its purpose.
Important tags include:
 obj
 endobj
 stream
 endstream
Each attribute begins with “/”.
Cross-Reference Table (xref)
The cross-reference (xref) table contains entries corresponding to the file offset for each object.
FlateDecode Attribute
One common attribute is:
/FlateDecode
The PDF viewer decompresses this data using the zlib library.
Example:
14 0 obj
<</Length 838 /Filter /FlateDecode>>
stream
... zlib compressed binary data ...

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

endstream
endobj

Execution of JavaScript in PDF Files

Malicious PDF files often contain malicious JavaScript code that analysts can inspect after
decompressing the zlib data.
To execute JavaScript when the PDF is opened, the author assigns an action to an object.
Examples:
<</Type/Action/S/JavaScript/JS 14 0 R >>
<</OpenAction <</JS (...)
/S /JavaScript
The Action attribute instructs the PDF reader to execute the JavaScript code contained in the specified
object. The OpenAction attribute can call a JavaScript function when the file is opened.

Adobe JavaScript Engine

The Adobe JavaScript engine exposes several PDF-specific objects, including:
 app
 doc
 dbg
 console
 global
 util
 dialog
 security
 SOAP
 search
 ADBC
 event
It also provides online collaboration commands for review, markup, and approval. These exposed
objects have often been the target of vulnerabilities exploited by attackers.

Creating Malicious PDF Files

Many common web exploit toolkits include PDF exploits that use JavaScript vulnerabilities to execute
arbitrary code.
Examples of vulnerable JavaScript functions include:
CVE ID Vulnerable JavaScript Function
CVE-2007-5659 [Link]
CVE-2008-2992 [Link]
CVE-2009-0927 [Link]
CVE-2009-1493 [Link]
CVE-2009-1492 getAnnots
Tools Used
Several publicly available tools can embed JavaScript into PDF files and decode PDF files.
Examples include:
 Origami Ruby Framework
 make-pdf

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 pdf-parse
 pdf-id
The Origami framework can modify an existing PDF file by injecting custom JavaScript code that
executes when users open the PDF file.
JavaScript Deobfuscation Tools
Authors commonly use obfuscation techniques to hide malicious JavaScript.
Tools such as:
 jsunpack-n
help analyze PDF files by decoding PDFs and interpreting JavaScript code.

Embedded Flash Content

Malicious content can also be embedded using Flash objects.
Adobe Reader 9 introduced an embedded Flash interpreter. iDefense analyzed targeted attacks that
embedded malicious Flash objects inside PDF files. The ability to embed malicious files inside PDFs
increases the attack surface of PDF viewers.

Reducing the Risks of Malicious PDF Files

1. Disable JavaScript
One method of limiting the effectiveness of many exploits is disabling JavaScript in the PDF reader:
Preferences → JavaScript → Uncheck Enable Acrobat JavaScript
This reduces the effectiveness of many PDF vulnerabilities used in web exploit toolkits. However,
vulnerabilities that do not depend on JavaScript may still be effective.
A user may still execute malicious JavaScript if prompted. Normally, selecting “No” when prompted
has no negative impact on PDF behavior.

2. Disable Embedded Flash and Multimedia

Adobe Acrobat can be configured to disable embedded Flash files and other media content.
Path:
Preferences → Multimedia Trust (legacy)
Uncheck:
Allow multimedia operations
for both trusted and untrusted documents.

3. Prevent Automatic PDF Loading in Browsers

Preventing browsers from automatically opening PDF files reduces the risk of malicious PDFs. Many
exploits embed invisible PDF objects or redirect users to malicious PDF content. Victims may not
intentionally open the PDF because browsers can load them automatically.
Examples:
 Disable the Adobe Acrobat add-on in Firefox.
 Disable Adobe browser add-ons in Internet Explorer.
To completely prevent automatic opening of PDFs in Internet Explorer, it may also be necessary to
remove the PDF file type association from:
Tools → Folder Options → File Types

4. Use PDF Conversion Tools

PDF conversion tools can reduce the impact of attacks.
Example:
pdftotext
This Linux utility converts PDF files to plain text. Although this removes visual components, media
files, and interactive features, it can reduce exposure to malicious content.

