Chapter 4 - Malware Infection Flashcards
What are the two vector methods to infect u w/ malware can get onto ur machine
1- Threat Vector=A threat vector is the method used by an attacker to access a victim’s machine. (the path someone uses to gain access to a device)
Some ex of threat vectors are unpatched software, installation from a USB thumb drive, a phishing campaign, where one of your users clicks on a link to install a program, & many other different methods that are out there.
After we figure out what the threat vector is, the next piece is what we call the attack vector.
2- Attack Vector= Method used by an attacker to gain access to a victim’s machine in order to infect it w/ malware (intentional threats that require planning & analysis)
An attack vector is the means by which the attacker is going to gain access to that computer in order to affect you with malware. Now I know these two terms sound very similar, but there is a key difference. A threat vector is how we get to the machine itself, but the attack vector includes both the way we got to the machine & how we’re going to infect it. Let me provide you an example to hopefully simplify this just a little bit. Let’s pretend that your house is a computer & I have a cupcake that’s going to represent malware. My job as the attacker is to get the cupcake from my house to your house & put it on your kitchen table. Now, that’s my goal, as the attacker. U are going to try & defend against it. The threat vector I use might be that I can drive right up to ur house, bc ur house isn’t inside a gated community & there’s no security guards looking for me. This would be a threat vector, your unguarded neighborhood. Now if I walk up to your door, & I start picking your lock, & I enter your house, & I place the cupcake on your kitchen table, this represents the attack vector. It’s all the things I did from driving to your house, to picking your lock, & delivering that poison cupcake onto your kitchen table. That’s the difference between the threat vector and the attack vector.
What are the Common Delivery Methods of ways your computer can get infected w/ malware?
**The most common ones come from software, messaging, & media. **
Software & messaging are things like email programs, peer-to-peer networks like BitTorrent, FTP servers, & pretty much any other way that we communicate from one computer to another.
What are watering holes?
Watering hole is a place on a website that u know ur potential victims will access
EX= an attacker can figure out where that website is that you go to every day. & if they can go & attack that company & embed viruses or malware into their website, when you go to the website to do regular work, like pulling your invoices, u can also be pulling that virus.
There are lots of things that can create watering holes for us. There’s an automated toolkit called an ______ that makes this really easy to do as an attacker.
exploit kit
Say an attack tries to spoof you. Right website is DionTraining.com.
Now, if you look at the one on the bottom,
it says DionTrainings.com.
What is that called?
Typosquatting
they might clone it to look like my site. & they might place malware there & then use that as a watering hole to try to go after all of my students.
What is a Botnet
A collection of compromised computers under the control of a master node
if your computer becomes part of this network & it becomes a zombie, it doesn’t even know it’s doing a lot of these things & you might not even know that it’s doing these things either. Instead you just see your machine is slowing down.
What kind of things can a zombie do?
(1) They might be used as a pivot point so that when they get a new victim, or if they’re attacking a server, they can access it through your computer & it looks like you’re doing the attack instead of the master node.
(2) They’ll jump from their command and control node into one of the zombies & from the zombie over to the victim & they might go out and use those zombies to host files that are illegal, like child – so they don’t get caught with them & all sorts of things like that.
(3) They may use them to spam other people & send out phishing campaigns and other malware or, most commonly, they can use this botnet to conduct a DDoS, a distributed denial-of-service attack.
What is a DDoS?
denial-of-service attack occurs when many machines target a single victim & attack them at the exact same time.
What is the most common use of Botnets?
DDoS & money (cryptomining or bitcoin mining)
What is an Active Interception?
Occurs when a computer is placed between your sending computer & your receiving computer. Bc of that position it’s able to capture or modify the traffic that’s going between the two computers.
Ex= We think we’re connected to Pete’s Coffee or Starbucks, or whatever your favorite coffee shop is. But in actuality we’re not connected to the coffee shop wifi. Instead, we’re connecting to an attacker who’s sitting in the back of the room with their laptop. This attacker has set up their laptop & is putting out a signal stronger than the coffee shop’s signal. So our machines are connecting to them. Now whenever we’re trying to go to the internet we’re actually going from our laptops to the hackers laptop and from the hackers laptop out to the internet. To us it still looks like we’re connected & we can go online and everything is fine w/ the world. But bc of the placement of the attackers laptop in between us & our final destination they can capture anything that we’re doing. They can see the emails that we’re sending. They may be able to capture usernames and passwords. They may be able to modify what’s coming back to us as well & embed malware into the files that we’d been requesting. That’s what active interception is.
What is Privilege Escalation?
occurs when you’re able to exploit a design flaw or a bug in a system to gain access to resources that a normal user isn’t able to access.
Ex=Using IP to get administrative access
How to prevent Privilege Escalation?
To prevent this, we want to make sure that we patch and update our machines.
What acts just like a backdoor to maintain persistent access?
RAT= to maintain persistent access
Backdoors are used to ________.
bypass normal security & authentications functions
What is an Easter Egg?
was an insecure coding practice
It is a non-malicious code that when invoked, displays an insider joke, hidden message, or secret feature
EX= googling barrel roll and google page would spin leading to logic bombs
