In this section we're going to take a look at some of the common and point based attacks buffer overflows
are a potential danger to software programs and is probably the best known software vulnerability.
A buffer overflow is when a computing device as buffer has more data than it can handle or when the
program puts data in memory past the buffer.
If this occurs the program could crash corrupt data or cause the execution of malicious code.
Back in 1988 the Morris worm used this vulnerability to take down most of the Internet.
Wait so the Internet existed back in 1988.
Command and Control is an attack on CNC servers remotely sun malicious commands to a botnet or a compromised
computer CNC is an easy way for an attacker to actually queue a DVOA attack.
Imagine the power someone would have if they were controlling thousands of points across the globe.
They could send commands to all the compromised computers instructing them to send large amounts of
data to targeted hosts CNC connections can be blocked by Cisco fire power devices with the security
intelligence feature here you can see in my lab network.
I have tons of potential CNC connections being blocked from IPs that have been added to the Cisco security
intelligence blacklist in the CNC category.
Now let's learn about the infamous malware aka malicious software.
One of the main goals of an organization is to prevent malware from being downloaded to network devices
once malware has launched numerous attacks can be executed on the installed equipment.
One of the most popular forms of malware today is called ransomware.
Ransomware can be used by attackers to encrypt data on computers and threaten to erase it unless they
are paid to decrypt it.
Let's hop into my lab sandbox and I will show you what happened when the infamous wanna cry Ransomware
is executed on and on point OK so here we are in my sandbox I'm going to launch the WANNA CRY ransomware
software.
Here I have a picture and a test zipped folder currently in my documents and more see what happens when
this Ransomware is launched.
My computer's being kind enough to warn me not to launch this but I'm going to run it anyways.
Since this is a sandbox environment.
This is actually VM so I'm just going to revert to a snapshot once I'm done playing around with this
ransomware here.
OK so now the ransomware has been executed and as you can see it's encrypted.
My picture file as well as my test files zipped folder
so I'm going to try to view this picture that I have in my documents and we'll see what happens.
So as you can see I cannot open this picture up.
Let's try to open the Zip's folder now that I've tried to launch those files you see that they've disappeared
out of my documents folder.
If I read this please read the message.
The attackers were kind enough to leave instructions on how to decrypt my files.
So they're asking for Bitcoin.
And if I launch the other file we give this nice pop up for instructions on how to pay in bitcoin to
decrypt my files.
And then they're even kind enough to have another message in the background saying Oops your important
files are encrypted.
So now you've been able to see for yourself what ransomware can do and how big of a concern it can be
for businesses out there.
If a company's computers happen to be infected with this then they could potentially lose a lot of sensitive
data.
And this is another great example of why you should always have an anti-malware solution on endpoints.
A rootkit is a collection of malicious software designed to enable root access to the computer while
hiding its presence or identity from anti-virus software.
There is soft.
There is software available that can be ran to detect the presence of root kits on an endpoint.
For Windows you can use the system turtle's tool.
Rootkit Revealer and in Linux you can install r.k haunter.