Chapter 5: Endpoint Vulnerabilities, Attacks, and Defenses Flashcards
What are Endpoints?
Any device - a better and more accurate description
What is Blocking Ransomeware?
Blocks user from using the computer correctly
What is Locking Ransomeware?
Encrypts some or all files on the device so that they can’t be open
What is spyware?
Tracking software deployed without consent
What is a Trojan?
Executable program that masquerades as performing good activity BUT does something malicious
What is RAT?
Remote Access Trojan
What is the definition of a Launch type of malware? (Virus, Worm, Bloatware, and Bot)
Infects a computer to launch attacks on other computers
What is a File-Base Virus?
Reproduces itself on the same computer without human intervention (Easy)
What is a Fileless Virus?
Not attached to files, takes advantage of native services and process - ex. RAM (Hard)
What is a worm (Network Virus)?
Malicious program that uses a computer network to replicate
What is Bloatware?
Software that is installed on a device without user requesting it
What is a Bot/Zombie?
Infected robot computer
What is a Botnet?
Multiple bot computers
What are Bot Herders?
Controls bots through a C&C structure
What is a logic bomb?
Computer code added to legit program but lies dormant& evades detection until a specific logical event
What is a Rootkit?
Malware hides its presence & possibly other malware
What is a Backdoor?
Gives access to a computer, program, or service that circumvents any normal security protections
What is an IoA?
Indicator of Attack - A sign an attack is currently underway
What is an IoC?
Indicator of Compromise - A sign an attack has already happened
What is Privilege Escalation?
Allows attacker to gain access beyond what is entitled for a user
What is Buffer Overflow?
A process attempts to store data in RAM beyond the boundaries of a fixed-length storage buffer
What is a NULL Pointer/Object?
An improper handling situation
What is a Race Condition?
Two concurrent threads of execution access shared resource simultaneously
What is a web-based attacks?
Attacks through web application
What is Directory Traversal?
Takes advantage of a vulnerability so that a user can move from the root directory or other restricted directory
What are Request Forgery attacks?
A request that has been fabricated
What is Cross-site scripting? (XSS)
A website that accepts user input without validating it & uses that in put in a response; no sanitizing
What is sanitizing in programing?
the process of cleaning or filtering user input to ensure it doesn’t contain any malicious code that could be executed by the web application - to “clean” anything from “bad things”
What is CSRF?
Cross-Site Request Forgery - Takes advantage of an authentication “Token” that a website sends to a users browser
What is SSRF?
Server-Site Request Forgery - Takes advantage of a trusting relationship between servers
What is a Replay attack?
Commonly against digital identities, Impersonates legitimate user - copies data and then uses it for an attack
What is Antivirus?
Monitors computer activity, examines computer for file-based virus infection
What is static analysis?
Older AV products that use signature-based monitoring
What is dynamic analysis?
Looking for characteristics. heuristic monitoring
What is Secure Cookies?
Encrypted request over the secure HTTPS protocol
What is HTTP Response Headers?
Headers that tell browser how to behave with website
What is HIDS?
Host Intrusion Detection Systems - Used to detect attack
What is an HIPS?
Host Intrusion Prevention Systems - Monitor activity to block malicious attack
What is EDR?
Endpoint Detection & Response - Tools more robust than HIDS & HIPS, Preform more analytics to ID anomalies
What is a keylogger?
Software or Hardware that silently captures and stores each keystroke that is typed on a user’s keyboard - Can even be able to take screenshots of the screen and send that over the ethernet to the threat actor (software) - Sometimes needs to be installed and retrieve without being detected (hardware)
What is TOC/TOU?
Time of Check/Time of Use - A race condition in which a threat actor can influence the state of the resource between a check
What is TOE?
Target of Evaluation - A system, product, and its documentation that is the subject of a security evaluation
