OS202
Breach of confidentiality
This type of violation involves unauthorizedreading of data (or theft of information).
Typically, a breach of conidentiality is the goal of an intruder. Capturing secret data from a system or
a data stream, such as credit-card information or identity information for
identity theft, or unreleased movies or scripts, can result directly in money
for the intruder and embarrassment for the hacked institution.
Breach of integrity
This violation involves unauthorized modiication of data.
Such attacks can, for example, result in passing of liability to
an innocent party or modiication of the source code of an important
commercial or open-source application.
Breachof availability
This violationinvolves unauthorized destruction of data.
Some attackers would rather wreak havoc and get status or bragging
rights than gain inancially. Website defacement is a common example of this type of security breach.
Theft of service
This violation involves unauthorized use of resources.
For example, an intruder (or intrusion program) may install a daemon on a systemthat acts as a ile server.
Denial of service (DOS)
This violation involves preventing legitimate use of the system.
Denial-of-service (DOS) attacks are sometimes accidental.
The original Internet wormturned into a DOS attack when a bug failed to delay its rapid spread.
Permissive
Permissive licenses place minimal restrictions on software users.
Often they only require that the original creators are attributed in any distribution or derivative of the software or source code.
Masquerading
one participant in a communication pretends to be someone else (another host or another person).
By masquerading, attackers breach authentication, the correctness of identiication;
they can then gain access that they would not normally be allowed.
Replay Attack
A replay attack consists of the malicious or fraudulent repeat of a valid data transmission.
Sometimes the replay comprises the entire attack—for example,
in a repeat of a request to transfer money. But frequently it is done along with message modificatio , in which the attacker changes data in a communication without the sender’s knowledge.
Man-In-The-Middle Attack
An attacker sits in the data low of a communication, masquerading as the sender to the receiver, and vice versa. In a network communication,
a man-in-the-middle attack may be preceded by a session hijacking, in which an active communication session is intercepted.
Privilage Escalation
Privilege escalation gives attackers more privileges than they are supposed to have.
For example, an email containing a script or macro that is executed exceeds the email sender’s privileges.
Masquerading and message modiication, mentioned above, are often done to escalate privileges.