Module 2

Tools and Methods used in Cybercrime

(Whole Module Notes)
Various tools used for the attack:

→Proxy servers and Anonymizers:

● A proxy server is a dedicated computer or a software system running on a computer that

acts as an intermediary between an endpoint device, such as a computer, and another
server from which a user or client is requesting a service.
● A client connects to the proxy server, requesting some service, such as a file, connection,
web page, or other resource available from a different server and the proxy server
evaluates the request as a way to simplify and control its complexity.
● Purpose of a proxy server
○ Improve Performance:
○ Filter Requests
○ Keep system behind the curtain
○ Used as IP address multiplexer
○ Its Cache memory can serve all users
○ Attack on this: the attacker first connects to a proxy server- establishes connection

● An Anonymizer or an anonymous proxy is a tool that attempts to make activity on the

Internet untraceable.
● It is a proxy server computer that acts as an intermediary and privacy shield between a
client computer and the rest of the Internet.
● It accesses the Internet on the user's behalf, protecting personal information by hiding the
client computer's identifying information.
● For example, large news outlets such as CNN target the viewers according to region and
give different information to different populations
======================================

→Phishing:
● It is the method of stealing personal and financial data.
● It can also can infect systems with viruses
● It is one method of online ID theft.
● How Phishing works?
○ Planning : use mass mailing and address collection techniques- spammers
○ Setup : / webpage to collect data about the target
○ Attack : send a phony message to the target
○ Collection: record the information obtained
○ Identity theft and fraud: use information to commit fraud or illegal purchases
============================================================
→Password Cracking:
● Password cracking is the process of recovering passwords from data that have been
stored in or transmitted by a computer system.
● A common approach (brute-force attack) is to try guesses repeatedly for the password
and check them against an available cryptographic hash of the password.
The purpose of password cracking
● help a user recover a forgotten password
● to gain unauthorized access to a system,
● or as a preventive measure by System Administrators to check for easily crackable
passwords
Manual Password Cracking Algorithm
● Find a valid user
● Create a list of possible passwords •
● Rank the passwords from high probability to low
● Key in each password
● If the system allows you in - Success
● Else try till success
Examples of guessable passwords
● Blank
● Words like “passcode” ,”password”, “admin”
● Series of letters “QWERTY”
● User’ s name or login name
● Name of the user’s friend/relative/pet
● User’s birth place, DOB
● Vehicle number, office number ..
● Name of celebrity
● Simple modification of one of the precedings, suffixing 1 …
Categories of password cracking attacks:
● Online attacks:
○ An attacker may create a script- automated program- to try each password
○ Most popular online attack;- man-in-the- middle attack or bucket-brigade attack
○ Used to obtain passwords for accounts on public websites like gmail, yahoomail
○ Also to get passwords for financial websites
● Offline attacks:
○ Are performed from a location other than the target where these passwords reside
or are used.
○ Require physical access to the computer and copying the password
○ Types of offline attacks are
■ Dictionary attack
■ Hybrid attack
 ■ Brute force attack
● Non-electronic attacks:
○ Social engineering
○ Shoulder surfing
○ Dumpster diving

Strong and weak passwords:

Weak passwords:
● The password contains less than eight characters
● The password is a word found in a dictionary (English or foreign)
● The password is a common usage word such as: Names of family, pets, friends, co-
workers, fantasy characters, Computer terms and names, commands, sites, companies,
hardware, software.
● Birthdays and other personal information such as addresses and phone numbers.
● Word or number patterns like aaabbb, qwerty, zyxwvuts, , etc.
● Any of the above spelled backwards.
● Any of the above preceded or followed by a digit (e.g., secret1,1secret..)
Strong Passwords:
● Contain both upper and lower case characters (e.g., a-z, A-Z)
● Have digits and punctuation characters as well as letters e.g.,
● Are at least eight alphanumeric characters long.
● Are not a word in any language, slang, dialect, jargon, etc.
● Are not based on personal information, names of family, etc.
● Passwords should never be written down or stored on-line.
● Try to create passwords that can be easily remembered.
● One way to do this is create a password based on a song title, affirmation, or other phrase.
● For example, the phrase might be: "This May Be One Way To Remember"
● and the password could be: "TmB1w2R!" or "Tmb1W>r~" or some other variation.
Random passwords:
Generate On The Client Side:
( do NOT send across the Internet )
Auto-Select:
( select the password automatically )
Save My Preference:
( save all the settings above for later use )