Conclusion
Attackers frequently use malicious PDF files in both targeted attacks and browser-based attacks.
Attackers can modify any existing PDF file to append malicious content; therefore, any PDF file may
contain malicious content regardless of how much the user trusts it.
To reduce the risk of arbitrary code execution, administrators can eliminate common dependencies
used by malicious PDF files, including JavaScript and embedded media content. Although these
measures may reduce PDF functionality, PDF files rarely require JavaScript and multimedia for normal
operation. The rich functionality of PDF files is one of the primary reasons attackers continue to target
them.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Exam-Oriented Key Points

 PDF files can be used to install malicious code.
 Browsers may automatically load PDF files, enabling attacks without user interaction.
 Malicious PDFs commonly contain JavaScript.
 JavaScript is used for heap spraying and hiding malicious intent.
 PDF files consist of objects, streams, attributes, and xref tables.
 Action and OpenAction attributes can execute JavaScript automatically.
 Attackers create malicious PDFs using tools such as Origami, make-pdf, pdf-parse, and pdf-id.
 Embedded Flash content can also be used in attacks.
 Risk reduction measures include:
o Disabling JavaScript
o Disabling multimedia content
o Preventing automatic PDF loading in browsers
o Using PDF conversion tools
 Any PDF file may contain malicious content because attackers can modify existing PDF files

RACE CONDITIONS
Race conditions occur when an electronic device or process attempts to perform two or more
operations at the same time, resulting in an illegal operation. Race conditions are a type of
vulnerability that attackers can use to influence shared data, causing a program to use arbitrary data
and allowing attackers to bypass access restrictions. Such conditions may lead to:
 Data corruption
 Privilege escalation
 Code execution
when they occur in an appropriate context.

Definition of Race Conditions

Race conditions are also known as Time-of-Check and Time-of-Use (TOC/TOU) vulnerabilities
because they involve changing a shared value immediately after the check phase. When the program
later uses this unexpected value, it may execute instructions intended for a different purpose or allow
attackers to redirect critical information.

Environments Favorable to Race Conditions

Race conditions are becoming more common because modern applications increasingly use:
 Multiple threads
 Multiple CPU cores
 Parallel access systems

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Future systems containing tens or hundreds of processor cores may make race conditions possible in
even more applications.
Factors conducive to race conditions include:
 Multiple callers
 Multiple CPUs
 Multiple threads
 Parallel access systems

Local and Network Race Conditions

Race conditions can occur both locally and across networks.
Network race conditions introduce more latency and therefore often provide a larger window of
opportunity for attackers. The text notes that during the time required for a single network operation
(approximately 0.1 seconds), modern CPUs can execute about 7.5 billion instructions. Therefore,
race conditions generally have:
 Smaller windows of opportunity in local operations
 Larger windows of opportunity in network operations
Requirements for Race Conditions
Race conditions are limited in where they occur because they require multiple callers accessing
shared information.
Examples include:
 Multiple threads accessing shared memory
 Multiple threads accessing shared files
 Multiple threads accessing other shared program data
Traffic Signal Analogy
A race condition can be compared to a traffic signal with only two states:
 Green (Go)
 Red (Stop)
A race condition is similar to two drivers being in the intersection at the same time because there is no
delay between state changes. Like automobile accidents, race conditions can have catastrophic effects
on threads and applications.

Examples of Race Conditions

1. DNS Answering Race Condition
Network race conditions are common in non-TCP protocols such as User Datagram Protocol (UDP).
Many network communications accept the first answer received. Therefore, there is a short period
between:
1. Asking a question
2. Receiving the legitimate answer
During this interval, an attacker may attempt to provide a fraudulent answer before the legitimate
response arrives. A Domain Name System (DNS) answering race condition is one such example.
Difficulties in Exploitation
Exploiting DNS race conditions is difficult because:
 Attackers do not know when a victim will ask a question.
 Attackers do not know what question will be asked.
 Incorrect answers are ignored by the client.
 DNS caching reduces opportunities for attack.
 DNS Time-To-Live (TTL) limits repeated queries.
As a result, attackers often flood victims with responses to questions that were never asked. Such
attacks are considered "blind" attacks because attackers do not know when the victim is vulnerable.

