Kaspersky PURE User Guide - Kaspersky Lab

U S E R G U I D EThere are two basic types of DoS attacks:sending the target computer specially created packets that the computer does not expect, which cause thesystem either to restart or to stop;sending the target computer many packets within a timeframe that the computer cannot process, whichcause system resources to be exhausted.The most flagrant examples for this group of attacks are the following types:The Ping of death attack consists of sending an ICMP packet with a size greater than the maximum of 64KB. This attack can crash some operating systems.Land attack consists of sending a request to an open port on the target computer to establish a connectionwith itself. This attack sends the computer into a cycle, which intensifies the load on the processor and canlead to the crashing of some operating systems.The ICMP Flood attack consists of sending a large quantity of ICMP packets to your computer. Thecomputer attempts to reply to each inbound packet, which slows the processor to a crawl.The SYN Flood attack consists of sending a large quantity of queries to a remote computer to establish afake connection. The system reserves certain resources for each of those connections, which completelydrains your system resources, and the computer stops reacting to other connection attempts.Intrusion attacks, which aim to take over your computer. This is the most dangerous type of attack, because if itis successful, the hacker takes total control of your system.Hackers use this attack to obtain confidential information from a remote computer (for example, credit cardnumbers, passwords), or to penetrate the system to use its computing resources for malicious purposes later(e.g., to use the invaded system in a zombie network, or as a platform for new attacks).This group is the largest in number of attacks included. They may be divided into three groups depending on theoperating system installed on the user's computer: Microsoft Windows attacks, Unix attacks, and the commongroup for network services available in both operating systems.The following types of attacks are the most wide-spread among those using the network resources of operatingsystems:Buffer overflow attacks. Buffer overflow may be caused by lack (or insufficiency) of control when workingwith data arrays. This is one of the oldest vulnerability types and the easiest for hackers to exploit.Format string attacks. Format string errors arise from insufficient control of input values for I/O functions,such as printf(), fprintf(), scanf(), and others, from the standard C library. If a program has this vulnerability,the hacker able to send queries created with a special technique, can take total control of the system.Intrusion Detection System automatically analyzes and prevents attempts to exploit these vulnerabilities inthe most common network services (FTP, POP3, IMAP) if they are running on the user’s computer.Attacks aimed at computers with Microsoft Windows are based on the use of vulnerabilities of the softwareinstalled on a computer (such as Microsoft SQL Server, Microsoft Internet Explorer, Messenger, andsystem components available via the network – DCom, SMB, Wins, LSASS, IIS5).In addition, the use of various malicious scripts, including scripts processed by Microsoft Internet Explorer andHelkern-type worms, can be classified as isolated incidents of intrusion attacks. The essence of this attack typeconsists of sending a special type of UDP packets to a remote computer that can execute malicious code.E N A B L I N G A N D D I S A B L I N G N E T W O R K A T T A C K B L O C K E RBy default, Network Attack Blocker is enabled, functioning in optimum mode. You can disable Network Attack Blocker, ifnecessary.To enable or disable the Network Attack Blocker:1. Open the main application window.144