Chapter 6 - Comparing Threats, Vulnerabilities, and Common Attacks Flashcards
Attack vector
Paths that attackers use to gain access to computers and networks.
When successful, these vectors enable attackers to exploit vulnerabilities
Malware
Malware, or malicious software, includes a wide range of software that has malicious intent.
Malware is not software that you would knowingly purchase or download and install - but rather it is installed onto your system through devious means.
Virus
Malicious code that attaches itself to a host application.
The host application must be executed to run, and the malicious code executes when the host application is executed.
The virus tries to replicate by finding other host applications to infect with the malicious code.
At some point the virus activates and delivers it payload. Typically the payload of a virus is damaging, and could delete files, cause random reboots, join the computer to a botnet, or enable backdoors that attackers can use to access systems remotely.
Most viruses won’t cause damage immediately, but rather give the virus time replicate first. A user often executes the virus unknowingly but other times the OS will automatically execute it after user interaction, such as when a user plugs in an infected USB drive.
Shadow IT
Shadow IT refers to any unauthorized systems or applications within an organization, installed on a network without authorization or approval. Happens when insiders install systems without approval, often to bypass security controls.
Shadow IT increases risks because these systems aren’t managed.
Worm
A self-replicating malware that travels throughout a network without the assistance of a host application or user interaction.
A worm resides in memory and can use different transport protocols to travel over a network.
One significant problem with worms is they consumes lots of network bandwidth, and can replicate themselves hundreds of times and spread to all the systems in the network.
Each infected system tries to locate and infect other systems on the network, and network performance can slow to a crawl.
Log bomb
A string of code embedded into an application or script that will execute in response to an event. The event might be a specific date or time, or a user action such as when a user launches a specific program.
Backdoor
Provides another way or accessing a system, like a backdoor on a house.
Malware often installs backdoors on systems to bypass normal authentication methods.
Many types of malware create a backdoor quickly after infecting a system or network, giving them discreet access to the system or network. Even if the malware is later discovered and removed, the backdoor remains.
Trojan
Like a trojan horse, typically looks like something beneficial, but it’s actually something malicious, such as installing a backdoor onto a user’s system.
A Trojan can come as pirated software, a useful utility, a game or something else that could entice a user to download or try. Attackers also have used drive-by-downloads to deliver Trojans.
In a drive-by-download, web servers include malicious code that attempts to download and install itself on user computers after the user visits. Steps:
1. Attackers compromise a website to gain control of it.
2. Attackers install a Trojan embedded in the website’s code.
3. Attackers attempt to trick users into visiting the site. Sometimes, they simply send the link to thousands of users via email, that some of them click.
4. When users visit, the website attempts to download the trojan onto a user’s system.
Another trojan is rogueware, also known as scareware, which masks as a free antivirus program, that encourages users to install after a popup appears saying it detected malware on the system.
RAT
Remote Access Trojan, a type of malware that allows attackers to control systems from remote locations.
Often delivered via drive-by-downloads or malicious attachments in email. Once installed on a system, attackers can then access the infected computer at any time and install additional malware if needed.
-Often delivered as PE (Portable Executable) files in 32-bit and 64-bit (PE64) formats. They often compress the PE files using compression tools, such as tar (sometimes called tarball). Tar files have the .tar.gz file extension.
Keyloggers
Keyloggers attempt to capture a user’s keystrokes.
Keystrokes are stored in a file and either sent to an attacker immediately, or saved until the attacker retrieve the file. KLs are typically software but can also be hardware, such as a USB keylogger.
Keyloggers can be thwarted by 2FA.
Spyware
Software installed on a users’ systems without their awareness or consent with the purpose of monitoring the user’s computer and the user’s activity.
Spyware can take some level of control over the user’s computer to learn information and send the information to the third party.
Rootkit
A rootkit is a group of programs (or maybe a single program) that hides the fact that the system has been infected or compromised by malicious code.
A user might suspect something is wrong but antivirus scans and other checks indicate everything is fine because the rootkit hides its running processes to avoid detection.
In addition to modifying the internal OS processes, rootkits also often modify system files such as the Registry, and can even modify system access.
Botnet
A group of zombie computers controlled by attackers, and computers in a botnet check in with command and control servers periodically for instructions. Frequently used for DDoS attacks.
Bot = software robot
Bot herder = criminals who manage botnets.
Attackers use command and control resources to control infected computers. Once infected with malware the malware then attempts to connect to a command and control resource for instructions.
Ransomware
A specific type of Trojan, ransomware attackers take control of computers or networks and lock out users.
With cryptomalware, attackers encrypt the data on computers within the network to prevent access.
In both cases the attackers then demand that the user or organization pay a ransom to regain access to the data forever.
PUP
Potentially Unwanted Programs, programs that a users may not want even if they consented to download it.
Some of these unwanted programs are legit, but some are malicious, such as browser hijackers than can change the user’s browser settings without the user’s clear consent.