2. Privileged Application and File Race Condition

Race conditions can occur when privileged applications use unprivileged files.
An example involves the X Font Server (xfs) service running as root. The service changes the
permissions of a file in the /tmp/ directory to world writable.
If an attacker creates a symbolic link (symlink) at the correct moment, the permission change affects
the symlink target rather than the intended file. By repeatedly attempting to create a symlink to
/etc/passwd, an attacker may cause the service to change the permissions of that file.
This allows the attacker to:

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 Add a new account to /etc/passwd

 Gain root privileges
The attack therefore enables privilege escalation.

3. Shared Memory Race Condition

Race conditions can also affect shared process memory.
Example pseudocode:
FunctionAddress = memory[pointerA]

If FunctionAddress within [Link]: # STATEMENT1

Then:
Parameters = memory[pointerB]
Call FunctionAddress with Parameters # STATEMENT2
In this example:
 STATEMENT1 represents the Time-of-Check (TOC).
 STATEMENT2 represents the Time-of-Use (TOU).
Between these two statements, another thread may alter the values stored at pointerA and pointerB.
As a result, an attacker may:
 Execute any function
 Supply arbitrary parameters
 Bypass restrictions enforced during the check phase
A Linux kernel vulnerability in version 2.6.29 demonstrated a similar issue because the lock between
the ptrace_attach() and execve() functions did not adequately prevent multiple threads from accessing
shared memory. Exploiting the vulnerability allowed local privilege escalation.

Difficulties in Exploiting Race Conditions

Race conditions are difficult to locate and exploit because instructions execute in extremely small
amounts of time.
Several factors make exploitation difficult:
Operating System Scheduling
The operating system scheduler determines the priority of applications and threads rather than the
user application.
As a result, attackers have little control over the exact timing required for successful exploitation.
Interrupt Requests (IRQs)
Operating systems use interrupt requests (IRQs) to trigger actions.
Interrupts can:
 Change execution flow
 Help exploitation
 Hinder exploitation
Because interrupts are unpredictable, timing attacks become difficult to perform reliably.
Brute Force Requirement
Due to these timing uncertainties, attackers often repeat the same operation millions of times until
favorable conditions occur. Race condition exploitation therefore frequently requires brute-force
techniques.

Detecting Race Conditions

Since race condition attacks commonly use brute-force methods, they may generate noticeable
anomalies.
Indicators include:
 Extended spikes in CPU utilization
 Large numbers of failed requests
 Frequently repeated operations
System administrators should monitor systems for such unusual activity.

Preventing Race Conditions

Race conditions can be prevented if programmers use appropriate synchronization mechanisms.
Semaphores and Mutexes

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Semaphores and mutexes (mutual exclusions) provide instructions that are not vulnerable to race
conditions.
Atomic Instructions
Mutex operations succeed because they are based on atomic instructions.
An atomic instruction:
 Executes in a single CPU clock cycle.
A nonatomic instruction:
 Executes across multiple clock cycles.
Atomic vs. Nonatomic Locking
In a nonatomic implementation:
 Thread1 and Thread2 may both obtain the same lock.
In an atomic implementation:
 The check-and-lock procedure occurs as a single instruction.
 Thread1 obtains the lock.
 Thread2 detects that the lock is unavailable.
This prevents the race condition.
Lock Management
When a resource is successfully locked using an atomic instruction:
 The program can proceed knowing no other thread has locked the same resource.
 Programs must release locks when finished.
Many mutex systems distinguish between:
 Read locks
 Write locks
Giving writers higher priority can reduce writer starvation when many readers exist.

