Normal Spoofing Scan

    This is the simplest among all other technique. All the attacker needs to do is to spoof
the source IP of the scanning machine to any other IP without worrying about anything else. That spoofed IP is used for all scan packets. Also, that spoofed IP can by any valid
IP address and does not have to be within the subnet IP range of the scanning machine.
    This normal spoofing could be done with the (-S) switch of nmap tool:

# nmap –sS –S 217.64.121.34 –P0 –p 1-1024 64.23.16.21

However, this technique suffers from a major drawback. That is, there will be no results since all replies will be forwarded to the spoofed IP. The scanning machine will never receive any of those replies. One reason an attacker might attempt such type of spoofing is to fool the scanned target into thinking that somebody else – probably a competitor – is scanning them. The attacker here is not concerned about the replies or about the port status of the target.

Advantages of this spoofing technique are:
• Freedom of spoofing. The attacker is not bounded by a specific range of IPs.
• No wasted or unneeded initiated packets. The attacker sends one TCP/UDP
packet per port.
• No tracing of the original scanner. Detection of the scanning machine is impossible at the IP layer.

Disadvantages of this technique are:
• No replies. There will be no reply packets arriving at the scanning machine.
• No results. Since replies are not received, the attacker won’t know port status.

Dynamic Port Scanning

Dynamic Port Scanning is a new methodology that aims to dynamically spoof the source IP of the scanning machine. What is meant by “dynamic spoofing” is that each TCP or UDP scan packet has a randomly generated IP address. However, that IP address
must fall within the local subnet IP range of the scanning machine. The underlying implementation of such methodology is solely dependent on the integration of ARP
poisoning/spoofing into the scanning process.
    ARP poisoning/spoofing has been in place since the creation of TCP/IP protocols. It has been known and used for network traffic sniffing and interception in switched
network. However, this paper will show how ARP poisoning/spoofing could be used in conjunction with port scanning to achieve the dynamic way of spoofing the source IP of the scanning machine.
    In general, Dynamic Port Scanning [DPS] is implemented by ensuring that the ARP cache of the target host or even the default gateway is poisoned by fake IP/MAC entry which allows scan reply packets to carry the MAC address of the scanning machine. Although the reply packet is destined to a fake IP address (i.e. the spoofed IP), the
placement of scanner’s MAC address as destination MAC address in the reply packet enables that packet to arrive correctly at the scanning machine. The process of poisoning the remote ARP cache is done for each TCP/UDP scan packet that carries a spoofed IP
address.
   This paper will discuss deeply the process of Dynamic Port Scanning [DPS]. First, the paper examines current methodologies used in spoofing the source IP while scanning. Then, it will describe the new methodology along with TCP scan types. Finally, a new open-source tool called Dynamic Port Scanner [DPS], which does exactly the technique described in this paper, is outlined.

Malware Detection Techniques

Techniques used for malware detection classified into two categories:
1)Anomaly based detection
                                            An anomaly based detection techniques uses the knowledge of what is considered as normal to find out what actually is malicious.a special type of anomaly based detection is Specification based detection.
Specification based detection makes use of certain rule set of what is considered as normal in order to decide the maliciousness of the program violating the predefined  rule set.This program violating the rule set are consider as malicious program.Or it is considered as malicious to finds out maliciousness of the program under inspection.

2)Signature based detection
Commercial antivirus scanner look for signature which are typically a sequence of bytes within the malware code to declare that the program scanned is malicious in nature.
Basically there are three type of malware: Basic,Polymorphic,Metamorphic malware
  a) Basic malware
In basic malware the program entry is changed such that control is transferred to malicious payload.
Detection is relatively if the signature can be found for the viral code.
                                Entry ---------> Original code ---------> Malicious code


  b) Polymorphic malware 
Polymorphic viruses mutates while keeping the original code intact. A polymorphic malware consists of encrypted malicious code along with the decryption module. To enable the polymorphic      virus the virus has got polymorphic engine somewhere in the virus body.The polymorphic engine generates new mutants each time it is executed.Strong static analysis based on API sequencing is used for polymorphic virus detection.