To prevent your passwords from being hacked by social engineering, brute force or
dictionary attack method, you should notice that:
1. Do not use the same password for multiple important accounts.
2. Use a password that has at least 16 characters, use at least one number, one uppercase letter,
one lowercase letter and one special symbol.
3. Do not use the names of your families, friends or pets in your passwords.
4. Do not use postcodes, house numbers, phone numbers, birthdates, ID card numbers, social
security numbers, and so on in your passwords.
5. Do not use any dictionary word in your passwords.
6. Do not use something that can be cloned( but you can't change ) as your passwords, such as
your fingerprints.
7. Do not let your Web browsers( FireFox, Chrome, Safari, Opera, IE ) store your passwords,
since all passwords saved in Web browsers can be revealed easily.
8. Do not log in to important accounts on the computers of others, or when connected to a public
Wi-Fi hotspot, Tor, free VPN or web proxy.
9. Do not send sensitive information online via HTTP or FTP connections, because messages in
these connections can be sniffed with very little effort. You should use encrypted connections
such as HTTPS and SFTP whenever possible.
10. When traveling, you can encrypt your Internet connections before they leave your laptop,
tablet, mobile phone or router.
11. How secure is my password? Perhaps you believe that your passwords are very strong,
difficult to hack. But if a hacker has stolen your username and the MD5 hash value of your
password from a company's server, and the rainbow table of the hacker contains this MD5 hash,
then your password will be cracked quickly.
12. It's recommended to change your passwords every 10 weeks.
13. It's recommended that you remember a few master passwords, store other passwords in a
plain text file and encrypt this file with 7-Zip, GPG or a disk encryption software such as
BitLocker, or manage your passwords with a password management software.
14. Encrypt and backup your passwords to different locations, then if you lost access to your
computer or account, you can retrieve your passwords back quickly.
15. Turn on 2-step authentication whenever possible.
16. Do not store your critical passwords in the cloud.
17. Access important websites( e.g. Paypal ) from bookmarks directly, otherwise please check its
domain name carefully, it's a good idea to check the popularity of a website with Alexa toolbar to
ensure that it's not a phishing site before entering your password.
18. Protect your computer with firewall and antivirus software, download software from
reputable sites only, and verify the MD5 or SHA1 checksum of the installation package
whenever possible.
19. Be careful when using online paste tools and screen capture tools, do not let them to upload
your passwords to the cloud.
20. If there are important files on your computer, and it can be accessed by others, check if there
are hardware keyloggers( e.g. wireless keyboard sniffer ), software keyloggers and hidden
cameras when you feel it's necessary.
21. If you're a webmaster, do not store the users passwords in the database, you should store the
salted hash values of passwords instead.
===================================================
→keyloggers:
● Keystroke logging, often referred to as keylogging or keyboard capturing, is the action of
recording (or logging) the keys struck on a keyboard, typically in a covert manner so that
the person using the keyboard is unaware that their actions are being monitored.
● It has uses in the study of human–computer interaction.
● There are numerous keylogging methods, ranging from hardware and software-based
approaches to acoustic analysis.

Software-based keyloggers:
Software-based keyloggers use the target computer’s operating system in various ways,
including: imitating a virtual machine, acting as the keyboard driver (kernel-based), using the
application programming interface to watch keyboard strokes (API-based), recording
information submitted on web- based forms (Form Grabber based) or capturing network traffic
associated with HTTP POST events to steal passwords (Packet analyzers).
Usually consists of two files DLL and EXE

Hardware keyloggers:
installing a hardware circuit between the keyboard and the computer that logs keyboard stroke
activity (keyboard hardware).
Target- ATMs

Acoustic keylogging:
Acoustic keylogging monitors the sound created by each individual keystroke and uses the subtly
different acoustic signature that each key emits to analyze and determine what the target
computer’s user is typing.

AntiKeylogger:
An anti-keylogger (or anti–keystroke logger) is a type of software specifically designed for the detection of
keystroke logger software; often, such software will also incorporate the ability to delete or at least immobilize
hidden keystroke logger software on your computer.

Benefits of Antikeyloggers
Spywares:
Spyware is software that aims to gather information about a person or organization without their
knowledge and that may send such information to another entity without the consumer's consent,
or that asserts control over a computer without the consumer's knowledge

==============================================================

→Virus and Worms:

A computer virus is a malware program that, when executed, replicates by inserting
copies of itself (possibly modified) into other computer programs, data files, or the boot sector of
the hard drive; when this replication succeeds, the affected areas are then said to be "infected".