Conclusion
Race condition vulnerabilities are used less frequently than buffer overflows and other code execution
vulnerabilities. They are generally less reliable and often require large volumes of traffic or activity,
which may attract attention.
Attackers most commonly use race conditions to escalate privileges, because they often cannot
precisely control the desired action triggered by the race condition using otherwise untrusted data.

Exam-Oriented Key Points

 Race conditions occur when two or more operations execute simultaneously and produce an
illegal operation.
 Race conditions are also called TOC/TOU (Time-of-Check/Time-of-Use) vulnerabilities.
 They require multiple callers accessing shared resources.
 Possible consequences include:
o Data corruption
o Privilege escalation
o Code execution
 Common environments include multithreaded and multicore systems.
 Examples:
o DNS answering race condition
o Symlink race condition in X Font Server
o Shared memory race condition
 Exploitation is difficult because of scheduling and interrupt timing.
 Detection indicators include CPU spikes and repeated failed requests.
 Prevention methods include:
o Semaphores
o Mutexes
o Atomic instructions
 Race conditions are most commonly used for privilege escalation.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

WEB EXPLOIT TOOLS

To identify vulnerable targets and deliver appropriate exploits, attackers frequently use Web exploit
tools containing exploits for numerous vulnerabilities. Some of these tools are freely available, while
the most effective ones are often purchased through hacking forums. After infecting users with a
selected payload, the tools collect statistics that help attackers conduct more targeted attacks and
track metrics such as the number of successful installations.
Web exploit tools, also known as exploit kits, give attackers the ability to execute arbitrary code using
vulnerabilities or social engineering techniques.

How Web Exploit Tools Work

Attackers often compromise servers and append IFrame tags that redirect visitors to malicious
websites hosting Web exploit tools.
The attack process is:
1. A victim visits a compromised website.
2. The website redirects the victim to a Web exploit tool.
3. The exploit tool attempts to launch multiple exploits.
4. Successful exploitation allows arbitrary malicious code to execute.
5. A virus or other malicious executable is installed on the victim’s computer.
Most Web exploit tools are very simple to operate. The operator often needs only to provide the
executable virus for installation. The exploit tool automatically handles:
 Hiding
 Exploitation
 Statistics collection

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Features for Hiding

Many exploit tools attempt to prevent both detection and analysis.
Common hiding techniques include:
 Encoding
 Obfuscation
 Redirection
Encoding
Exploit tools frequently encode traffic so that the victim decodes it using:
 JavaScript
 VBScript
Because the content transferred over the network differs from the content executed on the client
machine, intrusion detection systems (IDSs) may be ineffective at detecting these encodings.

Client Profiling
Exploit tools commonly use JavaScript or HTTP headers to profile clients and determine whether they
are vulnerable.
Information gathered may include:
 Browser type
 Browser version
 User-Agent header information
 Browser variables such as navigator or app
The exploit tool may:
 Detect multiple vulnerabilities.
 Determine which exploit is most likely to succeed.
 Decide whether multiple attacks should be attempted.
If the client is not vulnerable, the exploit tool may:
 Redirect the user to a benign URL.
 Display an empty page.

Additional Victim Analysis

Exploit tools may also analyze:
 Browser language
 Geographic location of the victim
 Referrer HTTP header
The referrer header helps determine whether the victim originated from an infected page.
This allows exploit tools to avoid sending malicious content to researchers who attempt to discover or
analyze malicious websites through search engines or other methods.

Commercial Web Exploit Tools and Services

A large variety of commercial Web exploit tools and services exist for installing malicious code on
victims’ computers.
The purchase price of exploit tool source code ranges from:
 Approximately US$30
 Up to US$2,000
Examples of exploit kits mentioned in the source include:
 AD Pack
 Armitage
 Firepack
 G-Pack
 IcePack Lite
 IcePack Platinum
 Le Fiesta
 MPack
 Neosploit
 SPREADER
 Tornado
 WebAttacker
 WebAttacker II

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Market-Driven Exploit Services

