Kaspersky Internet Security 2012

A D V A N C E D A P P L I C A T I O N S E T T I N G S
This group includes the largest number of attacks. They may be divided into three groups depending on the
operating system installed on the user's computer: Microsoft Windows attacks, Unix attacks, and a common
group for network services available in both operating systems.
The following types of attacks are the most common among those which use the network resources of operating
systems:
Buffer overflow attacks. Buffer overflow may be caused by the absence (or insufficiency) of control when
working with data arrays. This is one of the oldest vulnerability types and the easiest for hackers to exploit.
Format string attacks. Format string errors arise from insufficient control of input values for I/O functions,
such as printf(), fprintf(), scanf(), and others, from the standard C library. If an application has this
vulnerability, the hacker is able to send specially created queries and can take total control of the system.
The Intrusion Detection System automatically analyzes and prevents attempts to exploit these
vulnerabilities in the most common network services (FTP, POP3, IMAP) if they are running on the user’s
computer.
Attacks aimed at computers with Microsoft Windows are based on the use of the vulnerabilities of the
software installed on a computer (such as Microsoft SQL Server, Microsoft Internet Explorer, Messenger,
and system components available via the network – DCom, SMB, Wins, LSASS, IIS5).
In addition, the use of various malicious scripts, including scripts processed by Microsoft Internet Explorer and
Helkern-type worms, can be classified as isolated incidents of intrusion attacks. The essence of this attack type
consists of sending a special type of UDP packet that can execute malicious code to a remote computer.
ENABLING AND DISABLING NETWORK ATTACK BLOCKER
By default, Network Attack Blocker is enabled, running in a mode recommended by Kaspersky Lab specialists. You can
disable Network Attack Blocker if necessary.
To disable Network Attack Blocker:
1. Open the application settings window.
2. In the left part of the window, in the Protection Center section, select the Network Attack Blocker component.
3. In the right part of the window, uncheck the Enable Network Attack Blocker box.
EDITING THE BLOCKAGE SETTINGS
By default, Network Attack Blocker blocks the activity of an attacking computer for one hour. You can cancel blockage of
the selected computer or change the blockage time.
To modify the time for which an attacking computer will be blocked:
1. Open the application settings window.
2. In the left part of the window, in the Protection Center section, select the Network Attack Blocker component.
3. In the right part of the window, check the Add the attacking computer to the list of blocked computers for
box and specify the blockage time.
To unblock an attacking computer:
1. Open the main application window (see page 33).
2. In the lower part of the window, select the Network Monitor section.
3. In the Network Monitor window that opens, on the Blocked computers tab, select the blocked computer and
click the Unblock button.
115