Operating System attack
Operating Systems (OS) considerably aid in administering and synchronizing
numerous software and hardware components in computer systems and
networks.
Operating systems are vulnerable to attacks by malicious actors or organizations
looking for a competitive advantage.
Two main categories of operating System attack are:
Local
Remote
[Link] banu , Associate Professor, SCOPE, VIT University
Operating System attack
Local attacks are conducted by someone who has physical or logical access to
the system, such as a malicious insider or a compromised application.
Remote attacks are carried out by someone who exploits a vulnerability in the
system's network services, such as a hacker or a phishing email.
Examples of operating system attacks include boot sector attacks, kernel
attacks, and user mode attacks.
[Link] banu , Associate Professor, SCOPE, VIT University
Operating System attack
Boot sector attacks target the code that is executed when the system starts up,
such as the master boot record (MBR) or the GUID[globally unique identifier ]
partition table (GPT).
Kernel attacks exploit a flaw in the kernel code or a kernel module to gain root or
administrator privileges, execute arbitrary code, or disable security features.
User mode attacks target applications and services that run in the user mode of
the operating system, which is the normal mode for most programs. They can
exploit a bug or vulnerability in a user mode program to escalate privileges, inject
code, or access sensitive data
[Link] banu , Associate Professor, SCOPE, VIT University
Common types of Operating system
attacks
Active Attacks
An active attack tries to change system resources or impact their
functionality. Active attacks entail some form of data stream manipulation or
false statement generation. Active attacks can take the following forms:
Masquerade
Modification of messages
Repudiation
Replay
Denial-of-Service
Operating System attack
Passive Attacks
A passive attack does not consume system resources but aims to gather or
use system data. Monitoring communications are examples of passive attack.
The adversary wishes to obtain the information that is being delivered.
Malware
Phishing
Man-in-the-Middle Attack
Distributed Denial-of-Service Attack
Zero-Day Exploit
[Link] banu , Associate Professor, SCOPE, VIT University
Operating System attack
Masquerade –A masquerade attack refers to a cyber attack where an attacker
impersonates a legitimate user or device in order to gain unauthorized access
to a network or system.
By Masquerading the attackers breach authentication.
[Link] banu , Associate Professor, SCOPE, VIT University
Operating System attack
Modification of messages – It denotes that part of a message has been changed, delayed,
or rearranged to have an unauthorized impact.
In a message modification attack, an intruder alters packet header addresses to direct a
message to a different destination or to modify the data on a target machine.
Operating System attack
Replay – It entails passively capturing and transmitting a message to generate an
authorized effect.
Operating System attack
Repudiation – The sender or receiver may be the perpetrator of this attack.
Later, the sender or the recipient may claim they never sent or received a
communication. For example, customers might ask their bank. To send money
to someone and afterward (client) deny that he ever requested it. This is a
rejection.
Denial-of-Service – It makes it difficult to use communication tools on a
regular basis. This attack could have a specific target. For example, an entity
could suppress all messages delivered to a certain area. Another type of
service denial occurs when an entire network is interrupted by powering it
down or delivering too many messages, lowering performance.
[Link] banu , Associate Professor, SCOPE, VIT University
Operating System attack
Passive Attacks – A passive attack does not consume system resources but aims to gather or use system data. Monitoring
communications are examples of passive attack. The adversary wishes to obtain the information that is being delivered.
Malware
Malware is harmful software used to access computer systems by exploiting network weaknesses. Users generally notice
this when they open attachments or click on URLs that download harmful spyware. Malware can be spyware,
ransomware, viruses, or worms. Malware can engage in a wide range of malicious activities:
Access to the network or specific areas of the network may be blocked.
It can set up further malware.
It is possible to transmit and copy data from the hard drive covertly.
It might interfere with the system and render it useless.
[Link] banu , Associate Professor, SCOPE, VIT University
Operating System attack
Phishing is a kind of social engineering in which forged communications look to be from a reliable source.
Email is frequently used to steal sensitive information or deceive individuals into installing malware. The most
common reason for cyberattacks worldwide is phishing.
