|
BTS INFORMATIQUE DE GESTION SESSION 2006 Option « Développeur d'applications" Langue anglaise appliquée à l'informatique et à la gestion Durée : 2 heures Coefficient : 2 Matériel autorisé : dictionnaire bilingue L'usage des calculatrices n'est pas autorisé pour cette épreuve
IN FOCUS : PHISHING AND PHARMING 1 You've undoubtedly heard of "phishing," luring users (typically through email messages) to phony Web sites that imitate legitimate Web sites to try to trick users into divulging private information such as logon IDs, passwords, and account numbers. Phishing can lead to unauthorized monetary charges against your merchant accounts, unauthorized use of your services, and more. 2 Tools such as CoreStreet's SpoofStick and the Netcraft Toolbar can help in some cases. Both tools are add-ons for Microsoft Internet Explorer (IE) and Mozilla Firefox that try to determine and display the real domain of the site you're visiting. 3 Recently, hackers are combining phishing with DNS poisoning or DNS hijacking – also known as "pharming." In a pharming attack, the attacker changes DNS records of the servers at an ISP or at the company that's the target of the attack or modifies a client system's HOSTS file or DNS settings. Obviously, protecting against such attacks means devising some method of establishing trust in DNS query results. The two tools I mentioned above don't help much against pharming. 4 I know of three ways to help prevent pharming attacks. The first method is for a company to use a service, such as one recently announced by MarkMonitor, to monitor the company's DNS servers for unauthorized changes. When unauthorized changes are detected, MarkMonitor alerts the company so that it can begin working to correct the situation. 5 A second method, which is also new, is to use Next Generation Security's (NGSEC's) AntiPharming tool, which works at the client level (rather than the server level) to prevent unauthorized changes to a system's HOSTS file and local DNS settings. It also listens on the system's network interfaces to capture DNS query responses and then doublechecks those responses against "three secure DNS servers". The tool comes with three DNS servers preconfigured, and you can modify those server addresses as you see fit. The tool is available free for personal use and requires a fee for commmercial use. 6 Another new solution, Identity Cues from Green Armor Solutions, works at the Web site level. The first time a user logs on to an Identity Cues-protected Web site, the product generates colored visual cues that will the appear each time the user logs on to the site. A spoofed Web site won't be able to generate the same cues, so a user sent to a spoofed site will immediately know that he or she isn't visiting the legitimate Web site. Identity Cues is definitely a novel concept. 7 All three approaches sound like good ideas and would go a long way towards thwarting phishing and pharming. I suspect that there are other ways to help prevent pharming, but at this point I'm unaware of any other solutions. If you know of any, please send me an email message that fills me in on the details. "Security : Phishing and Pharming," Windows IT Pro Magazine, June 22, 2005
QUESTIONS Indiquez le nombre de mots contenus dans vos réponses pour chacune des deux parties. 1re PARTIE – RÉSUMÉ (12 points) Résumer ce texte en français en 150 mots (+/-10%). 2e PARTIE – EXPRESSION ÉCRITE (8 points) Vous traiterez en anglais les deux sujets ci-dessous. A - You meet the German teenager who hijacked eBay.de Domain Name in 2004. Write a conversation relating the event. You will insist on the following clues: B - Write a notice from a bank to clients warning against the dangers of phishing. (50 mots +/- 10%) (3 points) NDLR : La formulation des questions laisse à désirer. Pour la fin de la question A, nous proposons « Imagine the conversation you could have had with him, focussing on the following points: 1/ his reasons for breaking the law, 2/ The procedures he used. » Pour la question B, nous proposons « Write a note warning a bank's clients about the danger of phishing attacks. » Corrigé du résumé Corrigé de la question A Corrigé de la question B home tech voc general voc grammar EtoF FtoE exam papers texts pronunciation methods franglais dictionaries publications Q&A links © Christian Lassure - English For Techies |
