1.2 - Given a scenario, analyze potential indicators to determine the type of attack.

Question 1

Malware

Answer 1

• malicious software
• harms usrs comp/data
• targets info stored on local comps + other resources/comps
• takes advantage of weaknesses/system vulnerabilties -> makes it more dangerous + enables spreading more effectively
• gathers info (keystrokes)
• viruses + worms

Question 2

Ransomware + protection

Answer 2

• malware that takes over comp. + demands ransom
• perps want ur $, will take ur comp. in the meantime
• could be a false ransom
  -> locks ur comp. “by the police”
• ransom may be avoided
• security professional might be able to remove these kinds of malware

Protection
- ALWAYS have a backup, ideally an offline backup
- Keep OS up to date
-> patch vulnerabilities
- Keep apps up to date
-> security patches
- Keep antivirus + antimalware signatures up to date
- Keep everything up to date

Question 3

Trojans

Answer 3

• malware disguised as legit software
• rely on unsupecting ppl running them -> provides perp with path into sys./device
• software designed to be something else (typically hidden)
• capture/conquer ur comp. free reign once inside
• can open gates 4 other programs
• can perform actions wthout usrs knowledge/consent
• can collect + send data causing comp. to malfunction
• don’t replicate themselves like viruses do
• circumvent existing sec.
• often classified by payload/function

Most common
- backdoor
- downloader
- infostealer
- keylogger

Question 4

PUPs (Potentially unwanted programs)

Answer 4

• typically installed wthout user knowing
• identified by antivirus/anti-malware
• potentially undesirable software
• often installed along with other software
• overly aggressive toolbar
• backup utility that displays ads
• browser search engine hijacker
• includes spyware, browser toolbars, web browser tracking, adware, dialers

Symptoms
- can slow down system, etc.

Detection/Removal
- antivirus/antimalware tools

Mitigation
- limit usr rights 2 prevent software installs
-limit what software can be installed
awareness
- best practices

Question 5

Command and control

Answer 5

• botnet contacts central control system -> provides commands + updates + tracks how many sys. r in botnet
• mechanism by which malicious software communicates with remote server/controller
• allows perps to send instructions to malware on infected comp.
• these servers are essential for managing/maintaing control over compromised systems

Question 6

Bots + infection + prevention

Answer 6

• automated comp. program
• doesn’t need usr interaction
• outside sources can control
• ur machine becomes a bot once infected
• sits around -> checks in with command + control server -> waits for instructions

Infected via
- trojan horse
- OS/app vulnerability
- port left open
- unpatched vulnerability

Prevention
- OS/app patches
- antivirus/antimalware
- updated signatures
- identifying existing infection
-> on demand scans
-> network monitoring
- prevent command + control
-> block at firewall
-> identify at workstation with host based firewall/host based IPs

Question 7

Cryptomalware

Answer 7

• newer gen. of ransomware
• data unavailable until u provide the $
• malware encrypts ur data files BUT ur OS remains available
  -> want u running but not working
• pay to obtain decryption key
  -> untraceable payment system
  -> unfortunate use of public key cryptography

Question 8

Logic bombs + prevention

Answer 8

• virus/trojan horse
• executes malicious actions when certain event occurs OR after certain period of time
• time bomb (time or date)
• user event (logic bomb)
• difficult to identify

Prevention
- process + procedures
-> formal change control
- electronic monitoring
-> alert on changes
-> host based intrusion detection
- constant auditing
-> admin can circumvent existing systems

Question 9

Spyware + detection + protection

Answer 9

• malware spies on you
• can change comps config without consent
• software communicates info from users system to another party without user knowing
• EX: advertising, identify theft, etc
• EX: browser monitoring, surfing habits, keyloggers

Detection
- slow system
- windows desktop slow coming up
- clicking link doesn’t do anything/takes you to unexpected website
- browser homepage changes (might not be able to reset it)
- webpages automatically added to your favorites list

Protection (adware + spyware)
- know what ur installing
- maintain antivirus/antimalware, always have latest signatures
- have a backup
- malwarebytes (run scans)

Question 10

Keylogger trojans

Answer 10

• monitors + sends keystrokes from infected comp.
• EX: passwords, CC #s, messages

Question 11

RAT (remote access Trojan) + protection

Answer 11

• provide perp with remote access to sys.
  -allow perp to take control of systems remotely
• install without usrs knowledge
• remote admin tool -> ultimate backdoor
• malware installs server/service/host and perp connects with client software
  -identifying if it’s legit remote support tool or not is difficult
  -may cause false positives
• EX: key logging, screen recording, screenshots, copy files, embed more malware, etc.

