Internet

1.         Introduction

(a)        Internet is a worldwide collection of computers, networks and gateways . It consists of millions of computers connected to each other through telephone lines, fiber optics, satellite links or other communication lines. Each of these computers contains information that can be accessed by anybody with the right kind of equipment.

(b)        Once connected to the Net, you become a part of a community of millions who use computers to communicate with one another and share ideas and information.

(c)        Computers use protocols to communicate with one another. At the heart of the Internet are high-speed data Communications lines between major host computers, consisting of thousands of commercial, government, educational, and other computer systems that route data and messages.

(d)       Internet offers a range of benefits to users, such as E-Mail, Downloads,                                       Information, Products, Services and much more.

2.         Browsers

(a)    A browser is a client application used to access the information on the World Wide Web. The browser interprets the markup of files in HTML, formats them into Web Pages and displays them to the user. It also makes the connection necessary to follow Hypertext Links. These links bring you information from Web servers and other types of resources, which may be located anywhere on the Internet.

(b)    Browsers are either Graphical or Text oriented. The Graphical browsers display images, as well as text, and offer Hyperlinks to multimedia resources, including sound and video files.

(c)    The Text oriented browsers like the Lynx enables you to follow web hypertext links but do not display non-text web resources.

(d)    The best browsers have additional features that save time and make it easier to navigate and use the resources of the web. Look for one that is Forms capable and has some timesaving features. The most popular browsers available today are the Netscape Navigator and Microsoft Internet Explorer

Viruses, Trojans, Worms & Types

 Virus 
           

(a)        A Computer virus is a software program designed to function in a manner diametrically opposed to legitimate software.

(b)        It will load and run without a request. To meet the minimum criteria for computer virus design, a program must be executable, be capable of cloning itself and converting other executable objects into viral clones. Hence, it may be a simple DOS batch file.

Types of Virus           There are six types of Computer viruses

                (a)    Boot Sector Infectors (BSI)  
                (b)    Command Processor Infectors (CPI) 
                (c)    General Purpose Infectors (GPI)       
                (d)   Multipurpose Infectors (MPI)
                (e)    File specific Infectors (FSI)   
                (f)    Memory Resident Infectors (MRI).

Boot Sector Infectors            Computer viruses that specialize in altering data in the master boot sector are called BSIs. They are loaded immediately upon system start up, before the command processor loads and of course before any anti-viral program can be loaded 

Command Processor Infectors        CPIs affect the hidden files as well as the command processor the COMMAND.COM file. These viruses have the advantage of examine a large majority of the interaction between the user and the computer.

General Purpose Infectors        GPIs are designed for the broadest range of infections compatibility. They infect any or particular executable files. They adapt well to most executable file formats, moving quickly among files

Multi Purpose Infectors         MPIs are designed to combine some or all the infectious tributes of the BSIs, CPIs and the GPIs. They are a potent, adaptable and deadly combination of computer virus technologies.

File specific Infectors            FSIs target a fixed number and fixed type of files. FSIs are viral cruise missiles, programmed to seek out and destroy the intended target files and property.

Memory Resident Infectors        MRIs could be boot sector or command processor infectors. They are always loaded and active. 

How a Proxy Passes Traffic, Stateful inspection, Interfaces & Address Translation

How a Proxy Passes Traffic.

(a)        Unlike its packet-filtering counterparts, a proxy does not route any traffic. In fact, a properly configured proxy will have all routing functionality disabled. As its name implies, the proxy stands in or speaks for each system on each side of the firewall.

(b)       For an analogy, think of two people speaking through a language interpreter. While it is true these two people are carrying on a conversation, they never actually speak to one another.

(c)        All communication passes through the interpreter before being passed on to the other party. The interpreter might have to clean up some of the language used, or filter out comments or statements that might seem hostile. To see how this relates to network communications, refer to Figures.

(d)      Our internal host wishes to request a Web page from the remote server. It formulates the request and transmits the information to the gateway leading to the remote network, which in this case is the proxy server.

(e)        Stateful inspection of an application is unique for each application. Any non-predicted ports used by an application are validated and allowed through the firewall using stateful inspection. The following applications are inspected.

(f)        Connections are not only applied to an ACL, but are logged into a state table.

(g)        After a connection is established, all session data is compared to state table.

(i)         FTP

(ii)        TFTP

(iii)       RCMD

(iv)       SQLNETe.

(v)        VDOLive

(vi)       RealAudio.

(aa)      Connections are not only applied to an ACL, but are logged into a state table.

(ab)      After a connection is established, all session data is compared          to state table.

  Stateful inspection    

(a)        Some protocols are difficult to allow through a firewall securely using traditional filtering mechanisms. In FTP, for example, the control connection is typically created using a known port, but the data connection is over a random port. To allow an FTP data connection through a firewall without leaving a large number of open ports requires stateful inspection: packets are inspected at the application layer to determine which port the data connection is using. Traffic on that port can then be allowed to pass through the firewall for the duration of the FTP session.

(b)        Transport-level state inspection provides a number of ways to make TCP traffic more secure and more difficult for hackers to intercept. Stateful inspection of TCP consists of verifying the consistency of the TCP header as well as preventing

some well-known TCP attacks.

            (c)        Any non-predicted ports used by an application are validated and allowed             through the firewall using stateful inspection. The applications inspected are : FTP,       TFTP, RCMD, SQLNET, VDO Live and Real Audio.

 Interfaces      

(a)        The Secure IP Services Gateway can have many interfaces. Each tunnel (end user or branch office) is a virtual interface, and all gateways have two or more physical interfaces. Packets can be classified by the interface on which they arrive at the source interface or the interface on which they leave the (the destination interface).

(b)        The rules in a policy can be constructed to either use or ignore this classification. If the rule designates “Any” as an interface, the rule ignores this classification. If the rule designates an interface or group of interfaces, the rule uses this classification.

(c)        The rules in any policy can use the following terms to designate an interface:-

(i)         Any                 –          Any physical interface or tunnel.
(ii)        Trusted            –          Any private physical interface or tunnel.
(iii)       Untrusted        –          Any public physical interface.
(iv)       Tunnel             –          Any tunnel.

 Address Translation            When an IP address is converted from one value to another, it is called address translation. This feature has been implemented in most firewall products and is typically used when you do not wish to let remote systems know the true IP address of your internal systems.

Destination IP                         -           206.121.73.5  
Source port                  -          1058
Destination port          -           80

Address translation  
Source IP                    -           192.168.1.50  
Destination IP             -           206.121.73.5  
Sourceport                   -           1037
Destination port          -           80