电脑攻击与防御TheAttackandDefenseofComputersDr.许.pptVIP

電腦攻擊與防禦 The Attack and Defense of Computers Dr. 許 富 皓 Virus [Internet Security Professional Reference ] Virus A sequence of code that is inserted into other programs. A virus can create a copy of itself to inserted in one or more other programs. Virus cannot run on their own, and need to have some host program. e.g. Melissa virus, ILOVEYOU virus. Virus Boot sector viruses Master boot record viruses File infector viruses Multi-partite viruses Macro viruses (infect data files) Floppy Disks Hard Disks Disk Structures Units used in Floppy Disks and Hard Disks: Sectors E.g. A 3 ? inch high-density disk 512 bytes/sector 18 sectors/track 40 tracks/side Cluster Disk space allocation unit Each cluster contains one or more sectors. Tracks Heads Cylinder (for HDs) Floppy Disk Structure Disk Sectors Hard Disk Structure Areas of a Disk Under DOS, A disk is divided into the following four areas: The boot record. The file allocation table (FAT). The root directory. The data area. A hard drive has a fifth area: The partition table. Boot Record Boot Record: Location: sector 1, track 0, head 0. Contents: the bootstrap routine (a machine language program designed to load the operating system from other part of the disk.) the BIOS Parameter Block (BPB), which identifies the floppy disk’s operating parameters, including the number of bytes per sector, sectors per cluster and track, and tracks per disk. The BPB allows an operating system to understand the format of a disk. The Bootstrap Program In a PC, when a machine is turned on, a routine called “The Power-On Self Test (POST)” verifies all hardware components are working properly. After everything is confirmed working well, POST loads up the boot record from the disk and checks for two signature bytes inside it. If the boot record signature is present, the execution control is transferred to the bootstrap program inside the boot record. Under DOS, the bootstrap program in turn loads the OS into the RAM from the disk