Protection
- DON’T run/download unknown software
- ALWAYS consider the consequences
- Keep antivirus/anti-malware signatures up to date
- ALWAYS have a backup
-security awareness
-antimalware

Question 12

Rootkit + detection + removal

Answer 12

• software that can be installed/hidden
  -designed to allow perps to access a sys. thru backdoor
• can be part of software packages, installed thru unpatched vulnerabilities, downloaded/installed by usrs
• compromise system + gain elevated privileges
• can lead to compromising other devices on network
• programs that view traffic/keystrokes + alter existing files to escape detection/create system backdoor
• modifies core system files
• might be invisible to OS, antivirus software b/c it can run in background
• use encryption to protect outbound comms. + piggyback commonly used ports to communicate without interrupting apps

Detection
- look at memory processes
- monitor outbound comms.
- check for newly installed software
- antimalware scans
-detection tools look for behaviors + signatures typical of rootkits
-integrity checking
-data validation

Removing
- use remover specific to toolkit
- secureboot with UEFI (bios)
- have to remove toolkit AND malware rootkit is using

Question 13

Backdoor

Answer 13

• provide access that bypasses normal authentication/authorization procedures
  -not malicious on own
• app code functions devs create intentionally/unintentionally
• shortcut entry point added to allow rapid code eval/testing during app development
• can allow perp unauthorized access if they’re not removed b4 app deployment

Detection
-check 4 unexpected open ports + services

Question 14

Password attacks

Answer 14

• two categories
  -> online attack
  -> offline attack

Question 15

Spraying attack + detection

password attacks

Answer 15

• try to log in wth incorrect pswd
  -> eventually locked out
• attack acct wth top 3+ pswds
  -> move on to next acct if they don’t work
  -> no lockouts, alarms, or alerts
  slow approach

Detection
- single failed log in across multiple accts at same time

Question 16

Dictionary attacks + prevention

password attacks

Answer 16

• trying every word in dict. to gain access to system
• common word lists available on the net + can sometimes be customized by language/line of work
• pswd crackers can substitute letters (p&ssw0rd)
• takes time
• discover pswds for common words
  -> won’t discover ones wth random character pswds
• can use dif. custom dicts.
  -> list could have 1234 and abcde
• most successful on simple pswds b/c attack tries each word in list

Prevention
- “password” is easily compromised
-> changing “o” to numeral “0” + changing “a” to “@” could thwart attack

Question 17

Brute force attacks + online + offline

password attacks

Answer 17

• tries every possible pswd combo until it matches hash
• relies on cryptanalysis or hashing alg.
• could take time b/c strong hasing alg. slows things down
• cracks short pswds faster than dict. attacks

Online
- keep trying login process
- slow
- most accts lockout after certain # of failed attempts

Offline
- obtain list of usrs + hashes
- calculate pswd hash + compare to stored hash
- large computational resources
- attempts to exhaust all possible combos

Question 18

Offline attacks

password attacks

Answer 18

• convenient b/c can iterate thru dif. methods + countless attempts
• perp has access to material independant of source system
• EX: encrypted password database might have been downloaded
• less risky for perp
  -> perp has opportunity to circumvent control wthout detection

Question 19

Online attacks + detection + prevention

password attacks

Answer 19

• occurs while connected to a system
• EX: automated/manual attack against ur web based email acct
  -> attacker tries logging in with ur username/pswd

Detection
- usrs getting locked out of their accts

Prevention
- security best practices can help avoid
- EX: locking accts after several failed attempts

