Book - 1 Flashcards
Understand viruses.
Viruses are programs that are designed to spread from one system to another through self-replication and to perform any of a wide range of malicious activities.
Chapter 1.1
Understand crypto-malware.
Crypto-malware is any form of malware that uses cryptography as a weapon or a defense.
Chapter 1.1
Understand ransomware.
Ransomware is a form of malware that aims to take over a computer system in order to block its use while demanding payment.
Chapter 1.1
Understand worms.
Worms are designed to exploit a single flaw in a system (operating system, protocol, service, or application) and then use that flaw to replicate themselves to other systems with the same flaw.
Chapter 1.1
Understand Trojan horses.
A Trojan horse is a form of malicious software that is disguised as something useful or legitimate.
Chapter 1.1
Understand rootkits.
A rootkit is a type of malicious code that fools the OS into thinking that active processes and files don’t exist. Rootkits render a compromised system completely untrustworthy.
Chapter 1.1
Understand keyloggers.
A keylogger is a form of malware that records the keystrokes typed into a system’s keyboard.
Chapter 1.1
Understand spyware and adware.
Spyware gathers information about users and may employ that information to customize advertisements or steal identities. Adware gathers information about users and uses it to direct advertisements to the user. Both spyware and adware are usually unwanted software that gathers information without authorization.
Chapter 1.1
Understand botnets.
A botnet is a network of robots or malicious software agents controlled by a hacker in order to launch massive attacks against targets.
Chapter 1.1
Understand a RAT.
A remote-access Trojan (RAT) is a form of malicious code that grants an attacker some level of remote-control access to a compromised system.
Chapter 1.1
Understand logic bombs.
A logic bomb is a form of malicious code that remains dormant until a triggering event occurs. The triggering event can be a specific time and date, the launching of a specific program, or the accessing of a specific URL.
Chapter 1.1
Understand backdoor attacks.
There are two types of backdoor attacks: a developer-installed access method that bypasses any and all security restrictions, or a hacker-installed remote-access client.
Chapter 1.1
Understand malicious code countermeasures.
The best countermeasure to viruses and other malicious code is an antivirus scanner that is updated regularly and that monitors all local storage devices, memory, and communication pathways for malicious activity. Other countermeasures include avoiding downloading software from the Internet, not opening email attachments, and avoiding the use of removable media from other environments.
Chapter 1.1
Understand social engineering.
Social engineeringis a form of attack that exploits human nature and human behavior. Social engineering attacks take two primary forms: convincing someone to perform an unauthorized operation or convincing them to reveal confidential information.
Chapter 1.2
Understand phishing.
Phishing is the process of attempting to obtain sensitive information such as usernames, passwords, credit card details, or other personally identifiable information (PII) by masquerading as a trustworthy entity (a bank, a service provider, or a merchant, for example) in electronic communication (usually email).
Chapter 1.2
Understand spear phishing.
Spear phishingis a more targeted form of phishing where the message is crafted and directed specifically to an individual or group of individuals. The hope of the attack is that someone who already has an online/digital relationship with an organization is more likely to fall for the false communication.
Chapter 1.2
Understand whaling.
Whalingis a form of phishing that targets specific high-value individuals.
Chapter 1.2
Understand vishing.
Vishing is phishing done over VoIP services.
Chapter 1.2
Understand tailgating and piggybacking.
Tailgatingoccurs when an unauthorized entity gains access to a facility under the authorization of a valid worker but without their knowledge.Piggybackingoccurs when an unauthorized entity gains access to a facility under the authorization of a valid worker but with their knowledge and consent.
Chapter 1.2
Understand impersonation.
Impersonationis the act of taking on the identity of someone else. The purpose of impersonation is to trick someone into believing you’re the claimed identity so you can use the power or authority of that identity. Impersonation is also known as masquerading or spoofing.
Chapter 1.2
Understand dumpster diving.
Dumpster diving is the act of digging through trash in order to obtain information about a target organization or individual. It can provide an attacker with information that could make social engineering attacks easier or more effective.
Chapter 1.2
Understand shoulder surfing.
Shoulder surfing occurs when someone is able to watch your keyboard or view your display. This may allow them to learn your password or see information that is confidential, private, or simply not for their eyes.
Chapter 1.2
Understand hoaxes.
