Download

What are the Hacking, Denial of services, Database administrator (DBA)?

Answer: Hacking, Denial of services, Database administrator (DBA)

Hacking :

Hacking is an art of exploring various security breaches. Each hackers has motives, methods and skills. Computer hacker is a typically knowledgeable person. He/she knows several different languages, familiar with UNIX and NT, Networking protocols. A hackers will look for internal and external system holes or break into the system. Cracker and hacker are two different terms. Cracker is making an attempt to break into the system by guessing or cracking user’s passwords. Crackers can easily be identified because their actions are malicious.

An ethical hacker possesses the skills, mindset, and tools of a hacker but is also trustworthy. Ethical hackers perform the hacks as security tests for their systems. Ethical hacking is also known as penetration testing or white hat hacking. It involves the same tools, and techniques that hackers use, but with one major difference. Ethical hacking is legal. Attack vector is a path for hacker. By means which a hacker can gain access to a computer system or computer server in order to deliver a payload or malicious outcome. Attack vectors enable hackers to use system vulnerabilities, including the human. Viruses, attachments of electronic mail, web pages, pop‐up windows, instant messages and chat rooms are example of attack vector. All of these methods require programming. To prevent vector, you can use firewall and anti‐virus software.

Denial of services (DoS) :

Denial of services (DoS) is a network based attack whose objective is not to steal the system resources or access confidential data but it aims to prevent the legitimate users from accessing information or services by interrupting the normal use of the system services. DoS attacks fall under two categories :

1. One which eat up almost all system resources, preventing legitimate users from doing any useful work.

2. Another which target the network and disrupt its operation.

The most common type of DoS attack occurs when attackers mischievously flood a network server or a web server with multiple false requests for services in order to crash the network. In this situation, the server is not able to serve the genuine requests. This is a ʹdenial of serviceʹ because the legitimate users cannot use the network facility.

DoS attack does not damage information or access restricted areas but it can shut down a website, thereby making it inaccessible for genuine users. Several times, it becomes difficult for a website to determine that it has been attacked.

Example : A slowdown may be considered as due to network traffic.

It is usually impossible to prevent DoS attacks.

Protecting against DoS attack is as follows :
(i) Make a list of all resource consumed by every user.

(ii) Detect when the resources consumed by a given user exceed those allowed by some system policy.

(iii) After detecting attack, reclaim the consumed resources using as few additional resources as
possible or removal of an offending user.

Classification of DoS attacks :

(i) Logic attacks : This attack takes place in network software such as TCP/IP protocol stack or web server.

(ii) Protocol attacks : Protocol is a set of rules. This attack takes place to specific feature or implementation bug.
(iii) Bandwidth attacks : Attacker open many web pages and keep on refreshing for consuming
more bandwidth. After some time web site becomes out of service.

Types of DoS attacks :

1. Ping of death : Ping of death attack sends large oversized ICMP packets. Maximum legal size of IP packets is 65535 bytes. Because of limitations in the physical layer, packets may have to be fragmented and then reassembled at the destination. So this packet is fragmented for transport. The receiver then starts to reassemble the fragments as the ping fragments arrive. The total packet length becomes too large. It may possible that system may crash.
2. Smurf : It is a variation of ping attack. Attacker selects a network of unwitting victims. The attacker spoofs the source address in the ping packet so that it appears to come from the victim. Then the attacker sends this request to the network in broadcast mode by setting the last byte of the address to all 1s.

3. Teardrop attack : This attack misuse a feature designed to improve network communication. Attacker sends a series of datagram that cannot fit together properly. One datagram might say it is position 0 for length 60 bytes, another position 30 for 90 bytes so on. These fragment pieces overlap so they cannot be reassembled properly.

4. Malicious misrouting of packets : A attacker may attacks a router and change its routing table, resulting in misrouting of data packets, causing a denial of service.

5. Attacker send large number of UDP packets to non‐listing ports on the victim. This cause victim to respond with an ICMP host unreachable message for each packet that it receives.

Database administrator (DBA) :

The database administrator is a person having central control over data and programs accessing that data. He coordinates all the activities of the database system. The database administrator has a good understanding of the enterprise’s information resources and needs.

Functions of a DBA :

1. Schema definition : The creation of the original database schema. This involves writing a set of definitions in a DDL (data storage and definition language), compiled by the DDL compiler into a set of tables stored in the data dictionary.

2. Storage structure and access method definition : Writing a set of definitions translated by the data storage and definition language compiler.

3. Schema and physical organization modification : Writing a set of definitions used by the DDL compiler to generate modifications to appropriate internal system tables (Example : Data dictionary). This is done rarely, but sometimes the database schema or physical organization must be modified.

4. Granting user authority to access the database : Granting different types of authorization for data access to various users.

5. Specifying integrity constraints : Generating integrity constraints. These are consulted by the database manager module whenever updates occur.
6. Routine maintenance : It includes the following :
(i) Acting as liaison with users.
(ii) Monitoring performance and responding to changes in requirements.
(iii) Periodically backing up the database.