★ Some typical virus actions include:

● Display a message to prompt an action
● Delete files in the system
● Scramble data on a hard disk
● Cause erratic screen behavior
● Halt the system
● Replicate themselves to propagate further harm
★ Virus spread through
1. The internet:
2. A stand alone PC :

3. Local networks:
Difference between virus and worm:

Types of viruses:
1. Boot sector viruses:
● A boot sector virus is a computer virus that infects a storage device's master boot
record (MBR).
● It is not mandatory that a boot sector virus successfully boot the victim's PC to
infect it.
● As a result, even non-bootable media can trigger the spread of boot sector viruses.
● These viruses copy their infected code either to the floppy disk's boot sector or to
the hard disk's partition table. During start-up, the virus gets loaded to the
computer's memory. As soon as the virus is saved to the memory, it infects the
non-infected disks used by the system.
● The propagation of boot sector viruses has become very rare since the decline of
floppy disks. Also, present-day operating systems include boot-sector safeguards
that make it difficult for boot sector viruses to infect them.
[Link] viruses:
● A program virus becomes active when the program file (usually with
extensions .BIN, .COM, .EXE, .OVL, .DRV) carrying the virus is opened.
 ● Once active, the virus will make copies of itself and will infect other programs on the
computer.

3. Multipartite viruses:
● A multipartite virus is a fast-moving virus that uses file infectors or boot infectors
to attack the boot sector and executable files simultaneously.
● Most viruses either affect the boot sector, the system or the program files.
● The multipartite virus can affect both the boot sector and the program files at the
same time, thus causing more damage than any other kind of virus.
● When the boot sector is infected, simply turning on the computer will trigger a
boot sector virus because it latches on to the hard drive that contains the data that
is needed to start the computer. Once the virus has been triggered, destructive
payloads are launched throughout the program files.
● A multipartite virus infects computer systems multiple times and at different
times. In order for it to be eradicated, the entire virus must be removed from the
system.
● A multipartite virus is also known as a hybrid virus.

4. Stealth viruses:
● Stealth viruses
● A stealth virus is a hidden computer virus that attacks operating system processes and
averts typical anti-virus or anti- malware scans. Stealth viruses hide in files, partitions
and boot sectors and are adept at deliberately avoiding detection. Stealth virus eradication
requires advanced anti-virus software or a clean system reboot.

[Link] viruses:
Polymorphic viruses
A polymorphic virus is a complicated computer virus that affects data types and
functions.
It is a self-encrypted virus designed to avoid detection by a scanner.
Upon infection, the polymorphic virus duplicates itself by creating usable, albeit slightly
modified, copies of itself.
Polymorphism, in computing terms, means that a single definition can be used with
varying amounts of data. In order for scanners to detect this type of virus, brute-force
programs must be written to combat and detect the polymorphic virus with novel variant
configurations.
6. Macroviruses:
● A macro virus is a computer virus that "infects" a Microsoft Word or similar application
and causes a sequence of actions to be performed automatically when the application is
started or something else triggers it.

7. Active X and Java control:

● ActiveX and Java were created for web page designers to incorporate a wide array of
impressive effects on web pages, giving movement and added dimension to the
previously "flat" web pages.
● To operate properly, these ActiveX controls and Java applets need to gain access to your
hard disk. Insufficient memory and bandwidth problems necessitate this approach.
Although this desktop access provides a wealth of beneficial applications of these
controls and applets, malicious code developers have the same access. They are now
using it to read and delete or corrupt files, access RAM, and even access files on
computers attached via a LAN.

=====================================================================

Trojan Horse:

● Trojan Horse is a program in which malicious or harmful code is contained inside

apparently harmless programming or data in such a way that it can get control and cause
harm.
● Trojan horse may get widely released tributed as a part of computer [Link] horse
can also be transferred through an USB flash drive or other portable media.
● Trojans can get into the system in a number of ways, including from a web browser, via
E-Mail or in a bundle with other software downloaded from the Internet.
● Unlike viruses or worms, Trojans do not replicate themselves but they can be equally
destructive.
● On the surface, Trojans appear harmless, but once the infected code is executed, Trojans
kick in and perform malicious functions to harm the computer system without the user’s
knowledge.
● Some of the typical examples of threats by Trojans are.
○ They erase, overwrite or corrupt the data on a computer.
○ They helped to spread other malware such as viruses.
○ They allow remote access to your computer.
○ they gather e-mail addresses and use them for spam.
○ They reinstalled themselves after being disabled.
○ They disable task manager or control panel.
Backdoor:

● A backdoor is a means of access to a computer program that bypasse security

mechanisms.
● A programmer may sometimes install a backdoor so that the program accessed for
troubleshooting or other purposes.
● The back door works in the background and hides from the user.
● Backdoor is one of the most dangerous practices as it allows the malicious person to
perform any possible action on the compromised system.
● An attackers often use backdoors that they detect or install themselves of an exploit.
● In some cases, a worm is designed to take advantage of a backdoor can attack earlier.
● The following are some of the functions of back door.
○ It allows an attacker to create, delete, rename, copy or edit any file execute
various commands
○ Allows an attacker to control computer hardware devices, modify related settings,
shutdown or restart your computer.
○ Sensitive personal information, valuable documents, passwords, login names, etc.
○ It records keystrokes that a user types on a net key computer keyboard and
captures screenshots.
○ Corrupts installed applications and damages the entire system.

How to Protect from Trojan Horses and Backdoors

Follow the following steps to protect your systems from frozen horses and back doors.

Stay away from suspect websites or web links- avoid downloading free or pirated softwares
that often get infected by Trojans, worms, viruses and other things.
Search on the web cautiously- avoid connecting with and or are downloading any information
from peer-to-peer network, which are most dangerous networks to spread Trojan horses and
other threats.
Install antivirus or frozen remover software.- free poison removal programs are also available
on the web, and some of them are really good.
======================
Steganography

● The word “steganography” comes from the two Greek words: steganos meaning
“covered” and graphein meaning “to write” that means “concealed writing.”
● It is art and science of hiding information so that it does not even appear to exist.
● Steganography is always different from cryptography.
 ● Other names for steganography are data hiding, information hiding, and digital
watermarking.
● Digital watermarking is the process of possibility in irreversibly emitting information into
a digital signal. If the signal is copied and the information is also carried into the copy.
● Steganography can be used to make digital watermark to detect illegal copying of digital
images.
● In the process of Steganography, the term cover or cover medium is used to describe the
original innocent message.
● It is a medium that hides a secret message.
● It must have parts that can be altered or without damaging or noticeably changing the
cover media. If the cover media are digital, these alterable parts are called ‘redundant
bits.’
● The steganography works as shown in the figure below.

Steganalysis:
● Steganalysis is art and science of detecting messages that are hidden images, audio, or
video files using steganography.
● The goal of Steganalysis is to identify suspected packages or to determine whether or not
they have a payload encoded into them, and if possible, recover it.
● Automatic tools are used to detect such technographic data or information hidden in the
image and audio or video files.

DoS and DDoS Attacks

 A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DI
attack) is an attempt to make a computer resource unavailable to its intended users.

DoS Attacks

● The attacker floods the bandwidth of the victim's network or fills his E-Mail box Spam
mail depriving him of the services he is entitled to access or provide.
● These attackers target the sites or services hosted on high profile web servers like bank,
credit card payment gateways, mobile phone networks and even root name servers.
● The goal of DoS is not to gain unauthorized access to systems or data, but to prevent
intended users (i.e., legitimate users) of a service from using it. A DoS attack may do the
following:

1, Flood a network with traffic, thereby preventing legitimate network traffic.

2. Disrupt connections between two systems, thereby preventing access to a ser
3. Prevent a particular individual from accessing a service.
4. Disrupt service to a specific system or person.

Classification of DoS attacks:

1. Bandwidth attacks : Loading any website takes certain time. Loading means complete
webpage appearing on the screen and system is awaiting user's input. This loading
consumes some amount of memory. Every site is given with a particular amount of
bandwidth for its hosting., say for example, 50 GB. Now if more visitors consume all
50 GB bandwidth then the hosting of the site can ban this site. The attacker does the
same — he/she opens 100 pages of a sire and keeps on refreshing and consuming all
the bandwidth, thus, the site becomes out of service.
2. Logic attacks: These kind of attacks can exploit vulnerabilities in network software such
as web servers or TCP/IP stack.
3. Protocol attacks: Protocols here are rules that are to be followed to send data over the
network. These kind of attacks exploit a specific feature or implementation bug of some
protocol installed at the victim's system to consume excess amounts of its resources.
4. Unintentional DoS: This is a scenario where a website ends up denied not due to a
deliberate attack by a single individual or group of individuals, but simply due to a
sudden enormous spike in popularity. This can happen when an extremely popular
website posts a prominent link to a second, less well-prepared site, for example, as part of
a news story. The result is that a significant proportion of the primary sites regular users,
potentially hundreds of thousands of people, dick that link within a few hours and have
the same effect on the target website as a DDoS attack.
 Types or Levels of DoS attacks:

