Chapter 3 - Threats in Software Environments Flashcards
Software Attack Approaches
Adversaries employ various tactics to attack software applications, seeking to compromise them for data theft, data alteration, or system disruption. These approaches encompass:
- Authentication Bypass: Attackers aim to access system resources without providing valid authentication credentials.
- Privilege Escalation: Adversaries, once inside a system, attempt to gain higher privilege levels, potentially granting them access to more data or control over the system.
- Denial of Service (DoS): Attackers incapacitate a system by inundating it with messages or sending specially crafted ones, hoping to disrupt its normal operation.
These threats involve numerous attack methods:
- Buffer Overflow
- Malicious Software
- Input Attacks
- Logic Bombs
- Object Reuse
- Mobile Code
- Social Engineering
- Backdoor
Buffer Overflow
Buffer Overflow is a software vulnerability where excessive input disrupts program operation, potentially leading to memory corruption or unexpected behavior. Several types of attacks exploit this, including Stack Buffer Overflow, NOP Sled Attack, Heap Overflow, and Jump-to-Register Attack.
- Historic Buffer Overflow Attacks include the Morris worm, Ping of Death, Code Red, SQL Slammer, Blaster, Sasser, and Conficker, causing significant damage.
- Countermeasures to mitigate Buffer Overflow include using safer programming languages, safe libraries, executable space protection, stack smashing protection (using canary values), and application firewalls to prevent attacks.
Malicious Software
Malicious Software, often referred to as malware, encompasses various harmful software forms, each serving distinct purposes:
- Propagation: Some malware spreads from system to system without other specific functions.
- Damage and Destruction: Malware can alter or delete files on target systems.
- Information Theft: It can locate and steal valuable data such as emails, user IDs, passwords, bank account and credit card numbers, and transmit this information to its operator.
- Usage Monitoring: Malware can record communications, keystrokes, and mouse clicks for later transmission to the operator.
- Denial of Service: Malware can consume system resources or cause malfunctions, rendering the system useless.
- Remote Control: It can implant bots on target systems for remote control, forming bot armies controlled by bot herders or botnet operators.
Malware typically comprises three components:
- Exploit: Code exploiting vulnerabilities in software, enabling malware execution.
- Dropper: Installs the actual malware on the target system.
- Malware: Performs intended functions such as data theft, destruction, network sniffing, or propagation.
Various types of malware include:
- Viruses
- Worms
- Trojan horses
- Rootkits
- Bots
- Remote access Trojans
- Spam
- Pharming
- Spyware and adware
These types continuously evolve, adapting new methods for development, propagation, and evading defenses.
Viruses
Viruses are malicious code fragments that attach themselves to legitimate program files. They require human intervention to propagate and often spread via email and web traffic.
Example Types: Master boot record (MBR) viruses, file infector viruses, macro viruses.
Worms
Worms are similar to viruses but can propagate independently without human intervention. They spread through various means, including mass-mailing via email and port scanning.
Example Types: Mass-mailing worms, port-scanning worms.
Trojan Horses
Trojan horses are programs that disguise themselves as something benign but have hidden malicious functions. Users willingly execute them, unknowingly triggering harmful actions.
Example: Users might open an email attachment claiming to be a game but actually contains a Trojan horse.
Rootkits
Rootkits are malware designed to remain hidden from detection by altering the operating system. They use methods like process hiding, file hiding, and registry hiding.
Purpose: To maintain persistent and stealthy control over an infected system.
Bots
Bots, short for robots, are often part of malware and allow attackers to remotely control infected computers. They can be used for spam relaying, hosting phishing sites, and launching denial-of-service attacks.
Example: Botnets consist of a collection of bots controlled by a single entity.
RATs
Definition: RATs enable remote control of a victim’s computer, either manually or automatically. They are often used in targeted attacks for reconnaissance.
Purpose: To gain unauthorised access to and control over a victim’s computer
Spam
Definition: Spam refers to unwanted and unsolicited emails, which can include various types of content such as commercial advertisements, phishing scams, and malware delivery.
Example Types: Unsolicited commercial email (UCE), phishing emails, spear phishing, whaling
Pharming
Definition: Pharming redirects internet traffic intended for a legitimate website to a fraudulent one, often used for stealing login credentials or sensitive information.
Methods: Attackers manipulate DNS servers or modify users’ hosts files to redirect traffic
Spyware and Adware
Spyware and adware track users’ internet usage behavior, often without their consent, to collect data for marketing or other purposes.
Examples: Tracking cookies, web beacons, browser helper objects (BHOs), keyloggers.
Ransomware
Ransomware encrypts a victim’s files or locks them out of their system and demands a ransom payment in exchange for decryption or system access.
Purpose: To extort money from victims by holding their data hostage.
Anti-Virus
Anti-virus software detects and blocks malware by using signature-based and heuristics-based methods to identify and remove malicious code from a system.
Use cases: Deployed on end user workstations, e-mail servers, file servers, web proxy servers, and security appliances.
Anti-Rootkit Software
Anti-rootkit software is designed to detect hidden processes, registry entries, kernel hooks, and files that rootkits may use to hide their presence on a system.
Use cases: Deployed to identify and remove rootkits on various systems, including end user workstations and servers.
