Cisco 2 Flashcards
usually introduced by errors in the operating system or application code, despite all the effort companies put into finding
Software vulnerabilities
- are often introduced by hardware design flaws. RAM memory for example, is essentially capacitors installed very close to one another. It was discovered that, due to proximity, constant changes applied to one of these capacitors could influence neighbor capacitors.
- are specific to device models and are not generally exploited through random compromising attempts
Hardware vulnerabilities
Categorizing Security Vulnerabilities
- buffer flow
- non-validated input
- race conditions
- weakness in security practices
- access-control problems
his vulnerability occurs when data is written beyond the limits of a buffer. Buffers are memory areas allocated to an application.
Buffer overflow
Programs often work with data input. This data coming into the program could have malicious content, designed to force the program to behave in an unintended way
Non-validated input
- Systems and sensitive data can be protected through techniques such as authentication, authorization, and encryption.
- Developers should not attempt to create their own security algorithms because it will likely introduce vulnerabilities.
- It is strongly advised that developers use security libraries that have already created, tested, and verified.
weaknesses in security practices
This vulnerability is when the output of an event depends on ordered or timed outputs. A race condition becomes a source of vulnerability when the required ordered or timed events do not occur in the correct order or proper timing.
Race conditions
process of controlling who does what and ranges from managing physical access to equipment to dictating who has access to a resource, such as a file, and what they can do with it, such as read or change the file. Many security vulnerabilities are created by the improper use of access controls.
Access-control problems
Types of Malware
- spyware
- adware
- bot
- ransomware
- scareware
- rootkit
- trojan horse
- worms
- man-in-the-middle
- man-in-the-mobile
- This malware is design to track and spy on the user.
- often includes activity trackers, keystroke collection, and data capture. In an attempt to overcome security measures, spyware often modifies security settings.
Spyware
- dvertising supported software is designed to automatically deliver advertisements.
- is often installed with some versions of software.
- designed to only deliver advertisements but it is also common for adware to come with spyware.
Adware
From the word robot, a bot is malware designed to automatically perform action, usually online. While most bots are harmless, one increasing use of malicious bots are botnets.
Bot
This malware is designed to hold a computer system or the data it contains captive until a payment is made
Ransomware
his is a type of malware designed to persuade the user to take a specific action based on fear.
Scareware
This malware is designed to modify the operating system to create a backdoor. Attackers then use the backdoor to access the computer remotely
Rootkit
malicious executable code that is attached to other executable files, often legitimate programs
Virus
malware that carries out malicious operations under the guise of a desired operation. This malicious code exploits the privileges of the user that runs it
Trojan horse
malicious code that replicate themselves by independently exploiting vulnerabilities in networks
Worms
allows the attacker to take control over a device without the user’s knowledge. With that level of access, the attacker can intercept and capture user information before relaying it to its intended destination.
Man-In-The-Middle (MitM)
type of attack used to take control over a mobile device. When infected, the mobile device can be instructed to exfiltrate user-sensitive information and send it to the attackers.
Man-In-The-Mobile (MitMo)
two categories of malware
- infectious methods
- malware actions
infectious methods
- worms
- virus
- trojan
- bots
malware on basis of actions
- adware
- ransomware
- spyware
- scareware
- rootkits
- zombies
they dont steal or spy but wait for instructions from hackers
zombies
Symptoms of Malware
- There is an increase in CPU usage.
- There is a decrease in computer speed.
- The computer freezes or crashes often.
- There is a decrease in Web browsing speed.
- There are unexplainable problems with network connections.
- Files are modified.
- Files are deleted.
- There is a presence of unknown files, programs, or desktop icons.
- There are unknown processes running.
- Programs are turning off or reconfiguring themselves.
- Email is being sent without the user’s knowledge or consent.
access attack that attempts to manipulate individuals into performing actions or divulging confidential information
Social Engineering
This is when an attacker calls an individual and lies to them in an attempt to gain access to privileged data.
Pretexting
This is when an attacker quickly follows an authorized person into a secure location.
Tailgating
This is when an attacker requests personal information from a party in exchange for something, like a free gift.
Something for Something (Quid pro quo)
process of discovering the password used to protect a wireless network
Wi-Fi Password Cracking
The attacker manipulates a person who knows the password into providing it.
Social engineering
social engineering types
- pretexting
- tailgating
- something for something (Quid pro quo)
The attacker tries several possible passwords in an attempt to guess the password. If the password is a 4-digit number, for example, the attacker would have to try every one of the 10000 combinations.
Brute-force attacks
By listening and capturing packets sent on the network, an attacker may be able to discover the password if the password is being sent unencrypted (in plain text
Network sniffing
Wi-Fi Password Cracking types
- Social engineering
- Brute-force attacks
- Network sniffing
when a malicious party sends a fraudulent email disguised as being from a legitimate, trusted source.
Phishing
- highly targeted phishing attack
- emails are customized to a specific person
Spear phishing
common method for exploiting vulnerabilities
- Gather information about the target system
- One of the pieces of relevant information learned in step 1 might be the operating system
- the attacker looks for any known vulnerabilities specific to that version of OS or other OS services.
- hen a vulnerability is found, the attacker looks for a previously written exploit to use
They consist of a multi-phase, long term, stealthy and advanced operation against a specific target.
advanced persistent threats (APTs)
a public Internet database containing information about domain names and their registrants.
whois
- a popular port scanner
- With a port scanner, an attacker can probe ports of a target computer to learn about which services are running on that computer.
nmap
- attacks are a type of network attack
- results in some sort of interruption of network service to users, devices, or applications.
Denial-of-Service (DoS
This is when a network, host, or application is sent an enormous quantity of data at a rate which it cannot handle
Overwhelming Quantity of Traffic
his is when a maliciously formatted packet is sent to a host or application and the receiver is unable to handle it.
Maliciously Formatted Packets
- when single host attacks
- maliscious attempt by a single person of group of people to cause deny of service to customers
DOS
when multiple hosts attack simultaneously
DDOS
An attacker builds a network of infected hosts
botnet
The infected hosts are called
zombies
types of DOS attacks
- penetration
- eavesdropping
- man-in-the-middle
- flooding
- attacker gets inside your machine
- take over machine and do whatever he wants
- achieves entry via software, stolen password
penetration
- attacker gains access to same network
- listens to traffic going in and out
eavesdropping
- attacker listens in input/output
- can substitute messages in both directions
man-in-the-middle
- attacker sends overwhelming number of messages; great congestion
flooding
how to defend from DOS
- firewall
- router
- switches
prevent users from launching simple flooding type attacks from machines behind firewall
firewall
provide automatic and/or system wide rate limiting, traffic shaping, delayed binding to detect and remediate denial of service attacks
switch
add rules to take flow statistics out of router duing DOS attacks, they further slowdown and complicate the matter
router
DDS based defense
- clean pipes
- nothing can be done to entirely prevent DOS
- minimize dangers
While many legitimate companies specialize in optimizing websites to better position them, a malicious user could use this to make a malicious website appear higher in search results.
SEO Poisoning
attacks that use multiple techniques to compromise a target. By using several different attack techniques at once, attackers have malware that are a hybrid of worms, Trojan horses, spyware, keyloggers, spam and phishing schemes.
Blended attacks
important measures a company should take when a security breach is identified
- Communicate the issue
- Be sincere and accountable in case the company is at fault.
- Provide details.
- Understand what caused and facilitated the breach.
- Apply what was learned from the forensics investigation
- Ensure all systems are clean
- Educate