Question 20

Rainbow table

password attacks

Answer 20

• optimized prebuilt set of hashes (doesn’t have to contain every hash)
• saves time + storage space
• contain precalculated hash chains
• speed increase, especially wth longer pswd lengths
• need dif. tables for dif. hashing methods
  -> windows dif. than MySQL
• can occur offline, perp only has to search against required pswd hashes

Question 21

Plaintext/unencrypted

Answer 21

• pswds shouldn’t be unencrypted in plaintext b/c easy to compromise
• some apps store pswds unencrypted “in the clear”
• -> u can read pswrd stored
• anyone with access to pswd file/database has every cred.
• get a better app if it saves pswd as plaintext

Question 22

Physical attacks

Answer 22

• opportunities for attacks, often thru use of or on peripheral devices

Question 23

Malicious USB cable + prevention

Physical attacks

Answer 23

• looks like normal one BUT has additional electronics inside
• OS identifies it as a HID (human interface card)
  -> looks like you’ve connected keyboard/mouse
  -> keyboard doesn’t need extra rights/permissions
• cable takes over once connected
  -> downloads/installs malicious software

Prevention
- don’t plug in just any USB cable
- ALWAYS use trusted hardware

Question 24

Malicious flash drive + prevention

Physical attacks

Answer 24

• could act as HID (human interface card)/keyboard
  -> start command prompt + type anything without ur intervention
• perp can load malware in docs
• can be configured as boot device, then infects comp. after reboot
• acts as ethernet adapter
  -> redirects/modifies internet traffic requests
  -> acts as wireless gateway for other devices

Prevention
- NEVER connect an untrusted USB device

Question 25

Card cloning | Physical attacks

Answer 25

- creates duplicate of a card -> looks/feels like OG -> often includes printed CVC (card validation code) - get card details from skimmer b/c clone needs an original - can only be used with magnetic stripe cards -> b/c chip can't be cloned - cloned gift cards r common

Question 26

Skimming + prevention | Physical attacks

Answer 26

- stealing CC info, usually during normal transaction -> copy data from magnetic stripe (card #, expiration date, card holders name) - perp uses CC info for other financial transactions - fraud is responsibility of the seller - ATM skimming = includes small camera to watch for ur pin Prevention - ALWAYS check before using card readers

Question 27

Adversarial AI

Question 28

Tainted/poisoning training data for machine learning (ML) | Adversarial AI

Answer 28

- confuse A.I. - perps send modified training data which causes AI to behave incorrectly Mitigation - understand quality + security of source data - ensure developers r working in secure environ. - ensure data sources, sys, tools r maintained in secure manner - ensure changes to algs. = reviewed, tested, documented - encourage reviews

Question 29

Machine learning | Adversarial AI

Answer 29

- modify themselves as they evolve to become better at task they're set to accomplish - identifies patterns in data -> improves predictions - requires lots of training data - EX: stop spam, movie choices, etc.

Question 30

Security of machine learning algorithms | Adversarial AI

Answer 30

- check training data -> cross check + verify - constantly retrain with new data - train AI with possible poisoning -> what would the perp try to do?

Question 31

Evasion attacks | Adversarial AI

Answer 31

- AI only as good as its training -> perps find holes + limitations - AI that knows spam could be fooled by dif. approach - AI that uses real world info can release confidential info

Question 32

Supply chain attacks + protection

Answer 32

- many moving parts -> suppliers, manufacturers, etc - perps may infect any step without suspicion - one exploit can infect the entire chain Protection - use small supplier base -> tighter control on vendors - strict control over policies + procedures -> ensure proper security in place - security should be part of design (limit to trust)

Question 33

Cloud-based vs. on-premises attacks

Answer 33

Cloud based - centralized - costs less - no dedicated hardware - no data to secure - 3rd party handles everything On-premises - security burden on the client - data center security + infra costs - perps want ur data, don't care where it is

Question 34

Cloud-based attack security

Answer 34

- data in secure environment -> no physical access to DC -> 3rd party might have access to data - cloud providers r managing large scale sec. -> automated signature + sec. updates -> usrs must follow sec. best practices - limited downtime -> extensive fault tolerance (24/7/365 monitoring) - scalable sec. options -> one click sec. deployments -> may not be as customizable as necessary