Running an exploit tool requires little technical knowledge because the only required input is typically
an executable file.
The major commercial markets are:
1. Selling traffic (IFrames)
2. Selling installs

Pay-Per-Install Services
Pay-per-install services allow customers to buy and sell software installations.
The customer supplies the executable, and the service installs it on victim systems.
Examples include:
 IFrameDollars
 [Link]

Pay-Per-Traffic Services
Pay-per-traffic services provide large numbers of visitors to exploit tools.
Attackers can then:
 Install their own malware
 Sell installations through pay-per-install services
Examples include:
 [Link]
 [Link]

Traffic Generation
Attackers may generate traffic to exploit tools by exploiting vulnerable websites.
One method is SQL injection, which allows attackers to inject IFrames into vulnerable servers.
Infected websites often contain multiple levels of redirection. These redirects may support both pay-
per-traffic and pay-per-install business models.
The work is often divided into:
 Generating traffic
 Exploiting systems
 Running arbitrary executables on victim machines
Attackers can profit by specializing in any one of these activities.

Updates, Statistics, and Administration

Most modern Web exploit tools target:
 Browser vulnerabilities
 Browser plug-in vulnerabilities
Attackers can:
 Develop new exploits.
 Integrate newly released public exploits.
 Improve the likelihood of successful attacks.
Some attackers advertise:
 Zero-day exploits
 Premium versions that include the latest exploits
However, many exploit tools commonly integrate publicly available exploits.

Visitor Statistics
Many exploit tools collect detailed statistics about victims.
Examples of collected information include:
 Country
 Operating system
 Browser type
The Le Fiesta exploit tool is specifically noted for tracking numerous visitor attributes and building
victim statistics to help operators decide which software should be targeted.

Administration Interfaces
Many exploit tools provide password-protected administration interfaces.

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

These interfaces allow attackers to:

 Obtain detailed information
 Modify exploit tool behavior
 Perform administrative actions
Some exploit tools use databases such as MySQL for permanent storage.

Proliferation of Web Exploit Tools

Many commercial exploit tools have been offered free on hacking forums, making it unclear how
profitable exploit tool development remains.
Despite this, exploit tools continue to proliferate.

Protection Mechanisms Used by Exploit Tool Authors

Some Web exploit tools contain protections intended to prevent copying and modification.
These protections include:
 Source code obfuscation
 Per-domain licenses
 Network-based license validation
 End-user license agreements (EULAs)
Because many exploit tools are written in PHP, authors often use commercial PHP obfuscation
products such as:
 NuSphere’s NuCoder
 Zend Guard
to protect their source code.
Some tools, such as Neosploit, use compiled C code running as CGI programs, making reverse
engineering and modification more difficult.

Limitations of Protection Mechanisms

Despite these protections:
 Copying remains common.
 Exploit tools continue to spread widely.
 Reverse engineering remains possible.
 Tools such as Dezend may help reverse Zend Guard encoding.
Compiled programs provide additional protection but do not completely prevent modification.

Conclusion
Attackers do not always purchase exploit tools because some are freely available. Commercial
markets supporting exploit tool usage continue to operate through pay-per-traffic and pay-per-install
business models.
The widespread availability of Web exploit tools indicates continued investment in this area.
Commercial exploit tools commonly include hiding and obfuscation mechanisms to evade defensive
measures.
Attackers also collect victim statistics and trends, allowing them to improve future attacks. The
separation of traffic generation, exploitation, and installation activities is likely to continue as each area
develops further.

Exam-Oriented Key Points

 Web exploit tools (exploit kits) allow attackers to execute arbitrary code using vulnerabilities or
social engineering.
 Victims are often redirected through malicious IFrames to exploit tool websites.
 Exploit tools automatically handle:
o Hiding
o Exploitation
o Statistics collection
 Common hiding techniques:
o Encoding
o Obfuscation
o Redirection
 Exploit tools profile victims using JavaScript and HTTP headers.
 Commercial markets include:

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

o Pay-per-install
o Pay-per-traffic
 Exploit tools commonly target browser and browser plug-in vulnerabilities.
 Many tools collect statistics on victims’ operating systems, browsers, and locations.
 Protection methods used by exploit tool authors include obfuscation, licensing systems, and
source-code protection.
 Despite protections, exploit tools continue to spread and remain widely available.

