1.2 Compare and contrast different types of attacks Flashcards
Social Engineering
A means of getting users to reveal confidential information. (“Human Hacking”)
Phishing
A combination of social engineering and spoofing. An attacker sets up a spoof website to imitate a target bank or trusted source etc. The attacker emails users of the genuine site requiring a login. Their logon credentials are capture with the spoofed sit.
Spear Phishing
A phishing scam where the attacker has some information that makes an individual target more likely to be fooled.
Whaling
A spear phishing attack directed specifically against upper levels of management.
Vishing
Phishing attack conducted through a voice channel.
Tailgaiting
Entering a secure are by following close behind a person that has access.
Impersonation
Pretending to be someone else.
Dumpster Diving
Combing through an organization’s garbage to try to find useful documents.
Shoulder Surfing
Stealing a password or PIN by watching a user type it.
Hoax
An email alert or web pop-up will claim to have identified some sort of problem and offer a tool to fix it. The tool will be some sort of Trojan.
Watering Hole Attack
Relies on a group of targets using an unsecure third party website.
DoS
Denial of Service attack causes a service at a given host to fail or become unavailable. Ex. overloading a service by using up CPU, system RAM, disk space, or network bandwidth. The attack may be motivated by a desire to cause trouble. Or it may be a precursor to a MitM or data exfiltration attack.
Man-in-the-middle
An attacker sits between two communicating hosts, and transparently captures, monitors, and relays all communication between the hosts. MitM attacks can be defeated using mutual authentication, where both server and client exchange secure credentials.
Buffer Overflow
To exploit a buffer overflow vulnerability, the attacker passes data that deliberately overfills the buffer (an area of memory) that the app reserves to store the expected data.
Injection
The attacker embeds code within the input or appends code to it that executes when the server processed the submission
Cross-site scripting
An input validation exploit. An attacker crafts a URL to perform code injection on a trusted site with an input validation vulnerability. When the user clicks the link, malicious code executes.
ARP Poisoning
An attack that works by broadcasting unsolicited ARP reply packets. Because ARP in an antiquated protocol with no security. The receiving devices trust this communication and update their MAC:IP address cache table with the spoofed address.
The attacker’s spoof MAC address will receive all messages directed at the legitimate user. MiTM attack.
Amplification
An adversary spoofs the victim’s IP address and attempts to open connections with multiple servers. Those servers direct their SYN/ACK responses to the victim server. This rapidly consumes the victims bandwidth.
DNS Poisoning
A redirection attack that aims to corrupt the records held by the DNS (Domain Name Systems) server. The intention is to redirect traffic for a a legitimate domain to a malicious IP address.
Links names to IP addresses.
Domain Hijacking
An adversary gains control over the registration of a domain name, allowing the host records to be configured to IP addresses of the attacker’s choosing.
Zero Day
Vulnerability that is exploited before a developer knows about it.
Pass the Hash
Network based attack where the attacker steals hashed user credentials and uses them as-is to try to authenticate to a network.
IV
(Initialization Vector) A technique used in cryptography to generate random numbers to be used along with a secret key to provide data encryption.
In the case of a IV attack the adversary is able to predict the IV, thus giving them access to encrypted data.
Rogue AP
An unauthorized installation on a network which allows an attacker to connect to the network.
