Lesson 4 & 5 Flashcards
Pretexting
(form of impersonation) Using a scenario with convincing
additional detail The classic impersonation attack is for the social engineer to phone into a department,
claim they have to adjust something on the user’s system remotely, and get the user to
reveal their password. This specific attack is also referred to as pretexting.
Tailgating
- Access premises covertly
* Follow someone else through a door
• Piggy backing
- Access premises without authorization, but with the knowledge of an employee
- Get someone to hold a door open
• Identity fraud
- Impersonation with convincing detail and stolen or spoofed proofs
- Identity fraud versus identity theft
• Invoice scams
• Spoofing supplier details to submit invoices with false account details
• Credential theft and misuse
Credential harvesting
• Shoulder surfing
• Lunchtime attack
PHishing, whaling, vishing, spear fishing, sMishing
you know this
Spam
- Unsolicited email
- Email address harvesting
- Spam over Internet messaging (SPIM) (instant messagin service
Hoaxes
- Delivered as spam or malvertising
- Fake advertisement to get user to install remote desktop software
- Phone-based scams
Hoaxes, such as security alerts or chain emails, are another common social
engineering technique, often combined with phishing attacks. An email alert or web
pop-up will claim to have identified some sort of security problem, such as virus
infection, and offer a tool to fix the problem.
Prepending
adding text that appears to have been generated by the mail
system.
- Tagging email subject line
- Can be used by threat actor as a consensus or urgency technique
- Can be added by mail systems to warn users
Pharming
(passive technique)
• Redirection by DNS spoofing
Pharming is a passive means of redirecting users from a legitimate website to a
malicious one. Rather than using social engineering techniques to trick the user,
pharming relies on corrupting the way the victim’s computer performs Internet name
resolution, so that they are redirected from the genuine site to the malicious one. For
example, if mybank.foo should point to the IP address 2.2.2.2, a pharming attack would
corrupt the name resolution process to make it point to IP address 6.6.6.6.
Typosquatting
Www.comptia.org ==> www.connptia.org
Use cousin domains instead of redirection
• Make phishing messages more convincing
• Watering hole
- Target a third-party site
* Customer, supplier, hobbies, social media…
• Credential harvesting
• Attacks focused on obtaining credentials for sale rather than direct
intrusion
• Attacks focused on obtaining multiple credentials for single
company
Influence Campaigns
Sophisticated threat actors using multiple resources to change opinions on a mass scale - Soft power - Hybrid Warfare -social Media
• Soft power
• Leveraging diplomatic and cultural assets
• Hybrid warfare
• Use of espionage, disinformation, and hacking
• Social media (influence campaign)
- Use of hacked accounts and bot accounts
* Spread rumor and reinforce messaging
• Viruses and worms
• Spread within code without authorization
Trojans
• A malicious program concealed within a benign one
• Potentially unwanted programs/applications (PUPs/PAPs)
•Nonecessarily regarded as malicious
Pre-installed “bloatware” or installed alongside another app
• Not completely concealed, but installation may be covert
• Also called grayware
Computer Viruses
• Rely on some sort of host file or media • Non-resident/file infector • Memory resident • Boot • Script/macro • Multipartite • Polymorphic • Vector for delivery
Multipartite
virus uses multiple vectors
Polymorphic
(virus) able to obfuscate code to avoid detection
• Early computer worms
- Propagate in memory/over network links
* Consume bandwidth and crash process
• Fileless malware
does not write code to disk. avoids detection
“Living off the land”
Advanced persistent threat (APT)/advanced volatile threat (AVT)/
low observable characteristics (LOC)
All used to describe fileless live off the land malware
• Backdoor malware
Any type of access method to a host that circumvents the usual authentication method
and gives the remote user administrative control can be referred to as a backdoor.
RAT
Remote Access Trojan
backdoor malware that mimics the functionality of
legitimate remote control programs
bots and botnet
A group of bots that are all under
the control of the same malware instance can be manipulated as a botnet by the
herder program. A botnet can be used for many types of malicious purpose, including
triggering distributed denial of service (DDoS) attacks, launching spam campaigns, or
performing cryptomining.
• Command & control (C2 or C&C)
Whether a backdoor is used as a standalone intrusion mechanism or to manage
bots, the threat actor must establish a connection from the compromised host to a
command and control (C2 or C&C) host or network.
Ransomware
Nuisance (lock out user by
replacing shell)
usually easier to fix