There are several types or levels of DoS attacks as follows:

I. Flood attack: This is the earliest form of DoS attack and is also known as ping flood. It is
based on an attacker simply sending the victim overwhelming number of ping packets. usually
by using the "ping" command, which result into more traffic than the victim can handle. This
requires the attacker to have a Faster network connection than the victim (i.e., access to greater
bandwidth than the victim). It is very simple to launch, but to prevent it completely is the most
difficult.

[Link] of death attack: The ping of death attack sends oversized Internet Control Message
Protocol (ICMP) packets. It is mainly used by networked computers OSs to send error messages
indicating datagrams (encapsulated in IP packets) to the victim. The maximum packet size
allowed is of 65,536 octets. Some systems, upon receiving the oversized packet, will crash,
freeze or reboot, resulting in DoS.

[Link] attack: It is also termed as TCP SYN Flooding. In the Transmission Control Protocol (TCP),
handshaking of network connections is done with SYN and ACK messages. An attacker initiates
a TCP connection to the server with an SYN. The server replies with an SYN-ACK. The client
then does not send back an ACK, causing the server (i.e., target system) to allocate memory for
the pending connection and wait. This fills up the buffer space for SYN messages on the target
system, preventing other systems on the network from communicating with the target system.
The figure below explains how the DoS attack takes place.
4. Teardrop attack: the teardrop attack is an attack where fragmented packets are
forged to overlap each other when the receiving host tries to reassemble them. IP's
packet fragmentation algorithm is used to send corrupted packets to confuse the
victim and may hang the system. This attack can crash various OSs due to a bug in
their TCP/IP fragmentation reassembly code.

5. Smurf attack: It is a way of generating significant computer network traffic on a

victim network. This is a type of DoS attack that floods a target system via spoofed
broadcast ping messages. This attack consists of a host sending an ICMP echo
request (ping) to a network broadcast address (e.g., network addresses with the host
portion of the address having all Is). Every host on the network receives the ICMP
echo request and sends back an ICMP echo response inundating the initiator with
network traffic. On a multi-access broadcast network, hundreds of machines might
reply to each packet. This creates a magnified DoS attack of ping replies, flooding
the primary victim.
 6. Nuke: Nuke is an old DoS attack against computer networks consisting of
fragmented or otherwise invalid ICMP packets sent to the target. It is achieved by
using a modified ping utility to repeatedly send this corrupt data, thus slowing down
the affected computer until it comes to a complete stop.
DDoS Attacks

● In a DDoS attack, an attacker may use your computer to attack another computer.
● By taking advantage of security vulnerabilities or weaknesses, an attacker could take
control of your computer.
● He/she could then force your computer to send huge amounts of data to a website or
send Spam to particular E-Mail addresses.
● A DDoS attack is a distributed DoS wherein a large number of zombie systems are
synchronized to attack a particular system. The zombie systems are called “secondary
victims” and the main target is called “primary victim.”
● A system may also be compromised with a Trojan, allowing the attacker to download a
zombie agent.
● Nowadays, Botnet is the more popular medium to launch DoS/DDoS [Link]
can break into systems using automated tools.

How to protect from DoS/DDoS Attacks :

1. Implement router filters.
2. If such filters are available for your system, install patches to guard against TCP SYN
Flooding.
3. Disable any unused or inessential network service.
4. Observe your system’s performance and establish baselines for ordinary activity
5. Routinely examine your physical security with regard to your current needs.
6. Use Tripwire or a similar tool to detect changes in configuration information or other
files.
7. Invest in and maintain “hot spares” — machines that can be placed into service quickly if
a similar machine is disabled,
8. Invest in redundant and fault-tolerant network configurations.
9. Establish and maintain regular backup schedules and policies, particularly for important
configuration information.
10. Establish and maintain appropriate password policies, especially access to highly
privileged accounts such as Unix root or Microsoft Windows NT Administrator.
=================================

