Программа по формированию навыков безопасного поведения на дорогах и улицах «Добрая дорога детства» 2
Скачать 0.54 Mb.
|
Ex. 4. Reporting.You should elaborate the message to clearly deliver it to the class emphasizing the definitions and important details so that everybody could understand and take notes if necessary.The preparation is likely to take up to 3-5 minutes of class time. You should only talk for about 3 minutes. Prepare short reports with a clear structure: introduction, main body and conclusion. Use appropriate linking words. You may add some details to the description you hear during or after the activity. Make a short presentation of the topics:
1. Greynet Greynet is a term for the use of unauthorized applications on a corporate network. A greynet application is a network-based program that corporate network users download and install without permission from their company's IT department. Common examples of greynet applications include instant messaging, peer-to-peer collaboration and conferencing programs, streaming media players, and RSS readers. Many greynet applications, such as instant messaging and collaboration programs, have legitimate business use and help boost user productivity. Other greynet applications, like peer-to-peer file and music sharing programs, pose serious security risks and can drain network resources. User-downloaded programs also can include malicious programs like spyware components for tracking and reporting information without the user's knowledge. Greynet usage by employees is thought to be a major contributor to the growth of spyware-related incidents. All greynets, even those that benefit the end-user, can be detrimental to a company network. Because they use corporate bandwidth, the programs often have negative effects on overall network performance. They introduce security risks, including client code vulnerabilities and new avenues for attack, and can lead to data loss and property or identity theft. Greynets can be difficult to eliminate because many use encryption and port agility (the ability to dynamically send and receive traffic across any open network port), which makes them difficult to detect and block. 2. Hijacking Hijacking is a type of network security attack in which the attacker takes control of a communication - just as an airplane hijacker takes control of a flight - between two entities and masquerades as one of them. In one type of hijacking (also known as a man in the middle attack), the perpetrator takes control of an established connection while it is in progress. The attacker intercepts messages in a public key exchange and then retransmits them, substituting their own public key for the requested one, so that the two original parties still appear to be communicating with each other directly. The attacker uses a program that appears to be the server to the client and appears to be the client to the server. This attack may be used simply to gain access to the messages, or to enable the attacker to modify them before retransmitting them. Another form of hijacking is browser hijacking, in which a user is taken to a different site than the one the user requested. There are two different types of domain name system (DNS) hijacking. In one, the attacker gains access to DNS records on a server and modifies them so that requests for the genuine Web page will be redirected elsewhere - usually to a fake page that the attacker has created. This gives the impression to the viewer that the Web site has been compromised, when in fact, only a server has been. In February 2000, an attacker hijacked RSA Security's Web site by gaining access to a DNS server that was not controlled by RSA. By modifying DNS records, the attacker diverted requests to a spoof Web site. It appeared to users that an attacker had gained access to the actual RSA Web site data and changed it - a serious problem for a security enterprise. This type of hijacking is difficult to prevent, because administrators control only their own DNS records, and have no control over upstream DNS servers. In the second type of DNS hijack, the attacker spoofs valid e-mail accounts and floods the inboxes of the technical and administrative contacts. This type of attack can be prevented by using authentication for InterNIC records. In another type of Web site hijack, the perpetrator simply registers a domain name similar enough to a legitimate one that users are likely to type it, either by mistaking the actual name or through a typo. This type of hijack is currently being employed to send many unwary users to a pornographic site instead of the site they requested. 3. Browser hijacker A browser hijacker (sometimes called hijackware) is a type of malware program that alters your computer's browser settings so that you are redirected to Web sites that you had no intention of visiting. Most browser hijackers alter default home pages and search pages to those of their customers, who pay for that service because of the traffic it generates. More virulent versions often: add bookmarks for pornographic Web sites to the users' own bookmark collection; generate pornographic pop-up windows faster than the user can click them shut; and redirect users to pornographic sites when they inadvertently mistype a URL or enter a URL without the www. preface. Poorly coded browser hijackers -- which, unsurprisingly, are common -- may also slow your computer down and cause browser crashes. Browser hijackers and the pornographic material they often leave in their wake can also be responsible for a variety of non-technical problems. Employees have lost jobs because of content and links found on their computers at work; people have been charged with possession of illegal material; and personal relationships have been severed or strained. In one case in the United States, a Russian immigrant was convicted for possession of child pornography, although he claims to have been the victim of a browser hijacker. Like adware and spyware, a browser hijacker may be installed as part of freeware installation. In this case, the browser hijacker is probably mentioned in the user agreement -- although, obviously, not identified as a browser hijacker. The problem is that users typically either ignore the fine print or only give it a cursory reading. A browser hijacker may also be installed without user permission, as the result of an infected e-mail, a file share, or a drive-by download. To avoid contamination, experts advise users to read user agreements carefully, and to be cautious about freeware downloads and e-mail messages from unknown sources. |
