Chapter 6 Securing individual systems Flashcards
What is malware?
Software that is detrimental to the operation of a host, causing harm or unwanted behavior.
What are the two main functions of a virus?
To replicate and to activate, causing harm or performing some action once triggered.
What is a fileless malware or fileless virus?
Malware that resides in memory and does not rely on files to spread or execute.
What is ransomware (crypto malware)?
Malware that encrypts a user’s data and demands a ransom for the decryption key.
How does a worm differ from a virus?
A worm can replicate itself and spread over networks without user intervention.
What is a Trojan horse?
A program that appears legitimate but performs malicious actions in the background.
What is a Remote Access Trojan (RAT)?
A type of Trojan that allows an attacker to remotely control an infected computer.
What is a backdoor in the context of malware?
A hidden way to bypass normal authentication and gain access to a system.
What are Potentially Unwanted Programs (PUPs)?
Software that may be unwanted by the user, often bundled with other software.
What is a botnet?
A network of infected computers (zombies) controlled by an attacker for malicious activities like DDoS attacks.
What is a keylogger?
Malware that records keystrokes to capture sensitive information like passwords.
What is a rootkit?
Malware designed to gain root access and hide its presence on a system, often installed in the boot sector.
What is a logic bomb?
Malware that triggers a malicious action when certain conditions are met, such as a specific date or number of logins.
What type of attack typically uses botnets?
Distributed Denial of Service (DDoS) attacks.
How can hardware keyloggers be detected?
: They are difficult to detect with software, often requiring physical inspection of the device.
Why are rootkits particularly dangerous?
Because they operate with high-level privileges and can be difficult to detect and remove.
What is the main characteristic of a logic bomb?
It activates based on specific conditions or a timer, causing harm when triggered.
How can Trojans be spread?
Through seemingly legitimate software or files that users download and execute.
Why are PUPs considered a threat?
They can slow down systems, introduce unwanted changes, and potentially lead to further security issues.
What is a weak configuration in cybersecurity?
A setup that presents security risks due to default settings, lack of hardening, or other vulnerabilities.
Why are open Wi-Fi networks considered weak configurations?
Because they allow anyone to connect without authentication, posing security risks, especially in non-public environments.
Why should guest user accounts be disabled if not needed?
They can provide unauthorized access and should be turned off if not required to reduce security risks.
What is the purpose of intruder lockout settings?
To lock out user accounts after multiple failed login attempts, preventing brute force or dictionary attacks.
What is a common issue with permissions that can lead to weak configurations?
Assigning too many permissions, violating the principle of least privilege, and giving users more access than needed.
Why is using the root account directly in Linux considered a weak configuration?
Because it provides unrestricted access and increases the risk of accidental or malicious changes; using sudo is recommended instead.
What is the risk of insecure cryptographic solutions like WEP, DES, and SSL?
These outdated encryption methods are vulnerable to attacks and should be replaced with more secure alternatives like WPA3, AES, and TLS 1.2+.
Why is it important to change default settings on devices?
Default settings, including IP addresses and port numbers, are widely known and can be exploited by attackers.
What is a common weak configuration found in older Wi-Fi routers and multifunction network printers?
Having Universal Plug and Play (UPnP) enabled, which can expose devices to attacks.
Why should default usernames and passwords be changed on devices?
They are often easily found in online lists and can be exploited by attackers to gain unauthorized access.
What is a directory traversal attack and why is it a risk with default installation locations?
It’s an attack that gains unauthorized access to files and directories, made easier if the attacker knows the default file paths.
How can default passwords left unchanged impact security?
They can provide easy access for attackers, especially on internet-facing devices.
What tool can be used to find devices with default passwords on the internet?
Shodan.io, a search engine that identifies devices with default settings and other security vulnerabilities.
What is the principle of least privilege?
A security concept that users should be granted the minimum levels of access – or permissions – necessary to perform their job functions.
What is a common consequence of weak configurations in IoT devices?
Increased vulnerability to attacks, leading to potential unauthorized control or data breaches.
Why should older encryption standards like SSL and TLS versions below 1.2 be avoided?
They have known vulnerabilities and are no longer considered secure for protecting network communications.
What is a zero day attack?
An attack that exploits a vulnerability not yet known to the software vendor or hardware manufacturer, making it unpatched and unknown to the target.
What is the Zero Day Initiative (ZDI)?
A program promoting the responsible disclosure of discovered vulnerabilities, often with financial rewards for security researchers.
What are bug bounty programs?
Programs where companies pay security researchers to find and report vulnerabilities in their software or systems.
What is a DNS sinkhole?
A security measure where DNS responses are manipulated to redirect malicious traffic or block access to malicious domains.
What is privilege escalation?
Gaining higher access rights than initially granted, often through exploiting vulnerabilities or misconfigurations.
What is a replay attack?
An attack where valid data transmission is maliciously repeated or delayed, often to gain unauthorized access.
What is pointer and object dereferencing?
An attack that manipulates memory pointers to access unauthorized memory locations, potentially exposing sensitive data or crashing systems.
What are common issues with error handling in software?
Poor error handling can disclose too much information, aiding attackers in understanding the system’s vulnerabilities.
What is DLL injection?
A technique where malicious code is inserted into a running process by exploiting dynamic link libraries (DLLs).
What is resource exhaustion?
An attack that depletes system resources, such as memory or CPU, causing denial of service (DoS).
What is a race condition?
A flaw in multi-threaded applications where the timing of threads can lead to unpredictable behavior and potential security issues.
How can error messages contribute to security vulnerabilities?
Detailed error messages can provide attackers with insights into the system, revealing potential attack vectors.
What is a man-in-the-middle attack?
An attack where a malicious actor intercepts and potentially alters communication between two parties without their knowledge.
What is a dynamic link library (DLL)?
A collection of small programs that can be called upon by larger programs to perform specific functions.
How can you mitigate the risk of zero day attacks?
Employing strong security practices, such as regular updates, using intrusion detection/prevention systems (IDS/IPS), and participating in or supporting bug bounty programs.
What is memory injection in cybersecurity?
Memory injection is when unauthorized code is placed into a program’s running memory, causing it to act in unexpected and potentially harmful ways.
How is memory injection similar to adding unwanted ingredients in a kitchen?
Just as adding unwanted ingredients can change the flavor of a dish, memory injection changes the behavior of a program, making it do things it wasn’t supposed to.
What is a buffer overflow?
A buffer overflow occurs when a program receives more data than it can handle, causing the excess data to overflow into other parts of memory, potentially causing a system crash or allowing an attacker to exploit the system.
How is a buffer overflow similar to overfilling a glass with water?
Just like overfilling a glass causes water to spill everywhere, a buffer overflow causes excess data to spill into other parts of the program, potentially causing damage.
What is a race condition in cybersecurity?
A race condition occurs when the outcome of a program depends on the sequence or timing of uncontrollable events, leading to unpredictable behavior.