A hoax is a form of social engineering designed to convince targets to perform an action that will cause problems or reduce their IT security. A hoax is often an email that proclaims some imminent threat is spreading across the Internet and that you must perform certain tasks in order to protect yourself.
Chapter 1.2
Understand watering hole attacks.
A watering hole attack is a form of targeted attack against a region, a group, or an organization. It’s waged by poisoning a commonly accessed resource.
Chapter 1.2
Understand principles of social engineering.
Many techniques are involved in social engineering attacks. These often involve one or more common principles such as authority, intimidation, consensus/social proof, scarcity, familiarity/liking, trust, and urgency.
Chapter 1.2
Understand arbitrary code execution.
Arbitrary code execution is the ability to run any software on a target system.
Chapter 1.2
Understand DoS.
Denial of service (DoS) is a form of attack that has the primary goal of preventing the victimized system from performing legitimate activity or responding to legitimate traffic. One form exploits a weakness, an error, or a standard feature of software to cause a system to hang, freeze, consume all system resources, and so on. The end result is that the victimized computer is unable to process any legitimate tasks. Another form floods the victim’s communication pipeline with garbage network traffic. The end result is that the victimized computer is unable to send or receive legitimate network communications.
Chapter 1.2
Understand a Smurf attack.
This form of DRDoS uses ICMP echo reply packets (ping packets).
Added: Usually initiated through a botnet which sends pings from a forged source address (the victim’s address) to a third party. The third party sends echo replies, overwhelming the victim.
Chapter 1.2
Understand Xmas attacks.
The Xmas attack is actually an Xmas scan. It’s a form of port scanning that can be performed by a wide number of common port scanners, including Nmap, Xprobe, and hping2. The Xmas scan sends a TCP packet to a target port with the flags URG, PSH, and FIN all turned on.
Chapter 1.2
Understand DDoS.
Distributed denial-of-service (DDoS) employs an amplification or bounce network that is an unwilling or unknowing participant that is unfortunately able to receive broadcast messages and create message responses, echoes, or bounces. In effect, the attacker sends spoofed message packets to the amplification network’s broadcast address.
Chapter 1.2
Understand man-in-the-middle attacks.
A man-in-the-middle attack is a form of communications eavesdropping attack. Attackers position themselves in the communication stream between a client and server (or any two communicating entities). The client and server believe they’re communicating directly with each other.
Chapter 1.2
Understand buffer overflows.
Buffer overflows occur due to a lack of secure defensive programming. The exploitation of a buffer overflow can result in a system crash or arbitrary code execution. A buffer overflow occurs when a program receives input that is larger than it was designed to accept or process. The extra data received by the program is shunted over to the CPU without any security restrictions; it’s then allowed to execute. Results of buffer overflows can include crashing a program, freezing or crashing the system, opening a port, disabling a service, creating a user account, elevating the privileges of an existing user account, accessing a website, or executing a utility.
Chapter 1.2
Understand injection attacks.
An injection attack is any exploitation that allows an attacker to submit code to a target system in order to modify its operations and/or poison and corrupt its data set. Examples include SQL injection, LDAP injection, XML injection, command injection, HTML injection, code injection, and file injection.
Chapter 1.2
Understand SQL injection.
SQL injection attacks allow a malicious individual to perform SQL transactions directly against the underlying database through a website front end.
Chapter 1.2
Understand directory traversal.
A directory traversal is an attack that enables an attacker to jump out of the web root directory structure and into any other part of the filesystem hosted by the web server’s host OS.
Chapter 1.2
Understand cross-site scripting.
Cross-site scripting (XSS) is a form of malicious code injection attack in which an attacker is able to compromise a web server and inject their own malicious code into the content sent to other visitors.
Chapter 1.2
Understand cross-site scripting (XSS) prevention.
The most effective ways to prevent XSS on a resource host are implemented by the programmer by validating input, coding defensively, escaping metacharacters, and rejecting all script-like input.
Chapter 1.2
Understand cross-site request forgery (XSRF).
Cross-site request forgery (XSRF)is an attack focused on the visiting user’s web browser more than on the website being visited. The main purpose of XSRF is to trick the user or the user’s browser into performing actions they had not intended or would not have authorized.