DENIAL OF SERVICE (DOS) CONDITIONS

Denial of Service (DoS) attacks attempt to prevent legitimate users from accessing a service. Unlike
many other attacks, the goal of a DoS attack is not necessarily to gain unauthorized access but to
make a system, application, or network resource unavailable to its intended users.
DoS attacks are important because they can disrupt business operations, prevent access to critical
services, and consume system resources. The effectiveness of a DoS attack depends on the attacker's
ability to exhaust or misuse resources required by the target system.

Definition of DoS Conditions

A Denial of Service condition occurs when an attacker causes a service to become unavailable or
significantly degraded for legitimate users.
DoS conditions can result from:
 Resource exhaustion
 Excessive processing requirements
 Memory consumption
 Network bandwidth consumption
 Software flaws
The attack focuses on reducing availability rather than compromising confidentiality or integrity.

Resource Exhaustion
Many DoS attacks attempt to consume limited resources until no resources remain for legitimate users.
Common resources targeted include:
 CPU time
 Memory
 Disk space
 Network bandwidth
 Application connections
When resources are exhausted, legitimate requests may be delayed, rejected, or ignored.

Network-Based DoS Conditions

Network services often rely on finite communication resources.
Attackers may generate large numbers of requests to consume:
 Available bandwidth
 Network processing capacity

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 Connection resources
As the volume of malicious traffic increases, legitimate users may be unable to communicate with the
target service.

Application-Based DoS Conditions

Applications can also experience denial of service conditions.
Attackers may intentionally trigger:
 Expensive computations
 Excessive database operations
 Large memory allocations
 Resource-intensive functions
Even a small number of specially crafted requests may significantly affect application performance.

Distributed Denial of Service (DDoS)

A Distributed Denial of Service (DDoS) attack uses multiple systems to attack a single target.
Instead of generating traffic from one source, attackers use many compromised systems to increase
the volume of requests.
Advantages of DDoS attacks include:
 Greater attack volume
 Increased effectiveness
 More difficult source identification
Because traffic originates from many systems, blocking individual sources may not stop the attack.

Amplification Effects
Some DoS attacks exploit services that generate responses larger than the original request.
In such cases:
1. The attacker sends a small request.
2. The service generates a much larger response.
3. The victim receives excessive traffic.
This amplification increases the effectiveness of the attack while reducing the attacker's bandwidth
requirements.

Consequences of DoS Conditions

Successful DoS attacks may result in:
 Service outages
 Reduced performance
 Application crashes
 System instability
 Business disruption
The severity depends on the importance of the affected service and the duration of the attack.

Identifying DoS Conditions

Indicators of a DoS attack may include:
 Unusually high network traffic
 High CPU utilization
 Excessive memory usage
 Large numbers of connection requests
 Slow system response times
 Service unavailability
Administrators often monitor these indicators to detect potential attacks.

Preventing DoS Conditions

Several approaches can reduce the impact of DoS attacks.
1. Resource Management
Systems should limit the amount of resources allocated to individual users or requests.
Examples include:
 Connection limits
 Memory limits
 CPU usage restrictions

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

These controls help prevent a single user from consuming all available resources.

2. Input Validation
Applications should validate incoming data to prevent malformed requests from triggering excessive
processing.
Proper validation reduces the likelihood that attackers can exploit software flaws to create denial of
service conditions.

3. Traffic Filtering
Network devices can filter suspicious traffic before it reaches the target system.
Filtering mechanisms may:
 Block malicious requests
 Restrict abnormal traffic patterns
 Limit excessive connection attempts

4. Redundancy and Capacity Planning

Organizations can improve availability through:
 Additional servers
 Load balancing
 Increased bandwidth
 Redundant infrastructure
These measures make it more difficult for attackers to overwhelm services.