SQL Injection:
 ● SQL injection is a code injection technique that exploits a security vulnerability occurring
in the database layer of an application.
● The vulnerability is present when user input is either filtered incorrectly for string
literal escape characters embedded in SQL statements or user input is not strongly
typed and thereby unexpectedly executed.
● Attackers target the SQL servers common database servers used by many
organizations to store confidential data.
● The prime objective behind SQL injection attack is to obtain the information while
accessing a database table that may contain personal information such as credit card
numbers, passwords etc.
● During an SQL injection attack. Malicious Code is inserted into a web form field
or the website's code to make a system execute a command shell or other arbitrary
commands.
● Just as a legitimate user enters queries and additions to the SQL database via a
● web form, the attacker can insert commands to the SQL server through the same
web form field.
● The attacker determines whether a database and the tables residing into it are
vulnerable, before launching the attack.
● With SQL injection, it is possible for an attacker to send crafted
username/password field that will change the SQL query.

Blind SQL injection

● Blind SQL injection is used when a web application is vulnerable to an SQL
injection but the results of the injection are not visible to the attacker
● The page with the vulnerability may not be the one that displays data however. it
will display differently depending on the results of a logical statement injected into
the legitimate SQL statement called for that page.

In summary, using SQL injections, attackers can:

1. Obtain some basic information if the purpose of the attack is reconnaissance

2. May gain access to the database by obtaining username and their password

To get a user listing: SELECT * FROM users WHERE name = “OR ‘1’ = ‘1’

3. Add new data to the database

Execute the INSERT command: This may enable selling politically incorrect items on an
ecommerce website.

4. Modify data currently in the database

Execute the UPDATE command: May be used to have an expensive item suddenly be deeply
‘discounted.”,

How to Prevent SQL Injection Attacks:

SQL injection attacks occur due to poor website administration and coding. ‘The following
steps can be taken to prevent SQL injection

1. Input validation

2. Modify error reports: SQL errors should not be displayed to outside users and to avoid
this, the developer should handle or configure the error reports very carefully. These errors
some time display full query pointing to the syntax error involved and the attacker can use it
for further attacks.

3. Other preventions

● The default system accounts for SQL server 2000 should never be used
● Isolate database server and web server. Both should reside on different machines.

===============================================

Buffer Overflow:
● Buffer overflow occurs when a program or process tries to store more data in a buff

(temporary data storage area) than it was intended to hold.

● As buffers are created to contain a finite amount of data. the extra information can

overflow into adjacent buffers. corrupting or overwriting the valid data held in them.

● Although it may occur accidentally through programming error. buffer overflow is an

increasingly common type of security attack on data integrity.

Types of Buffer Overflow

1. Stack buffer overflow:

Stack buffer overflow occurs when a program writes to a memory address on the
program's call stack outside the intended data structure — usually a fixed length buffer.

The attacker may exploit stack-based buffer overflows to manipulate the program in various
ways by overwriting:
 1. A Local variable that is near the buffer in memory on the stack to change the
behavior of the program that may benefit the attacker.

2. The return address in a stack frame. Once the function returns, execution will
resume at the return address as specified by the attacker, usually a user input-filled buffer.

3. A function pointer, or exception handler, which is subsequently executed.

[Link] Buffer Overflow:

● Heap buffer overflow occurs in the heap data area when an application copies more data
into a buffer than the buffer was designed to contain
● Exploitation is performed by corrupting this data in specific ways to cause the application
to overwrite internal structures such as linked list pointers.

How to minimize Buffer Overflow:

The following methods will definitely help to minimize such attacks:
1. Assessment of secure code manually : Buffer overflow occurs when a program or
process tries to store more data in a buffer than it was intended to hold. Developers
should be educated about minimizing the use of vulnerable functions available in C
library,
2. Disable stack execution : Malicious Code causes input argument to the program, and
it resides in the stack and not in the code segment. Any code that attempts to execute any
other code residing in the stack will cause a segmentation violation. Therefore, the
simplest solution is to invalidate the stack to execute any instructions.
3. Compiler tools : Over the years, compilers have become more and more aggressive in
optimizations and the checks they perform. Various compiler tools already offer warnings
on the use of unsafe constructs such as gets(), strcpy, etc. Developers should be educated
to restructure the programming code if such warnings are displayed
4. Dynamic run-time checks :In this scheme, an application has restricted access to
prevent attacks. This method primarily relies on the safety code being preloaded before
an application is executed. This preloaded component can either provide safer versions of
the standard unsafe functions or it can ensure that return addresses are not overwritten.
One example of such a tool is libsafe.
[Link] tools are used to detect /defend buffer overflow: Tools like StackGuard,
ProPolice, Libsafe can be used.