CS373 Week 0 - Initial Setup


This blog will function as my space to write my thoughts and experiences as I take Oregon State University's CS373 - Defense Against the Dark Arts. The course will cover malware and malware defenses, forensics, vulnerabilities and exploits, Windows kernel structures and drivers, network security, web security, mobile security, and messaging security.

Comments

Post a Comment

Popular posts from this blog

Week 5 - Windows Internals

Image
This week we will be primarily focusing on rootkits. A rootkit is a piece of malware that conceals its activities and existence from the user. The ushering in of this new era of malware came into focus in 2006 when Sony released a disk to try and prevent copying of music. In this piece of software any file that started with $sys$ was hidden from the user. Attackers saw the potential of this and gained control of this method. The majority of rootkits operate in a 32 bit Windows environment however some rootkits target a 64 bit environment. Most rootkits are at the kernel level because at this level they have full access and control to the system. The slide below is a nice illustration what the computer architecture looks like and where rootkits are located. slide source from lecture, OSU CS 373 Definitions for this week: thread - the smallest unit of execution within an operating system. The slide below has a nice demonstration of how a thread is executed hooking - redirecting...
Read more

Week 8 - Messaging Security

Image
This week we will be focusing on messaging security, or email security. Several terms will be defined and used this week. Spam - illegitimate email message that is phishing or intending to do harm Ham - legitimate email message Spamtrap/honeypot - an email address or domain that doesn't have any filtering on it to collect spam. The spam is then analyzed to study spam trends Botnet - a collection of computers that have been hijacked to perform an action (such as spamming) that the end user does not condone Snowshoe spam - distributed spamming efforts across a broad footprint Phishing - a general spam message that tries to get information that targets a wide demographic Spear Phishing - a targeted phishing attack against a specific person or demographic Realtime Blackhole List (RBL) - a list of known IPs that send spam Heuristics - a spam detection technique that uses basic feature matches (strings, sender, etc) to detect spam. If a message matches the phrase "buy <...
Read more

Week 2 - Advanced Forensic Methods and Tools

Image
"Forensic Computing is the process of identifying, preserving, analyzing and presenting digital evidence in a manner that is legally acceptable" - Rodney McKemmish This week we are introduced to advanced forensics. Our primary goals are to learn how to approach and react to incidents when collecting evidence. We are also going to learn how to set up a forensic environment. There are several case types that require forensic analysis, including but not limited to: fraud, intellectual property theft, data breaches, inappropriate use of Internet, child exploitation, and eDiscovery support for court cases. There are three steps to forensics: evidence acquisition, investigation and analysis, and reporting the findings. There are four principles that have to be applied to every case: minimize data loss, record everything that you do, analyze all data collected, and report your findings. Evidence in computer forensics can be found is many locations such as the operating syste...
Read more