User Guide - Kaspersky Lab

164 Kaspersky Internet Security 7.0
• Intrusion attacks, which aim to take over your computer. This is the most
dangerous type of attack, since if it is successful, the hacker has
complete control of your computer.
Hackers use this attack to obtain confidential information from a remote
computer (for example, credit card numbers or passwords), or to use its
resources later for malicious purposes (e.g. using the captured system in
zombie networks or as a platform for new attacks).
This group contains more different types of attacks than any other. They
can be divided into three subgroups based on operating system: Microsoft
Windows attacks, Unix attacks, and a group for network services running
either operating system.
The most common types of attacks that use operating system network
tools are:
• Buffer overflow attacks – a type of software vulnerability that
surfaces due to insufficient control in handling massive amounts of
data. This is one of the oldest vulnerability types, and the easiest for
hackers to exploit.
• Format string attacks – a type of software vulnerability that arises
from insufficient control of input values for I/O functions such as
printf(), fprintf(), scanf(), and others from the C standard library. If a
program has this vulnerability, a hacker, using queries created with
a special technique, can gain complete control of the system.
The Intrusion Detection System automatically analyzes and blocks
attempts to exploit vulnerabilities in the most common network tools (FTP,
POP3, IMAP) running on the user’s computer.
Microsoft Windows attacks are based on taking advantage of
vulnerabilities in software installed on the computer (for example,
programs such as Microsoft SQL Server, Microsoft Internet Explorer,
Messenger, and system components that can be accessed through the
network – DCom, SMB, Wins, LSASS, IIS5).
Firewall protects your computer from attacks that use the following known
software vulnerabilities (this list of vulnerabilities is cited with the Microsoft
Knowledge Base numbering system):
(MS03-026) DCOM RPC Vulnerability(Lovesan worm)
(MS03-043) Microsoft Messenger Service Buffer Overrun
(MS03-051) Microsoft Frontpage 2000 Server Extensions Buffer Overflow
(MS04-007) Microsoft Windows ASN.1 Vulnerability
(MS04-031) Microsoft NetDDE Service Unauthenticated Remote Buffer
Overflow
(MS04-032) Microsoft Windows XP Metafile (.emf) Heap Overflow