In the development of information security, cyber attacks have become much more organized and refined. Elaborately planned cyber attacks have taken the place of large-scale attacks, and using malicious software to infect victims' computers is the most common method of carrying out cyber attacks.
Botnets are currently the most severe information security threat, and advanced persistent threat (APT) is the most popular information security issue. During targeted attacks, hackers usually steal information or launch large-scale attacks using Botnets. Once the targets are chosen, hackers carry out long-term and persistent attacks using various methods. Many hacked computers unconsciously participate in attacks launched by hackers. Malicious software used by Botnets is often customized based on weaknesses in the targeted computers. These “special” purpose malicious programs are extremely hard to detect in their latent or infected phase. Unless the behavior and patterns of such malicious programs are known in advance, it is hard to detect them using signature comparisons. Also, once a system is infected, it is difficult for anti-virus software to detect and remove the malicious programs due to their rapid mutation.
(Fig. Botnet Infection Map)
In order to penetrate the firewall defenses, most Botnets use protocols and ports allowed by the firewalls. This approach has changed the conventional information security defense mechanism. In the past, the internal networks were seen as relatively high security networks and external networks were seen as relatively low security ones. Default settings of access control allow computers in higher security networks to link to lower security networks, so that infected computers have free access through information security defenses such as firewalls. This is one of the reasons that Botnets are able to spread on such a large scale.
Commonly used Botnet protocols include http, ftp, tftp, and irc; all of which are widely used by applications. When Botnets use these protocols to communicate, they often go undetected by the webmaster or Botnet-infected systems, especially when the Botnet is in its latent phase and only maintains minimum communication with the intermediate node or the hacker’s control platform(C&C, Command and Control). This communication behavior cannot be effectively controlled using conventional network activity statistics.
The main difference between Botnets and computer viruses, Trojan horses, and Internet worms, is that Botnets not only affect computer systems, but also achieve more effective management through intermediate nodes or central control stations. Infected bots (i.e. infected computers) actively link to these intermediate nodes or central control stations and wait for commands. Once they receive a command to attack, bots are able to launch malicious attacks very quickly. This is different from conventional attacks in which the attacker must send commands individually to the hacked computers located in different areas. Botnets can not only achieve more efficient management of infection, but also launch targeted attacks within a relatively short period of time.
Currently, most underground economic activities are conducted in coordination with Botnets (e.g. stealing personal information, stealing website accounts and passwords, capturing keyboard input using screen loggers, or participating in malicious attacks using Botnets). The malware’s mutation tools used to spread its source codes are very difficult to detect. Additionally, the development of information convergence and digital economics, and the increase of cloud technologies and mobile commerce, also brings with it additional information security protection considerations. In a new environment that utilizes new technologies, mobile and broadband terminals, networks, services, application platforms, data centers, crime investigation, and national security will also face attacks by highly experienced hackers using malicious software.
In 2011, APT was extremely active. The APT is not a new type of attack, rather, it is a combination of several different attack methods in direct response to the targets’ environments. The entire attack process is divided into several stages including data collection and analysis, system and application weakness scanning, Rootkit use, and exploitation of Web Application security weaknesses. Victims of APT include information security equipment and service providers such as RSA Inc. and HBGary, Sony Entertainment Network, Citibank, Google, and VISA Inc.
In addition to the information security equipment and services being hacked, the leaking of client information has also become a major issue. Observing the trend of such attacks, hackers are not only stealing data from typical users’ PCs, but also gaining interests in important and representative targets and planning to launch long-term attacks as well. Through social engineering and web mining and detection, hackers customize their attack methods based on certain targets and these attacks often last several months to a year until their goals have been achieved. The attackers usually use or send network services or documents that seem normal to launch zero-day attacks, but they actually contain malicious programs. The attackers also target unannounced system and application weaknesses, so that the victims are not able to detect the attacks. When Botnets combine with APT, attackers can effectively utilize an immense Botnet to carry out multiple types of attacks simultaneously and use multiple channels to implant malicious software.
We live in a continuously evolving computing and networking environment wherein new applications that have the potential to be hacked are constantly being introduced. New risks are often generated by these new applications. The only way to improve information security is to know the latest developments in information security, understand common attack methods and ways to protect our systems and applications against them, and avoid exposing our systems to unsafe environments in the first place.
在花火節的現場，也可能是最後一天的關係，幾乎可用人山人海來形容。
河豚可愛的模樣常常看到，不過也一直滿好奇的，就是牠怎麼從原來的樣子，變成全身充氣，把身上的刺都張開的模樣，這次參加海釣的活動，船家就當場示範了一下，搖了幾下，果然河豚生氣了。
生氣後的河豚，感覺滿有威脅，如果我是魚的話，可能看到牠變成這樣，也就敬而遠之了，免得被刺到，就得不償失了。
這次帶著小朋友，只能選擇較輕鬆的行程，到海上釣釣魚，雖然釣魚對我來說不是件難事，不過在海上釣魚的經驗倒是屈指可數，這次的行程天氣相當的好，出發的時候，心裏就在想應該有機會釣到魚，果不其然，同行的遊客陸續有收獲，有的還接連一直上勾。
天氣好、氣氛佳，幾乎同船的人都有斬獲，三不五時就聽到有人釣到魚的歡呼聲，可能因為魚群的關係吧，怎麼都是同一種魚呢？
小朋友就像我們的小幫手，拿魚餌、拍照、抓魚等等，每次我們把魚釣上來時，最開心的就是他了。
海上牧場是許多人到澎湖都會體驗的活動，當然這次也不例外，澎湖的「蚵仔」又新鮮又大顆，稍微火烤一下，就可以品嘗海鮮的美味，負責烤「蚵仔」也是小朋友的主要工作，大人在旁邊倒是樂得輕鬆。
許多海上牧場都會準備許多「獵物」讓人試試身手，不過如果真的釣上來，想帶回家可不是免費的喔，但是在價位上個人倒是覺得還可以接受。
