Phase 3 - Gaining Access

Phase 3 - Gaining Access

• Gaining Access refers to the true attack phase. The hacker exploits the system.
• The exploit can occur over a LAN, locally, Internet, offline, as a deception or theft. Examples include stack-based buffer overflows, denial of service, session hijacking, password filtering etc.
• Influencing factors include architecture and configuration of target system, skill level of the perpetrator and initial level of access obtained.
• Business Risk - 'Highest' - The hacker can gain access at operating system level, application level or network level.

This is the most important phase of an attack in terms of potential damage. Hackers need not always gain access to the system to cause damage. For instance, denial of service attacks can either exhaust resources or stop services from running on the target system. Stopping of service can be done by killing processes, using a logic / time bomb or even reconfiguring and crashing the system. Resources can be exhausted locally by filling up outgoing communication links etc.

The exploit can occur over a LAN, locally, Internet, offline, as a deception or theft. Examples include stack-based buffer overflows, denial of service, session hijacking etc.

Spoofing is a technique used by attackers to exploit the system by pretending to be someone else or a different system. They can use this technique to send a malformed packet containing a bug to the target system and exploit a vulnerability. Packet flooding may be used to remotely stop availability of essential services. Smurf attacks try to elicit a response from available users on a network and then use their legitimate address to flood the victim.

Factors that influence whether a hacker can gain access to a target system include architecture and configuration of target system, skill level of the perpetrator and initial level of access obtained. The most damaging of the denial of service attacks can be a distributed denial of service attacks, where an attacker uses zombie software distributed over several machines on the Internet to trigger an orchestrated large scale denial of services.

The risk involved when an attacker gains access is perceived to be high; as the attacker can gain access at the operating system level, application level or even the network level, thereby accessing several systems over the network.