Man-in-the-Middle Attack:
A Man-in-the-Middle (MITM) attack occurs when an outsider intercepts and distributes communications that
appear to be engaging between two parties.
Assailants can filter, alter, and steal important information while in the conversation, also known as an
eavesdropping attack.
Encrypting data is one approach to defend your company from such threats.
Additionally, organizations should implement auditing and monitoring to stay updated on personnel activities.
[Link] banu , Associate Professor, SCOPE, VIT University
Operating System attack
Distributed Denial-of-Service Attack
Attacks known as DDoS (Distributed Denial-of-Service) flood a company’s central server with simultaneous data requests.
Several infected systems produce these data requests. A DDoS assault seeks to prevent the server from responding to
valid requests, creating an opportunity for criminal hackers to demand money from the victim.
A DDoS attack can last anything from a few minutes to a month, with 15% of attacks lasting that long. When DDoS attack
defenses are implemented carelessly, the immediate issue is only fixed, leaving the system vulnerable. Finding potential
targets for DDoS assaults requires a systematic approach using a risk assessment tool.
Zero-Day Exploit
There is a window after a network vulnerability is disclosed before a patch or other fix is applied. Attackers using the
internet will use the vulnerability during that period.
To defend against this kind of cyber-attack, continuous monitoring is required. Before online criminals do, infrastructure
penetration testing can find flaws in your network.
[Link] banu , Associate Professor, SCOPE, VIT University
Preventing Operating Systems attacks
Keep the Operating System Updated: Regularly update the operating system with the latest security patches and
updates provided by the OS vendor. This helps to address known vulnerabilities and strengthen the system
against potential attacks.
Use Strong Authentication: Implement strong passwords or passphrase policies for user accounts and discourage
default or easily guessable passwords. To access the system, consider enabling Multi-Factor Authentication (MFA)
for added security, requiring users to provide additional verification factors, such as a fingerprint, token, or SMS
code.
Install Security Software: Utilize reputable antivirus/anti-malware software on the operating system to detect
and mitigate threats. Keep the security software updated to ensure it can identify and protect against new and
emerging threats effectively.
Employ Firewalls: Enable firewalls at the network and host levels to monitor and control inbound and outbound
traffic. Firewalls help filter malicious network traffic and prevent unauthorized access to the system.
[Link] banu , Associate Professor, SCOPE, VIT University
Preventing Operating Systems attacks
Limit Privileges and Access Rights: Implement the Principle of Least Privilege (PoLP) by assigning users and processes only
the minimum level of access required to perform their tasks. Regularly review and revoke unnecessary privileges to reduce
the attack surface.
Encrypt Data: Utilize encryption mechanisms to protect sensitive data on the operating system, especially when it is stored
or transmitted. Full disk encryption can secure the entire storage medium, while file and folder-level encryption protect
specific data sets.
Regularly Backup Data: Perform regular backups of critical data and ensure the backups are stored securely. This practice
helps in data recovery in case of a successful attack or system failure.
Enable Auditing and Monitoring: Implement logging and auditing mechanisms to record system activities and detect
potential security incidents. Monitor logs and system events to identify abnormal or suspicious behavior that may indicate an
ongoing attack.
Benefits of preventing operating
system attacks?
Preventing operating system attacks can bring many benefits, such as improved reliability and
availability of the system, protection of data and resources, and enhanced reputation and
trust.
By preventing operating system attacks, you can avoid system downtime, crashes, or failures
that could disrupt operations and services.
Additionally, you can prevent data loss, theft, or corruption that could compromise
confidentiality, integrity, or availability.
Moreover, preventing operating system attacks can demonstrate commitment and capability
to secure the system and protect stakeholders.
This can increase confidence and credibility among customers, partners, and regulators.
Challenges of preventing operating
system attacks?
To keep up with the ever-changing threats, you need to stay informed of the latest trends and
developments in the operating system security landscape and adjust your prevention
strategies accordingly.
Additionally, there can be a conflict between security and usability, as some security
measures may be inconvenient or create complexity.
You need to find the optimal level of protection that meets your needs and expectations while
managing costs and resources wisely.
Prioritize your security investments and activities based on your risk assessment and business
objectives for the best results.
