Domain 1 Flashcards
SPIM
SPIM is spam (or mass unsolicited messages) but over instant messaging or Internet messaging services, such as WhatsApp, Facebook Messenger, Skype, or Telegram.
Spam
Spam or bulk unsolicited messages, usually sent in the form of email advertisements or other appealing material, may deliver malware or lure a user to another form of attack.
Spear phishing
Spear phishing is a phishing scam where the attacker has some information that makes an individual target more likely to be fooled by the attack.
Whaling
Whaling is a spear phishing attack directed specifically against upper levels of management in the organization (CEOs and other “big fish”).
pharming
Pharming is a passive means of redirecting users from a legitimate website to a malicious one by corrupting the way the victim’s computer performs Internet name resolution.
Credential Harvesting
Credential harvesting is a campaign specifically designed to steal account credentials. The attacker has more interest in selling the database of captured logins than trying to exploit them directly.
Watering Hole
A watering hole attack relies on the circumstance that users may use an unsecure third-party website, like a local pizza firm, which the attacker has compromised.
Typosquatting
Typosquatting occurs when a threat actor registers a domain name that is similar to a real one and tricks users into thinking they are going to a legitimate website even when they misspell the name a little.
Domain hijacking
Domain hijacking is a type of hijacking attack where the attacker steals a domain name by altering its registration information and then transferring the domain name to another entity. Brandjacking is another term for domain hijacking.
Kiting
Kiting is the act of continually registering, deleting, and reregistering a name within the five-day grace period without having to pay for it.
Tasting
Tasting is a Domain Name Server (DNS) exploit that involves registering a domain temporarily to see how many hits it generates within the five-day grace period.
Hoax attack
In a hoax attack, an email alert or web pop-up will claim to have identified some sort of security problem, such as a virus infection, and offer a tool to fix the problem. The tool, of course, will be some sort of Trojan application.
Spyware
Spyware is a program that monitors user activity and sends the information to someone else. This can occur with or without the user’s knowledge.
Rogueware
Rogueware is a fake antivirus web pop-up that claims to have detected viruses on the computer and prompts the user to initiate a full scan, which installs the attacker’s Trojan.
Trust
To be convincing (or to establish trust) usually depends on the attacker obtaining privileged information. An impersonation attack is much more effective if the attacker knows the information about the employee.
Shoulder surfing
Shoulder surfing refers to stealing a password or PIN (or other secure information) by watching the user type it, either in close proximity or remotely.
Lunchtime attack
If a user leaves a workstation unattended while logged on, an attacker can physically gain access to the system (often described as a lunchtime attack).
Tailgating
Tailgating is a means of entering a secure area without authorization by following close behind the person that has been allowed to open the door or checkpoint.
Adware
Adware is software that records information about a PC and its user, and usually displays pop-ups of commercial offers and deals.
Trojan
A Trojan is a malicious program hidden within an innocuous-seeming piece of software. Usually, the Trojan tries to compromise the security of the target computer.
Crypto-malware
Crypto-malware is a class of ransomware that attempts to encrypt data files. If the attack is successful, the user will be unable to access the files without obtaining the private encryption key, which is held by the attacker.
Keylogger
A keylogger actively attempts to steal confidential information by recording keystrokes. The attacker will usually hope to discover passwords or credit card data.
What does Fileless Malware use?
“live off the land” techniques rather than compiled executables to evade detection. This means that the malware code uses legitimate scripting tools like Windows PowerShell. uses lightweight shellcode to achieve a backdoor mechanism on the host.can be classified as using low observable characteristics (LOC) attacks which can make it less intrusive than other malware.
If a user’s computer becomes infected with a botnet, which of the following can this compromise allow the attacker to do?
RAT backdoor applications can allow the attacker to use the computer in a botnet to launch Distributed Denial of Service (DoS) attacks.to launch mass-mail spam attacks.A RAT must establish a connection from the compromised host to a Command and Control (C2 or C&C) host or network operated by the attacker.
What does a worm do?
memory-resident viruses that replicate over network resources. The primary effect of a worm infestation is to rapidly consume network bandwidth as the worm replicates. A worm may also be able to perform a Denial of Service attack by crashing operating systems and servers
What does a program virus do?
program virus, sequences of code insert themselves into another executable program. When executing the application, the virus code becomes active.
What is a multipartite virus?
uses both boot sector and executable file infection methods of propagation.
What is macro virus?
macro virus uses the programming features available in Microsoft Office files.
Password spraying
s a horizontal brute-force online attack. This means that the attacker chooses one or more common passwords and tries to use them in conjunction with multiple usernames.
online password attack
where the hacker interacts directly with the authentication service and submits multiple passwords (and variations) to gain access with a single account (e.g., root).
offline password attack
may involve using a captured database of known passwords or password hashes, even credentials stored in memory.
dictionary attack
occurs when there is a good chance of guessing the likely value of the plaintext or non-complex password with a common word in a dictionary.
What is potentially unwanted programs (PUP)? or Potentially unwanted applications (PUA)?
software installed alongside a package or from a computer store that the user did not request.
What is Adware browser plug-in?
displays commercial offers and deals. Some adware may exhibit spyware-like behavior, by tracking the websites a user visits and displaying targeted ads, for instance.
RootKit
is a backdoor malware that changes core system files and programming interfaces so that local shell processes no longer reveal their presence.
Which of the following attacks do security professionals expose themselves to, if they do not salt passwords with a random value?
Passwords not “salted” with a random value make the ciphertext vulnerable to rainbow table attacks. A rainbow table attack is a password attack that allows an attacker to use a set of plaintext passwords and their hashes to crack passwords.
What is refactoring?
Refactoring means the code performs the same function by using different methods. Refactoring means that the antivirus software may no longer identify the malware by its signature.