Chapter 1.2
Understand cross-site request forgery (XSRF) prevention.
XSRF prevention measures include adding a randomization string (called a nonce) to each URL request and session establishment and checking the client HTTP request header referrer for spoofing.
Chapter 1.2
Understand privilege escalation.
Privilege escalation occurs when a user account is able to obtain unauthorized access to higher levels of privileges, such as a normal user account that can perform administrative functions. Privilege escalation can occur through the use of a hacker tool or when an environment is incorrectly configured.
Chapter 1.2
Understand ARP poisoning.
ARP poisoning is the act of falsifying the IP-to-MAC address resolution system employed by TCP/IP.
Chapter 1.2
Understand amplification.
An amplification attack is one where the amount of work or traffic generated by an attacker is multiplied in order to cause a significant volume of traffic to be delivered to the primary victim. An amplification attack can also be known as a reflective or bound attack.
Added: The attacker selects requests that have large responses. The attacker can then send small requests over his network that generate large replies resulting in DDoS attack. Smurf attack is an example of an amplification attack.
Chapter 1.2
Understand DNS poisoning.
DNS poisoning is the act of falsifying the DNS information used by a client to reach a desired system. This can be accomplished by deploying a rogue DNS server (also known as DNS spoofing and DNS pharming), using DNS poisoning, altering the HOSTS file, corrupting IP configuration, and using proxy falsification.
Chapter 1.2
Understand pharming.
Pharming is the malicious redirection of a valid website’s URL or IP address to a fake website that hosts a false version of the original valid site.
Chapter 1.2
Understand domain hijacking.
Domain hijacking or domain theft is the malicious action of changing the registration of a domain name without the authorization of the valid owner. This may be accomplished by stealing the owner’s logon credentials, using XSRF, hijacking sessions, using MitM, or exploiting a flaw in the domain registrar’s systems.
Chapter 1.2
Understand man-in-the-browser.
The man-in-the-browser (MitB, MiTB, MiB, MIB) attack is effectively a MitM attack. The only real distinction is that the middle-man malware is operating on the victim’s system, where it is able to intercept and manipulatecommunications immediately after they leave the browser and before they exit the network interface.
Chapter 1.2
Understand zero day.
Zero-day attacksare newly discovered attacks for which there is no specific defense. Azero-day exploitaims at exploiting flaws or vulnerabilities in targeted systems that are unknown or undisclosed to the world in general.Zero dayalso implies that a direct or specific defense to the attack does not yet exist; thus most systems with the targeted vulnerable asset are at risk.
Chapter 1.2
Understand a replay attack.
In a replay attack, an attacker captures network traffic and then replays the captured traffic in an attempt to gain unauthorized access to a system.
Chapter 1.2
Understand pass the hash.
Pass the hash is an authentication attack that potentially can be used to gain access as an authorized user without actually knowing or possessing the plain text of the victim’s credentials. This attack is mostly aimed at Windows systems.
Chapter 1.2
Understand hijacking attacks.
Hijacking attacks are those where an attacker takes over control of a session from a valid user. Some forms of hijacking disconnect the client, whereas others grant the attacker a parallel connection into the system or service.
Chapter 1.2
Understand clickjacking.
Clickjacking is a web page–based attack that causes a user to click on something other than what the user intended to click. This is often accomplished by using hidden or invisible layovers, frame sets, or image maps.
Chapter 1.2
Understand session hijacking.
TCP/IP hijacking, orsession hijacking, is a form of attack in which the attacker takes over an existing communication session. The attacker can assume the role of the client or the server, depending on the purpose of the attack.
Chapter 1.2
Understand typo squatting/URL hijacking.
Typo squatting, or URL hijacking, is a practice employed to capture traffic when a user mistypes the domain name or IP address of an intended resource.
Chapter 1.2
Understand cookies.
A cookie is a tracking mechanism developed for web servers to monitor and respond to a user’s serial viewing of multiple web pages. It may allow identity theft.
Chapter 1.2
Understand driver manipulation.
Driver manipulation occurs when a malicious programmer crafts a system or device driver so that it behaves differently based on certain conditions.
Chapter 1.2
Understand shimming.
Shimming is a means of injecting alternate or compensation code into a system in order to alter its operations without changing the original or existing code.
Chapter 1.2
