1.2 Flashcards
Most common network attacks are?
Reconnaissance attacks, access attacks, Denial of Service, Distributed Denial of Service attacks
What are reconnaissance attacks are trying to do?
Attempt to gather information about the victim before launching an attack, example use cdp, whois, ping sweeps etc.
Explain social engineering
In an attack that tries to use people to do thing or spill info
social engineering - phishing
a message with a link that goes to a dodgy site but looks legit
social engineering - spear phishing
targeted phishing attack for an person/organzation
social engineering - whaling
targeted emails for top execs
social engineering - pharming
used to direct a customers url from a valid resource to a malicious one that could be made to appear as the valid site to the user.
social engineering - smishing
attack through a text
social engineering - vishing
attack through phone
social engineering - baiting
leaving an infected device lying around
What is privilege escalation
process of taking some leve of access and achieving an even greater level of access to a router and then uses a brute-force attack against the router
What are back doors?
When attackers gain access to a system they usually want future access. a backdoor application can be installed to either allow future access or to collect information to use in further attacks.
How can backdoors be installed?
by users clicking something without realizing the link they click or the files they open is a threat. Can also be implemented as a result of a virus or worm.
6 types of access attacks
Password, Trust exploitation, port redrection, mitm, buffer overflow, ip, mac, dhcp spoofing
what is a convert channel?
effective mechanism for sending and receiving information data between machines without alerting any firewalls. Die Daten unter einem anderen Protokoll verkleiden.
How to get a password? And which type of attack?
Trying to get ciritical passwords using methods like social engineering or brute force etc. Access attack
What is trust exploitation? which type of attack?
using unauthorized privileges to gain access to a system. access attack
What is MITM? which type of attack?
Man in the middle, when the attacker places themselves in the middle of 2 devices in order to eavesdrop or manipulate date, access attack
What is buffer overflow? which type of attack?
causing the buffer to overflow and crashing the system, leading to a DoS attack
What is ip, mac, dhcp spoofing? which type of attack?
an attack that makes it look like it is coming from the source - using a rogue dhcp server to respond to requests or exhausting the genuine server’s pool. access attack
What are Dos and DDoS attack attempt to do?
They try to consume all of a computers critical resources in order to make it unavailable for use.
From which source is DDoS? And what can this attack use?
DDoS is an attack from all sources and can use reflection and amplification.
What is reflection and amplification in combination with DDoS?
Reflection is when the attacker send a flood of protocol requests packets to various ip host, while amplification a small forged attacked gets a big reply from reflectors, called the avalanche effect.
DDoS - ping of death?
sending a malicious ping to a computer causing a crash - not done anymore
DDoS - Smurf attacks?
sending lots of icmp packets to the broadcast addresss of a big network cantaining the victims ip address as source and every host will replay back to that address - not done anymore
DDoS - tcp syn flood attack?
exploits te 3 way handshake by sending loads of syn packets with random source addresses to a victim, forcing it to wait for acks that will never arrive, leaving half open connections
Defenses against social engineering are?
password mgmt, 2 factor authentication, antivirus/phishing, change mgmt, info handling and classification
What is password management?
make rules on password change and format
what is 2 factor authentication?
mixing what a user has and something they know to gain access
what is antivirus/phishing?
host and network based filtering systems
what is change management?
a process showing how and when changes can be made
what is info handling and classification?
a policy that sets out how info can be handled and destroyed
malware - what is a virus?
a code that is attached to exe files that require user interaction to propogate
what is a trojan horse?
malware that looks genuine but is mailicous and creates a back door into the infected system. needs user interaction
what are worms?
they are like viruses but doesn’t need user interaction to reproduce - it also makes functional copies of itself
describe vectors of data loss/exfiltration
It is when data is leaked somehow to the outside word intentionally or not
vectors of data loss/exfiltration are:
email attachments, unencrypted devices, cloud storage, removable media, hard copy
