User Guide - Kaspersky Lab

Protection against network attacks 163
To ensure your computer’s security, you must know what kinds of network
attacks you might encounter. Known network attacks can be divided into three
major groups:
• Port scan – this threat is not an attack in its own right, but usually
precedes one, since it is one of the common ways of obtaining
information about a remote computer. The UDP/TCP ports used by the
network tools on the computer in question are scanned to find out what
state they are in (closed or open).
Port scans can tell a hacker what types of attacks will work on the system,
and what types will not. In addition, the information obtained by the scan
will let the hacker determine what operating system the remote computer
uses. This in turn further restricts the number of potential attacks, and,
correspondingly, the time spent running them. It also aids a hacker in
attempting to use vulnerabilities particular to that operating system.
• DoS (Denial of Service) attacks – these are attacks that render the
attacked system unstable or entirely inoperable. These attacks can
damage or corrupt the targeted information resources, and leave them
unusable.
There are two basic types of DoS attacks:
• Sending the target computer specially created packets that the
computer does not expect, which cause the system either to restart
or to stop
• Sending the target computer many packets within a timeframe that
the computer cannot process, which exhaust system resources
The following attacks are common examples of this type of attack:
• Ping of death sends an ICMP packet greater than the maximum of
64 KB. This attack can crash some operating systems.
• Land sends a request to an open port on your computer to establish
a connection with itself. This sends the computer into a cycle, which
intensifies the load on the processor and can end with some
operating systems crashing.
• ICMP Flood sends a large number of ICMP packets to your
computer. The attack leads to the computer being forced to reply to
each inbound packet, which seriously weighs down the processor.
• SYN Flood sends a large number of queries to your computer to
establish a fake connection. The system reserves certain resources
for each of those connections, which completely drains your system
resources, and the computer stops reacting to other connection
attempts.