Challenges in Defending Against DoS Attacks

Defending against DoS attacks can be difficult because:
 Legitimate and malicious traffic may appear similar.
 Large-scale attacks can exceed available resources.
 Distributed attacks originate from many systems.
 Blocking all attack traffic may also affect legitimate users.
As a result, mitigation often focuses on reducing impact rather than completely eliminating attacks.

Conclusion
Denial of Service conditions occur when attackers prevent legitimate users from accessing services
by exhausting or misusing system resources. These attacks may target networks, applications,
memory, processing power, or communication resources. Distributed attacks increase effectiveness
by using multiple systems simultaneously. Organizations can reduce risk through resource
management, input validation, traffic filtering, and adequate infrastructure planning.

Exam-Oriented Key Points

 A DoS attack aims to make a service unavailable to legitimate users.
 DoS conditions can result from:
o Resource exhaustion
o Memory consumption
o CPU consumption
o Network bandwidth consumption
o Software flaws
 Common targets include:
o CPU
o Memory
o Disk space
o Network bandwidth
o Application connections
 Network-based attacks consume communication resources.
 Application-based attacks trigger expensive operations.
 DDoS attacks use multiple systems against a single target.
 Amplification attacks generate responses larger than requests.
 Effects include:
o Service outages
o Reduced performance

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

o System crashes
 Prevention methods include:
o Resource management
o Input validation
o Traffic filtering
o Redundancy and capacity planning
 The primary goal of a DoS attack is to reduce service availability.

BRUTE FORCE AND DICTIONARY ATTACKS

Authentication systems that rely on passwords are only as secure as the strength of those
passwords. Even though system administrators enforce strong password policies, password-based
systems remain vulnerable to two common attacks: brute force attacks and dictionary attacks.
These attacks exploit weaknesses in how passwords are chosen, stored, and verified.
Password Storage and Security
In most systems, passwords are not stored as plain text. Instead, they are stored in:
 Encrypted form, or
 Hashed form
Hashing is more secure because:
 It does not allow direct reversal to the original password
 Even if the database is compromised, attackers must first recover the password

However, since hashing algorithms (e.g., NTLM, MD5) are known, attackers can still attempt to
match hashes using different techniques.
Dictionary Attacks
A dictionary attack uses a predefined list of possible passwords, known as a password dictionary or
wordlist.
These dictionaries contain:
 Common words
 Variations of words (e.g., replacing letters with numbers like “1” for “l”)
 Combined words or phrases
The attacker systematically tries each password from the list against a known username until a
match is found.
Working
 Passwords are tested one by one
 If the system is accessed online, the attack is slow due to network delays
 If the attacker has access to the password database, offline attacks become very fast and
effective
Tools can extract password hashes (e.g., Windows NTLM hashes), and attackers compare them
with dictionary-generated hashes to find matches.
Rainbow Tables
A rainbow table is a precomputed table of: Hashes and their corresponding plaintext passwords
Instead of generating hashes every time:
 The attacker directly looks up the hash in the table
 This significantly speeds up password recovery
Key points:
 Rainbow tables are specific to hashing algorithms

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

 They require large storage space

 Their creation is time-consuming, but lookup is very fast
This represents a time–space trade-off:
 More storage → faster cracking
Brute Force Attacks
A brute force attack tries all possible combinations of characters until the correct password is found.
Working
 The attacker defines a character set (key space), such as:
o Letters
o Numbers
o Symbols
 Passwords are generated systematically
 Each combination is tested against the system
The process continues until the correct password is discovered.
Time Complexity of Brute Force
Brute force attacks are time-consuming, especially for strong passwords.
The total number of attempts depends on:
 Size of the character set
 Length of the password
Mathematically:
Total combinations =

More characters and longer passwords increase security exponentially.

Comparison Insight
 Dictionary Attack
Uses common passwords → faster but limited
 Brute Force Attack
Tries all combinations → slow but guaranteed (given enough time)

Module 2
Dr. Surekha Borra Elements of Cyber Security and IoT KSIT

Module 2