2.2 Survey of Malicious Activities

Question 1

Malware Attacks

Answer 1

Ransomware: Encryption of files for ransom.
Trojan Horses: Malicious software disguised as legitimate software.
Remote Access Trojans (RATs): Allow remote control of infected systems.
Worms: Self-replicating malware that spreads across networks.
Viruses: Malicious code that attaches to executable files.
Spyware: Software that collects personal information without consent.
Keyloggers: Record keystrokes to steal sensitive information.
Logic Bombs: Malware triggered by specific events.
Rootkits: Malicious software that hides its presence and gains system control.

Question 2

Physical Attacks

Answer 2

Brute Force Attacks: Trying all possible combinations to gain access.
RFID Cloning: Cloning RFID cards to gain unauthorized access.
Environmental Attacks: Exploiting vulnerabilities in environmental control systems.

Question 3

Network Attacks

Answer 3

DoS/DDoS Attacks: Overwhelming a system or network with traffic.
DNS Attacks: Targeting DNS servers to disrupt service or redirect traffic.
Wireless Attacks: Exploiting vulnerabilities in wireless networks, such as rogue access points and man-in-the-middle attacks.
Credential Replay Attacks: Reusing captured credentials to gain unauthorized access.

Question 4

Application Attacks

Answer 4

SQL Injection: Injecting malicious SQL code into web applications.
Buffer Overflow: Exploiting vulnerabilities in software to execute malicious code.
Replay Attacks: Reusing captured network traffic to gain unauthorized access.
Privilege Escalation: Gaining higher-level privileges on a system.
Cross-Site Request Forgery (CSRF): Tricking users into performing unintended actions.
Directory Traversal: Accessing unauthorized files and directories on a web server.

Question 5

Cryptographic Attacks

Answer 5

Downgrade Attacks: Forcing systems to use weaker cryptographic protocols.
Collision Attacks: Finding two different inputs that produce the same hash.
Brute Force Attacks: Guessing passwords or cryptographic keys.Side-Channel Attacks:
Exploiting physical characteristics of cryptographic implementations.

Question 6

Password Attacks

Answer 6

Brute Force Attacks: Trying all possible password combinations.
Dictionary Attacks: Using a list of common passwords.
Spraying Attacks: Trying the same password against multiple accounts.

Question 7

Indicators of Compromise (IoCs)

Answer 7

Account lockouts
Concurrent session usage
Blocked content
Impossible travel
Resource consumption
Out-of-cycle logging
Missing logs