Chapter 4 Flashcards
Advanced Persistent Threat (APT)
A network attack in which an unauthorized person gains access to a network and stays there undetected for a long period of time. The purpose of such an attack is to steal data, not to damage the network or organization. Sectors with high-value information, such as national defense, manufacturing, and the financial industry, are commonly the target of such attacks.
Adware
Unwanted software that displays advertisements. Often linked with spyware.
Alternate Data Stream (ADS)
A feature added to the NTFS file system to support files from POSIX, OS/2, and Macintosh. ADS supports multiple resource forks for file objects. Hackers use ADS to hide files.
Arbitrary Code Execution
An exploit that allows a hacker to run any command line function on a compromised system. Buffer overflow attacks and SQL injection attacks can often allow arbitrary code execution.
ARP Spoofing
The falsification of ARP replies to trick the requestor into sending frames to a system other than its intended destination.
Banner
A message sent by a service in response to a valid or invalid query. A banner can confirm communication is functioning properly or announce an error. Some banners disclose the product name and version number of the service.
Banner Grabbing
The act of capturing or extracting banners from services. Hackers often perform banner grabbing after port scanning to learn what service is active on a port.
Botnet army
A network of zombie/bot/agent– compromised systems controlled by a hacker. The network consists of the bots, agents, or zombies that intercommunicate over the Internet. Another term for zombie.
Buffer Overflow
A condition in which a memory buffer exceeds its capacity and extends its contents into adjacent memory. Often used as an attack against poor programming techniques or poor soft-ware quality control. Hackers can inject more data into a memory buffer than it can hold, which may result in the additional data overflowing into the next area of memory. If the overflow extends to the next memory segment designated for code execution, a skilled attacker can insert arbitrary code that will execute with the same privileges as the current program. Improperly formatted overflow data may also result in a system crash.
Chip Creep
The slow movement of a chip out of its socket or solder points because of expansion and contraction caused by extreme temperature fluctuations.
Cluster
A logical division of data composed of one or more sectors on a hard drive. A cluster is the smallest addressable unit of drive storage, usually 512, 1,024, 2,048, or 4,096 bytes, depending on the logical volume size.
Cold Calling
A tactic of pursuing and extracting information for the purpose of making a sale or performing a social engineering attack. A cold call presupposes little or no knowledge of the person answering the phone. It requires the caller to be able to pick up on vocal and word clues, be knowledge-able about human nature, and adapt quickly to changes in conversation.
Command Shell
A software interface with a system that allows code execution. A command shell is often the focus of an attack. If a hacker gains access to a command shell, he or she can perform arbitrary code execution. Also known as a terminal window or a command prompt. For example, in Windows, the command shell prompt is usually “C:>”.
Contract Worker
An outsider brought into an organization to work on a temporary basis. Contracted workers can be consultants, temporary workers, seasonal workers, contractors, or even day-laborers. Contracted workers potentially represent a greater risk than regular, full-time regular employees because they might lack loyalty, not see the company as worthy of protection, might not be accountable after a project ends, and so on.
Covert Channel
An unknown, secret pathway of communication. Covert channels can be timing or storage-based.
Cross-site scripting (XSS)
The malicious insertion of scripting code onto a vulnerable Web site. The results of an XSS attack can include the corruption of the data on the Web site or identity theft of the site’s visitors.
Deterrent
A form of security defense that focuses on discouraging a perpetrator with disincentives such as physical harm, social disgrace, or legal consequences. A deterrent can also be a defense that is complex or difficult to overcome, such as strong encryption, multifactor authentication, or stateful inspection filtering.
Dialer
A rogue program that automatically dials a modem to a pre-defined number. Sometimes this is to auto-download additional malware to the victim or to upload stolen data from the victim. In other cases, the dialer calls premium rate telephone numbers to rack up massive long distance charges.
Disgruntled Employee
A worker who feels wronged by his or her employer and who may take malicious, unethical, potentially illegal actions to exact revenge on the organization.
Distributed denial of service (DdoS) Attack
An attack that uses multiple remotely controlled software agents disseminated across the Internet. Because the denial of service attack comes from multiple machines simultaneously, it is “distributed.” DDoS attacks can include flooding, spam, eavesdropping, interception, MitM, session hijacking, spoofing, packet manipulation, distribution of malware, hosting phishing sites, stealing passwords, cracking encryption, and more.
DNS Poisoning
A form of exploitation in which the data on a DNS server are falsified so subsequent responses to DNS resolution queries are incorrect. DNS poisoning can wage man-in-the-middle attacks.
DNS Spoofing
A form of exploitation in which unauthorized or rogue DNS server responds to DNS queries with false, spoofed resolutions. DNS poisoning can wage man-in-the-middle attacks.
Domain registration
The information related to the owners and managers of a domain name accessed through domain registrar’s Web sites and whois lookups. A domain registration might include a physical address, people’s names, e-mail addresses, and phone numbers. This information is useful in waging social engineering attacks.
Dumpster diving
A type of reconnaissance in which an attacker examines an organization’s trash or other discarded items to learn internal or private information. The results of dumpster diving are often used to wage social engineering attacks.
Enumeration
The process of discovering sufficient details about a potential target to learn about network or system vulnerabilities. Enumeration often starts with operating system identification, followed by application identification, then extraction of information from discovered services.
Flaw Exploitation Attack
A form of DoS that uses a software specific exploit to cause the interruption of availability. Once you apply the appropriate patch, the system is no longer vulnerable to this particular exploit.
Flooding
An attack, usually resulting in a DoS, in which hackers direct massive amounts of traffic toward a target to fully consume available band-width or processing capabilities.
Footprinting
The act of researching and uncovering information about a potential attack target. Also known as reconnaissance.
Hacktivism
Politically or socially motivated hacking, seen by activists as a form of civil disobedience in the interest of free speech and human rights, but seen by its opponents as a form of cyberterrorism.
Hierarchical File System (HFS)
A storage device file system developed by Apple Inc. for use on Macintosh computers. HFS supports multiple resource forks for file objects.
ICMP Redirect
An announcement message sent to hosts to adjust the routing table. ICMP type 5 messages are known as redirects. Hackers can use ICMP redirects to perform man-in-the-middle or session hijacking attacks.
IDS Insertion
An attack that exploits the nature of a network-focused IDS to collect and analyze every packet to trick the IDS into thinking an attack took place when it actually hasn’t. The common purpose of IDS injection attacks is to trick signature or pattern matching detection of malicious network events.
Insertion attack
An exploit-based on the introduction of unauthorized content or devices to an otherwise secured infrastructure. Three common insertion-based attacks include SQL injection, IDS insertion, and rogue devices.
Instant messaging
A form of near real-time text communication. Also known as chat, IRC, and SMS messaging.
Intentional Electromagnetic Interference (IEMI)
The result of an intentional discharge made to damage or destroy electronic equipment ranging from cell phones to computers and servers.
Interception Attack
Any attack that positions the attacker inline with a session between a client and server. Such attacks typically allow the hacker to eavesdrop and manipulate the contents of the session. Also known as a man-in-the-middle attack.
Internet Relay Chat (IRC)
A real-time text communication system. Hackers commonly use IRC as a way to communicate anonymously and control botnets.
Keystroke Logger
Malware that records all keyboard input and transmits the keystroke log to a hacker.
