ESET SMART SECURITY Betriebsanweisung PDF herunterladen (Seite 45)

6.2.6 SMB Relay

SMBRelay and SMBRelay2 are special programs that are capable of

carrying out attacks against remote computers. The programs take

advantage of the Server Message Block ﬁle sharing protocol, which is

layered onto NetBIOS. A user sharing any folder or directory within the

LAN most likely uses this ﬁle sharing protocol.

Within local network communication, password hashes are

exchanged.

SMBRelay receives a connection on UDP port 139 and 445, relays the

packets exchanged by the client and server, and modiﬁes them. After

connecting and authenticating, the client is disconnected. SMBRelay

creates a new virtual IP address. The new address can be accessed

using the command “net use \\192.168.1.1“. The address can then be used

by any of the Windows networking functions. SMBRelay relays SMB

protocol communication except for negotiation and authentication.

Remote attackers can use the IP address, as long as the client

computer is connected.

SMBRelay2 works on the same principle as SMBRelay, except it

uses NetBIOS names rather than IP addresses. Both can carry out

“man‑in‑the‑middle” attacks. These attacks allow remote attackers

to read, insert and modify messages exchanged between two

communication endpoints without being noticed. Computers exposed

to such attacks often stop responding or unexpectedly restart.

To avoid attacks, we recommend that you use authentication

passwords or keys.

6.2.7 ICMP attacks

The ICMP (Internet Control Message Protocol) is a popular and

widely‑used Internet protocol. It is used primarily by networked

computers to send various error messages.

Remote attackers attempt to exploit the weaknesses of the ICMP

protocol. The ICMP protocol is designed for one‑way communication

requiring no authentication. This enables remote attackers to trigger

so‑called DoS (Denial of Service) attacks, or attacks which give

unauthorized individuals access to incoming and outgoing packets.

Typical examples of an ICMP attack are ping ﬂood, ICMP_ECHO

ﬂood and smurf attacks. Computers exposed to the ICMP attack are

signiﬁcantly slower (this applies to all applications using the Internet)

and have problems connecting to the Internet.

6.3 Email

Email, or electronic mail, is a modern form of communication with

many advantages. It is ﬂexible, fast and direct, and played a crucial

role in the proliferation of the Internet in the early 1990‘s.

Unfortunately, with a high level of anonymity, email and the Internet

leave room for illegal activities such as spamming. Spam includes

unsolicited advertisements, hoaxes and proliferation of malicious

software – malware. The inconvenience and danger to you is

increased by the fact that the cost of sending spam is minimal, and

authors of spam have many tools to acquire new email addresses.

In addition, the volume and variety of spam makes it very dicult to

regulate. The longer you use your email address, the more likely it will

end up in a spam engine database. Some hints for prevention:

• If possible, don’t publish your email address on the Internet

• Only give your email address to trusted individuals

• If possible, don’t use common aliases – with more complicated

aliases, the probability of tracking is lower

• Don’t reply to spam that has already arrived in your inbox

• Be careful when ﬁlling out Internet forms – be especially cautious

of options such as “Yes, I want to receive information”.

• Use “specialized” email addresses – e.g., one for business, one for

communication with your friends, etc.

• From time to time, change your email address

• Use an Antispam solution

6.3.1 Advertisements

Internet advertising is one of the most rapidly growing forms of

advertising. Its main marketing advantages are minimal costs and a

high level of directness; what’s more, messages are delivered almost

immediately. Many companies use email marketing tools to eectively

communicate with their current and prospective customers.

This type of advertising is legitimate, since you may be interested in

receiving commercial information about some products. But many

companies send unsolicited bulk commercial messages. In such cases,

email advertising crosses the line and becomes spam.

The amount of unsolicited email has become a problem and it shows

no signs of slowing. Authors of unsolicited email often attempt to

disguise spam as legitimate messages.

6.3.2 Hoaxes

A hoax is misinformation which is spread across the Internet. Hoaxes

are usually sent via email or communication tools like ICQ and Skype.

The message itself is often a joke or Urban Legend.

Computer Virus hoaxes try to generate fear, uncertainty and doubt

(FUD) in the recipients, bringing them to believe that there is an

“undetectable virus“ deleting ﬁles and retrieving passwords, or

performing some other harmful activity on their system.

Some hoaxes work by asking recipients to forward messages to their

contacts, perpetuating the hoax. There are mobile phone hoaxes,

pleas for help, people oering to send you money from abroad, etc. It

is often impossible to determine the intent of the creator.

If you see a message prompting you to forward it to everyone you

know, it may very well be a hoax. There are many websites on the

Internet that can verify if an email is legitimate. Before forwarding,

perform an Internet search on any message you suspect is a hoax.

6.3.3 Phishing

The term phishing deﬁnes a criminal activity which uses techniques of

social engineering (manipulating users in order to obtain conﬁdential

information). Its aim is to gain access to sensitive data such as bank

account numbers, PIN codes, etc.

Access is usually achieved by sending email masquerading as a

trustworthy person or business (e.g., ﬁnancial institution, insurance

company). The email can look very genuine, and will contain graphics

and content which may have originally come from the source it is

impersonating. You will be asked to enter, under various pretenses

(data veriﬁcation, ﬁnancial operations), some of your personal data –

bank account numbers or usernames and passwords. All such data, if

submitted, can easily be stolen and misused.

Banks, insurance companies, and other legitimate companies will

never request usernames and passwords in an unsolicited email.

6.3.4 Recognizing spam scams

Generally, there are a few indicators which can help you identify spam

(unsolicited emails) in your mailbox. If a message fulﬁlls at least some

of the following criteria, it is most likely a spam message.

• Sender address does not belong to someone on your contact list

• You are oered a large sum of money, but you have to provide a

1 2 ... 40 41 42 43 44 45 46

Kommentare zu diesen Handbüchern

Keine Kommentare

ESET SMART SECURITY Betriebsanweisung Seite 45

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Antivirus-Sicherheitssoftware ESET SMART SECURITY