Question 35

On-premises attack security

Answer 35

- customize ur sec. posture -> full control when everything is in house - onsite IT team can manage sec. better - local team (LT) ensures everything = secure -> LT can be expensive + difficult to staff -> LT maintains uptime + availability -> system checks can occur at anytime -> no phone call for support -> security changes can take time (new equipment, configs, additional costs)

Question 36

Cryptographic attacks | Cryptographic attacks

Answer 36

- perp doesn't have the combo (key) -> so they break the safe (cryptography) - finding ways to undo the security -> many potential cryptographic shortcomings -> problem is often implementation

Question 37

Birthday attacks + protection | Cryptographic attacks

Answer 37

- perp generates multiple versions of plaintext to match hashes - EX: classroom of 23 students, what's the chance of 2 students sharing same birthday? It's about 50% -> in digital world the example above is a **hash collision** -> hash collision = same hash value for 2 dif. plaintexts -> find collision thru brute force Protection - protect urself with large hash output size

Question 38

Collisions | Cryptographic attacks

Answer 38

- hash digests supposed to be unique - dif. input data should never create same hash

Question 39

Downgrade attacks + prevention | Cryptographic attacks

Answer 39

- force systems to downgrade their security - result of sec. configs. not being upgraded - if server allows negotiation to downgrade to a lesser version, connection = susceptible to further attacks Prevention - update shit

Question 40

Resident virus

Answer 40

- in memory. to reside in mem. usually needs to be called up from type of storage **WHEREAS Fileless viruses don't** - loaded each time system starts - may infect other areas based on certain actions - remain active after host program is terminated

Question 41

Non-resident virus

Answer 41

- looks for targets locally + across network when executed - infects those areas then exits - **doesn't remain active (unlike Resident viruses)**

Question 42

Macro viruses

Answer 42

- MS office apps ability to automate procedures - MS office macros = r written in VBA (visual basic for apps) - malware has opportunity to automatically generate instructions when docs launched - uses macro language + executes when doc. opens - office software offers option to generate alerts when they launch Linux - perps may leverage languages/tools (python, perl, bash) - can be used 2 create peristent remote access using bind OR reverse shells Prevention - educate usrs - provide scanning of office docs received by org. via email, etc

Question 43

Boot sector virus

Answer 43

- placed in 1st hard drive sector - when computer boots the virus loads into memory - loads b4 OS even starts - were more prevalent wth floppy disks

Question 44

Fileless virus

Answer 44

- stealth attack - good at avoiding antivirus detection **- operates in mem. BUT never installed in file or app. ** - uses legit tools that r often part of the OS/development packages -> EX: powershell, windows management, macros. **- doesn't require virus components to be written to disk unlike mem. resident viruses**

Question 45

Program infecting virus

Answer 45

- infects executable program files - become active in memory - seeks out other files to infect - easily identified by binary pattern or signature

Question 46

Polymorphic virus

Answer 46

- can change form/signature each time executed to avoid detection - malicious code capable of changing shape - detection = difficult wthout identifiable pattern or signature to match

Question 47

Armored virus

Answer 47

- aims to make detection difficult - difficult to analyze functions **- seeks to defeat heauristic countermeasures ** - tries to prevent disassembly + debugging + analysis

Question 48

Stealth virus

Answer 48

- memory resident virus - uses techniques to avoid detection -> EX: temporariliy removing itself from infected file or masking file size

Question 49

Multipartite virus

Answer 49

- infects executable files - attacks master boot record of the system - if boot sector isn't cleaned wth infected files, the files can easily be infected again

Question 50

Heuristic scanning

Answer 50

- examines instructions running within a program instead of looking for specific signature

Question 51

Malware types + methods

Answer 51

- viruses - cyrptomalware - ransomeware - worms - trojan horse - rootkit - keylogger - adware/spyware - botnet

Question 52

Endpoint protection technologies + symptoms

Answer 52

- first line of defense - defends against malware - identifies + remediates sec. threats - identifies machine that's been targeted/compromised Symptoms - unexpected system behavior - system instability

Question 53

What should you examine to determine if systems is infected (MRM)?