          Entry --------> Original code --------> Decrypt code --------> Virus code


  c) Metamorphic malware
this malware can reprogram itself using certain obfuscation techniques so that the children never look like the parents.such malware evade the detection's from he malware detector since each new variant generated will have different signature, hence it is impossible to store the signature of multiple variants of same malware sample.In order to thwart detection a metamorphic engine has to be implemented with some sort of disassemble in order to parse the input code. After disassembly, the engine willl transform the program code and will produced new code that will retain its functionality and would still look different from the original code.

                   Virus                    Form                    Form                     Form
                     A                           B                      C                            D      
                      |                             |                      |                             |
                      |                             |                      |                             |
                   (S1 )                       (S2)                     (S3)                       (S4)

Worm

Viruses Are far from The only maverick programs that can disrupt a computer system.Worms are constructed to infiltrate  legitimate data processing programs and alter or destroy  the data. Often what  people believe is a virus infection is, in fact , a worm program. This is not as serious because worms do not replicate themselves.But the damage caused by a worm attack can be just as serious as a virus, especially if not discovered in time. For ex. suppose a worm program instructs a bank's computer to transfer funds to an illicit account.The fund transfers may continue even after the worm is destroyed.However, once the worm invasion is discovered , recovery is much  easier because there is only single copy of worm program to destroy since the replicating ability of the virus is absent .A worm is similar to a benign tumor while a virus is like a malignant one.

How Secure Should My Linux Be?

Security is process,not a permanent state. once you've taken the initial steps to secure your box,you must engage   in regular maintenance to ensure that box continue to remain secure. To ensure continue security,regular do the following:

> Keep current with patches:- Keep current with your distribution's security updates and patch on a regular basis.

>Monitor Log files:- Logfiles should be monitored regularly for anomalous events. Monitoring with automated tools is acceptable provided you do a regularly manual audit of log files as well.

>Audit password strength:- Run a password auditing tool such as jhon ripper every month or so to check for insecure password.

>Check your binaries:- Regularly scan your system for trojaned or otherwise altered binaries using both an integrity checker ,and trojan scanner.

>Check for remote vulnerability:- Periodically run a current vulnerability scanner against your machine from another box, preferably one outside of your firewall.

Protecting The Registry

All the initialization and configuration information used by windows NT is stored in the registry .
Normally ,the keys in the registry are changed indirectly, through the administrative tools such as the control panel. This method is recommended. The registry can be altered directly, with the Registry Editor. Some keys can be altered in no other way.

The Registry Editor supports remote access to the Windows NT registry.To restrict network access to the registry,use the registry Editor to create the following registry key:
Hive: HKEL_LOCAL_MACHINE
Key:\CurrentcontroleSet\Control\SecurePipeServers
Name:\winreg

The security permission set on this key define witch users or group can connect to the system for remote access. the default Windows NT Workstation installation does not define this key and does not restrict remote access to the registry .Windows NT Server permits only administrators remote access to the registry.

Legancy system

With Windows 95,Windows 98,Windows Me and windows NT,administrators can use a special file to be merged into the registry, called a policy file (POLICY>POL).The Policy file allows administrators to prevent non-administrator users from changing registry setting like ,for instance,the security level of Internet Explorer and the desktop wallpaper.the policy file is used in business with large no.of computers where the business needs to be protected from careless users.

The default extension for the policy file is .POL. The policy file filters the setting it enforces by user and by group(a "group"is a defined set of users). To do that policy file merges into the registry,preventing users from circumventing  it by simply changing back the setting. The policy file is usually distributed through a LAN,but can be placed on the local computer.

The policy file is created by a free tool by Microsoft that goes by the file name poledit.exe for Windows 95/98 and with a computer management  module for NT-based system.The editor requires administrative
permissions to be run on system that use permission.The editor can also directly change the current registry setting of the local computer and if the remote registry service is installed and started on another computer it can also change the registry on that computer.

The policy editor loads the setting it can change from .ADM files, of which one is included, that contains the setting the Windows shell provides. The .ADM file is plain txt and supports easy localization by allowing all the strings to be stored in one placed.