Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security + Vocab > 1.0 Threats and Vulnerabilities > Flashcards

1.0 Threats and Vulnerabilities Flashcards

1
Q

Social engineering attack where the attacker views what the victim is typing by looking over the victims shoulder or passing by victims.

A

Shoulder Surfing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A social engineering attack that uses a lie or false story to lead one or more people to believe something is true that is very much not true.

A

Hoax

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Type of social engineering attack that targets a group within an organization based on the patterns in a web page

A

Watering Hole Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A type of Social Engineering that takes advantage of two reactions most people have to authoritative sources, such as bosses, VIPs and so on. Fear and respect.

A

Authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Can go hand in hand with authority, where a target can fell intimidated by someone that doesn’t have to be an authoritative figure.

A

Intimidation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

When the attacker tried to be a bit more understanding and nicer to the victim to get whatever they need out of the target.

A

Consensus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Offering the victim or target something that they really want, specifically something that might be difficult to access or obtain.

A

Scarcity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

When people respond to others who like them or take time to know the victim developing a bond with the victim so they can be better at persuading and influencing the victim to get what they want.

A

Familiarity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

An attacker performs an action quickly to make it seem as if it is an urgent request to get what they need from the victim.

A

Urgency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

this involves the MAC (Media Access Control) address of the data being faked.

A

ARP Poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

An attack method in which a daemon caches DNS reply packets, which sometimes contain other information (data used to fill the packets). The extra data can be scanned for information useful in a break-in or man-in-the-middle attack.

A

DNS Poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Registering domains that are similar to those for a known entity but based on a misspelling or typographical error.

A

Domain Hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Client side attack, initiated by the user by inadvertently running a Trojan Horse to grab communication between the client and the server, silently sending data the attacker wants to a third location.

A

Man-in-the Browser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

An attack that captures portions of a session to play back later to convince a host that it is still talking to the original connection.

A

Replay Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Using multiple transparent or opaque layers to trick a user into clicking a button or link on another page when they had intended to click on the top page.

A

Clickjacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The interception of a valid computer session to get authentication information or other sensitive data

A

Session Hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Registering domains that are similar to those for a known entity but based on a misspelling or typographical error.

A

URL Hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A small library that is created to intercept API calls transparently.

A

Shimming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Reprogramming a devices driver’s internals so that the device driver responds to all of the normal inputs and generates all the regular outputs but also generates malicious output.

A

Refactoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

An attack that changes the source MAC Address

A

MAC Spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

An attack that involves looking at repeated results in order to crack the WEP secret key.

A

IV Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

An attack in which a rogue wireless access point poses as a legitimate wireless service provider to intercept information that users transmit.

A

Evil Twin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Purposely obstructing or interfering with a signal.

A

Jamming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

An authentication process that requires the user to do something in order to complete the enrollment process. Examples include pressing a button on the router within a short time period, entering a PIN, or bringing the new device close.

A

WPS

25
Q

The sending of unsolicited messages over a Bluetooth connection.

A

Bluejacking

26
Q

Attack that involves getting data from a Bluetooth device.

A

Bluesnarfing

27
Q

A technology that incorporates the use of electromagnetic coupling in the radio frequency (RF) portion of the spectrum to identify items uniquely (object, animal, person, credit cards, door access tokens, antishoplifting devices, and so on).

A

RFID

28
Q

Technology that enables communication between devices when they’re “touched” together. Often used to verify (often through RFID or Wi-Fi) that the device is present.

A

NFC

29
Q

An attack in which the intruder sends a frame to the AP with a spoofed address to make it look like it came from the victim and disconnects them from the network.

A

Disassociation Attack

30
Q

An attack in which the intruder sends a frame to the AP with a spoofed address to make it look like it came from the victim and disconnects them from the network.

A

Disassociation Attack

31
Q

Password attack stating that for any random group of 23 people, there is a 50% chance 2 of them have the same birthday

A

Birthday Attack

32
Q

A table of precomputed hashes used to guess passwords by searching for the hash of a password.

A

Rainbow Table Attack

33
Q

A password attack that uses a file of words and combinations. The attack tries every entry within the file when trying to guess the password.

A

Dictionary Attack

34
Q

A password attack that attempts to guess a password ,

A

Brute Force Attack

35
Q

When two different inputs into a cryptographic hash produce the same output, this is known as a collision.

A

Collision

36
Q

An attack that forces a system to downgrade its security.

A

Downgrade

37
Q

An attack that forces a system to downgrade its security.

A

Downgrade

38
Q

An attacker with very minimal skills.

A

Script Kiddies

39
Q

Attacker who launches attacks as a part of an activist movement or to further a cause.

A

Hacktivist

40
Q

Any sophisticated series of related attacks taking place over an extended period of time.

A

APT

41
Q

Anyone who has legitimate access to an organizations internal resources.

A

Insiders

42
Q

Anyone who has legitimate access to an organizations internal resources.

A

Insiders

43
Q

An information gathering technique in penetration testing where the pentester uses tools and techniques that may or may not avoid detection, but puts the attacker at risk.

A

Active Reconnaissance

44
Q

An information gathering technique in penetration testing where the pentester uses tools and techniques that make detection of activity difficult. The information is gathered without the targets knowledge and usually consists of open, available, and legal to acquire sources.

A

Passive Reconnaissance

45
Q

A step in pen-testing where the tester uses additional tools to gain additional information on the exploited computer or on the network

A

Pivot

46
Q

Type of Pen-test, where the tester has no knowledge of the environment prior to starting the test.

A

Black Box Testing

47
Q

Type of Pen-test, where the tester has some knowledge of the environment prior to the test.

A

Gray Box Testing

48
Q

A type of Pen-test where the tester has full knowledge of the environment prior to starting the test.

A

White Box Testing

49
Q

A method of testing targeted systems to determine if vulnerabilities can be exploited. This type of test is intrusive.

A

Penetration Testing

50
Q

Identifying specific vulnerabilities in your network. This type of scan is passive.

A

Vulnerability Scan

51
Q

An event that should be flagged but isn’t.

A

False Negative

52
Q

A flagged event that isn’t really an event and has been falsely triggered.

A

False Positive

53
Q

Operating system in a device, sometimes on a single chip.

A

Embedded System

54
Q

An application flaw that consumes memory without releasing it.

A

Memory Leak

55
Q

Putting too much information into too small of a space that has been set aside for numbers.

A

Integer Overflow

56
Q

Type of injection that injects Dynamic Link Library into memory and runs it. Attackers rewrite the DLL, inserting malicious code.

A

DLL Injection

57
Q

Denies users the capability of to address theses important issues, creating serious vulnerabilities.

A

Lack of Vendor Support

58
Q

A vulnerability that occurs when an organization has more systems than it needs, and systems it owns are underutilized.

A

System Sprawl

Security + Vocab (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions