Global ETD Search

1	Deriving System Vulnerabilities Using Log Analytics Higbee, Matthew Somers 01 November 2015 (has links) System Administrators use many of the same tactics that are implemented by hackers to validate the security of their systems, such as port scanning and vulnerability scanning. Port scanning is slow, and can be highly inaccurate. After a scan is complete, the results of the scan must be cross checked with a vulnerability database to discover if any vulnerabilities are present. While these techniques are useful, they have severe limitations. System Administrators have full access to all of their machines. They should not have to rely exclusively on port scanning them from the outside of their machines to check for vulnerabilities when they have this level of access. This thesis introduces a novel concept for replacing port scanning with a Log File Inventory Management System. This system will be able to automatically build an accurate system inventory using existing log files. This system inventory will then be automatically cross checked with a database of known vulnerabilities in real-time resulting in faster and more accurate vulnerability reporting than is found in traditional port scanning methods. log file agent syslog elasticsearch logstash kibana software inventory inventory management vulnerability port scan Systems Engineering
2	Evaluation of the CSF Firewall / Utvärdering av CSF brandväggen Mudhar, Ahmad January 2013 (has links) The subject of web server security is vast, and it is becoming bigger as time passes by. Every year, researches, both private and public, are adding to the number of possible threats to the security of web servers, and coming up with possible solutions to them. A number of these solutions are considered to be expensive, complex, and incredibly time-consuming, while not able to create the perfect web to challenge any breach to the server security. In the study that follows, an attempt will be made to check whether a particular firewall can ensure a strong security measure and deal with some security breaches or severe threat to an existing web server. The research conducted has been done with the CSF Firewall, which provides a suit of scripts that ensure a portal’s security through a number of channels. The experiments conducted under the research provided extremely valuable insights about the application in hand, and the number of ways the CSF Firewall can help in safety of a portal against Secured Shell (SSH) attacks, dedicated to break the security of it, in its initial stages. It further goes to show how simple it is to actually detect the prospective attacks, and subsequently stop the Denial of Service (DoS) attacks, as well as the port scans made to the server, with the intent of breaching the security, by finding out an open port. By blocking the IP Addresses of the attackers dedicated to such an act, preventing them from creating nuisance, the CSF Firewall has been able to keep alien intrusions away from the server. It also aids in creating a secure zone for the server, to continue smoothly, while alerting the server administrators of the same, and gives them an opportunity to check those threatening IPs, and the time of attack, makes sure that the server administrators stay alert in the future, and is able to keep an eye on such attacks. In doing this, the experiment adds valuable data in the effective nature of the CSF Firewall. CSF Firewall Iptables Firewall Web server Security SPI Configserver Security & Firewall SYN-flood DoS attack Port Scan Exploit checks Firewall notifications SSH attacks Computer Sciences Datavetenskap (datalogi)
3	Detektering av långsam portskanning i realtidssystem Pettersson, Mattias January 2017 (has links) I denna rapport beskriver jag min undersökning av en metod för detektering av långsam portskanning i ett system som utför realtidsanalys. Portskanning används som en rekognoceringsmetod bland illasinnade aktörer i IT-världen. Det används för att bilda en uppfattning om eventuella svagheter som kan finnas i ett nätverk. Långsam portskanning används för att lura ev. Detekteringssystem och därmed kunna skanna utan att upptäckas. Detektering av långsam portskanning kan vara resurskrävande för arbetsminnet då en stor buffer traditionellt upprättas för att analysera nätverkstrafik över en längre tidsperiod. Det finns även lösningar som analyserar nätverksflöden, vilket istället innebär en förlust av information och att port skanning ej kan upptäckas i realtid. Jag har skapat ett detekteringsystem där jag undersöker möjligheten att använda en databas för detektering av långsam portskanning. Det görs i ett system som ana-lyserar paket i realtid. Resultatet blev ett program som klarar av just det. Det upptäcker vanliga portskan-ningsattacker i realtid och långsamma attacker via presentation i en databas. / In this report I describe my investigation of a method for slow port scanning detec-tion in a real-time analysis system. Port scanning is used as a reconnaissance technique used by perpetrators in the IT world. It is used to form an idea of any vulnerabilities that may exist in a network. Slow port scanning is used to try to bypass detection systems and thus able to per-form a scan without being detected. Slow port scanning detection may be resource-intensive for the computer memory since a large buffer is traditionally established to analyze network traffic over a longer period of time. There are also solutions that analyze netflow data, which provides less information and is unable to detect port scanning in real time. I have created a detection system where I investigate the possibility of using data-base in order to detect slow port scanning. The method is part of a system that ana-lyzes real-time packages. The result is a program is capable of doing just that. It detects regular port scan attacks in real time and slow attacks through presentation of the database. IDS port scan Snort C# Intrusion detection system SharpPcap IDS portskanning Snort C# Intrusion detection system SharpPcap Computer and Information Sciences Data- och informationsvetenskap
4	Eavesdropping Attacks on Modern-Day Connected Vehicles and Their Ramifications / Avlyssningsattacker på moderna uppkopplade bilar och deras följder Bakhshiyeva, Afruz, Berefelt, Gabriel January 2022 (has links) Vehicles today are becoming increasingly more connected. Most cars are equipped with Bluetooth, Wi-Fi and Wi-Fi hotspot capabilities and the ability to connect to the internet via a cellular modem. This increase in connectivity opens up new attack surfaces for hackers to exploit. This paper aims to study the security of three different cars, a Tesla Model 3 (2020), an MG Marvel R (2021) and a Volvo V90 (2017), in regards to three different eavesdropping attacks. The performed attacks were a port scan of the vehicles, a relay attack of the key fobs and a MITM attack. The study discovered some security risks and discrepancies between the vehicles, especially regarding the open ports and the relay attack. This hopefully promotes further discussion on the importance of cybersecurity in connected vehicles. / Bilar idag har blivit alltmer uppkopplade. Idag har de inte bara bluetooth och Wi-Fi funktionalitet utan vissa bilar har förmågan att kopplas till internet via ett mobilt bredband. Denna trend har visats ge bilar nya attackytor som hackare kan utnyttja. Målet med denna studie är att testa säkerheten hos tre olika bilar, Tesla Model 3 (2020), MG Marvel R (2021) och Volvo V90 (2017) med åtanke på tre olika avlyssningsattacker. De attackerna som studien valde var port-skanning på bilen, relä-attack på bilnycklarna och mannen-i-mitten attack. Studien hittar vissa säkerhetsrisker och skillnader mellan de olika bilarna särskilt vid reläattacken och port-skanningen som förhoppningsvis främjar en fortsatt diskussion om cybersäkerhetens vikt för säkrare uppkopplade bilar. Connected vehicle hacking pentest eavesdropping security Tesla Model 3 Volvo XC40 MG Marvel R automotive cybersecurity interception attacks passive attacks wireless attacks Wi-Fi attacks attack surface relay attack port scan man-in-the-middle attack Uppkopplade fordon hacking avlyssning säkerhet Tesla Model 3 Volvo XC40 MG Marvel R fordonscybersäkerhet avlyssningsattacker passiva attacker trådlösa attacker Wi-Fi-attacker attackyta relä-attack port-skanning mannen-i-mitten attack Computer Sciences Datavetenskap (datalogi)

1

Page generated in 0.0521 seconds