syssec_red_book

16. Forwardare accessible from the Internet and possibly in-turn also depend on itsservices.”• “Hardware and Virtualization. This is probably the lowest level in thesystems hierarchy where attackers may choose to operate. Althoughthese attacks are usually difficult to deploy, they can remain stealthy forquite some time and thus be very effective. Such attacks may include (i)malicious hardware, and (ii) attacks within the cloud.”• “Weak Devices. Capitalizing on their small size and power requirements,such devices have recently enjoyed widespread deployment in the formof lightweight sensors, and RFID. Their deployment in the wild, and theirmostly wireless communication abilities make them vulnerable to a widevariety of attacks including (i) information snooping, (ii) inserting falseor misleading information, (iii) jamming radio channels, (iv) makingnodes run out of battery by never letting them sleep, (v) giving theimpression of phantom nodes that do not exist, (vi) giving the impressionof connectivity that does not exist, and (vii) making messages go throughan attacking node that can selectively drop messages from the system.Mobile phones (and PDAs) also fall under this category of weak devices,and can also be a target for attacks including (i) mobile malware, (ii)eavesdropping, and (iii) DoS Attacks.”• “Complexity. Over the past years we have been building increasinglycomplex systems which, by definition, are more prone to errors andattacks. Since these systems are difficult, if not impossible, to accuratelymodel, they are challenging to test and may lead to several threats including:(i) unforeseen cascading effects, (ii) large-scale deployment ofany attack, (iii) vulnerable system parts due to incomplete system maintenance,(iv) dormant functionality hidden in a program, and (v) raceconditions and bugs due to multi-threaded/parallel nature of applications.”• “Data Manipulation: more people, more data, more value. As morepeople use the Internet, and as more organizations collect and store dataon-line, we are bound to see an increasing number of attacks against(or based on) these data. The attacks may target several dimensionsincluding: (i) erosion of privacy due to ubiquitous sensors, (ii) falsesensor data due to fabrication or falsification, (iii) data leaked from socialnetworks, and (iv) data gathered from (or for) on-line games.”• “Attack Infrastructure. To launch large-scale attacks, several adversariesdevelop and deploy distributed offensive platforms (such as botnets),which serve as underground economy support structures serving (and110