Answer 53

Memory - might reside in mem. after execution - windows task manager + activity monitor -> provides insight into running processes + helps identify rogue processes Registries - provides various system settings malware often targets (windows) - entries enable software to automatically start at login - malware takes advantage of entries -> ensures malicious executables run each time comp. is set up Macros - MS office apps ability to automate procedures - gives malware opportunity to automatically generate instructions when docs launch - office software offers option to generate alerts when they launch

Question 54

How do people get malware? Protection?

Answer 54

- worm takes advantage of vulnerability - malware installed includes remote access backdoor - bot can be installed later - comp. has to run a program Protection - don't click email links, pop-ups - keep os updated - keep apps updated/check with publisher

Question 55

Virus and protection

Answer 55

- program/code runs on comp. wthout usrs knowledge/consent - attaches to other code + replicates when infected file executes/launches - needs u to execute program, just running program can spread it - many can replicate across networks + bypass sec. systems - may or may not cause problems (some r invisible) Protection - antivirus = common - make sure signature file is updated

Question 56

Worms + mitigation

Answer 56

**- similar function/behavior to viruses EXCEPT that worms are self replicating + don't need a host file -spread themselves -self install - don't need to attach to files/programs -> capable of reproducing on its own (key difference to virus)** - takes advantage of sec. hole in app or OS - finds other systems running same software then replicates to new host - repeating process - doesn't need usr interaction - checks for internet connection + if it has it then tries to replicate (network = how it transmits) - EX: spread via email attachments, net. file shares, over internet Mitigation - firewalls - IDS/IPS - but doesn't help much once worm is inside

Question 57

Backdoor trojans

Answer 57

- opens entry into system for access later - placed through malware - some software includes backdoor - bad software can have it as part of app

Question 58

Downloader trojans

Answer 58

- downloads additional malicious software onto infected systems - acts as gateways for other malware once installed

Question 59

Infostealer trojans

Answer 59

- attempts to steal info from infected machine - typically employs key logging , screen capturing, data scraping techniques - EX: login creds, browsing history, etc

Question 60

Adware + protection

Answer 60

- gives advertisers online way to make a sale - can cause performance issues - form of spyware - can be included with other software - software on ur system sending info about u + ur surfing habits to remote location - only legitimate when user is informed Protection (adware + spyware) - know what ur installing - maintain antivirus/antimalware, always have latest signatures - have a backup - malwarebytes (run scans)

Question 61

Botnets + prevention

Answer 61

- zombie army - large # of comp. that forwards transmissions to other comps. on internet - group of bots working together - can be programmed to conduct DDoS attacks, distribute spam, etc. (relay spam, proxy network traffic) - securely hidden - can perform tasks, gather info, commit crimes undetected Detection -analysis of bot traffic using net. monitoring tools (IPSs + IDSs) -antivirus tools -antimalware tools -endpoint detection response tools Prevention - OS/app patches - antivirus/antimalware - updated signatures - identifying existing infection -> on demand scans -> network monitoring - prevent command + control -> block at firewall -> identify at workstation with host based firewall/host based IPs

Question 62

hash/hashing

Answer 62

- one way function -> can't turn hashed value into pswd - pswds commonly stored this way - if u hash a pswd u can compare output to prev. hashed pswd - represents data as fixed length string of text (fingerprint) - no collision -> dif. inputs won't have same hash - impossible to recover orig. message from the digest - unreadable database of pswds

Question 63

Hybrid attacks | Password attacks

Answer 63

- dict. + brute force attacks can be combine into this kind - used dict. attack, then builds on it by adding #s to end of words, substitues certain letters for #s, capitalizing 1st letter of words - can be useful tool to help identify weak pswds + controls for audit purposes

Question 64

Salt | Password attacks

Answer 64

- random data added to pswd when hashing - raintables won't work with salted hashing -> additional random value added to OG pswd - slows down brute force process BUT doesn't completely stop reverse engineering - each usr gets dif. random hash -> same pswd creates dif. hash - use a pswd manager

Question 65

Stalkerware

Answer 65

-type of SPYWARE -used to monitor partners in relationships