MODULE 14 - CERTIFICATION CYBER OPS ASSOCIATE Flashcards
Malware
Types of Malware
End devices are especially prone to malware attacks. Therefore, the focus of this topic is on threats to end devices.
Malware is short for malicious software or malicious code.
It is code or software that is specifically designed to damage, disrupt, steal, or generally inflict some other “bad” or illegitimate action on data, hosts, or networks.
It is important to know about malware because threat actors and online criminals frequently try to trick users into installing malware to help exploit security gaps.
In addition, malware morphs so rapidly that malware-related security incidents are extremely common because antimalware software cannot be updated quickly enough to stop the new threats.
Viruses A virus is a type of malware that spreads by inserting a copy of itself into another program.
After the program is run, viruses then spread from one computer to another, infecting the computers. Most viruses require human help to spread.
For example, when someone connects an infected USB drive to their PC, the virus will enter the PC.
The virus may then infect a new USB drive, and spread to new PCs. Viruses can lay dormant for an extended period and then activate at a specific time and date.
A simple virus may install itself at the first line of code in an executable file.
When activated, the virus might check the disk for other executables so that it can infect all the files it has not yet infected.
Viruses can be harmless, such as those that display a picture on the screen, or they can be destructive, such as those that modify or delete files on the hard drive.
Viruses can also be programmed to mutate to avoid detection. Most viruses are now spread by USB memory drives, CDs, DVDs, network shares, and email. Email viruses are a common type of virus.
Trojan Horses
The term Trojan horse originated from Greek mythology. Greek warriors offered the people of Troy (the Trojans) a giant hollow horse as a gift.
The Trojans brought the giant horse into their walled city, unaware that it contained many Greek warriors.
At night, after most Trojans were asleep, the warriors burst out of the horse, opened the city gates, and allowed a sizeable force to enter and take over the city.
Trojan horse malware is software that appears to be legitimate, but it contains malicious code which exploits the privileges of the user that runs it.
Often, Trojans are found attached to online games.
Users are commonly tricked into loading and executing the Trojan horse on their systems. While playing the game, the user will not notice a problem.
In the background, the Trojan horse has been installed on the user’s system. The malicious code from the Trojan horse continues operating even after the game has been closed. The Trojan horse concept is flexible.
It can cause immediate damage, provide remote access to the system, or access through a back door. It can also perform actions as instructed remotely, such as “send me the password file once per week.”
This tendency of malware to send data back to the cybercriminal highlights the need to monitor outbound traffic for attack indicators. Custom-written Trojan horses, such as those with a specific target, are difficult to detect.
Trojan Horse Classification:
https://snipboard.io/s0Sn1G.jpg
Trojan horses are usually classified according to the damage that they cause, or the manner in which they breach a system, as shown in the figure.
Type of Trojan Horse ::
– Remote-access
– Data-sending
– Destructive
– Proxy
– FTP
– Security software disabler
– Denial of Service (DoS)
– Keylogger
Type of Trojan Horse ::
– Remote-access
– Data-sending
– Destructive
– Proxy
– FTP
– Security software disabler
– Denial of Service (DoS)
– Keylogger
Remote-access :
Enables unauthorized remote access.
Type of Trojan Horse ::
– Remote-access
– Data-sending
– Destructive
– Proxy
– FTP
– Security software disabler
– Denial of Service (DoS)
– Keylogger
Data-sending :
Provides the threat actor with sensitive data, such as passwords.
Type of Trojan Horse ::
– Remote-access
– Data-sending
– Destructive
– Proxy
– FTP
– Security software disabler
– Denial of Service (DoS)
– Keylogger
Destructive:
Corrupts or deletes files.
Type of Trojan Horse ::
– Remote-access
– Data-sending
– Destructive
– Proxy
– FTP
– Security software disabler
– Denial of Service (DoS)
– Keylogger
Proxy :
Uses the victim’s computer as the source device to launch attacks and perform other illegal activities.
Type of Trojan Horse ::
– Remote-access
– Data-sending
– Destructive
– Proxy
– FTP
– Security software disabler
– Denial of Service (DoS)
– Keylogger
FTP :
Enables unauthorized file transfer services on end devices.
Type of Trojan Horse ::
– Remote-access
– Data-sending
– Destructive
– Proxy
– FTP
– Security software disabler
– Denial of Service (DoS)
– Keylogger
Security software disabler ::
Stops antivirus programs or firewalls from functioning.
Type of Trojan Horse ::
– Remote-access
– Data-sending
– Destructive
– Proxy
– FTP
– Security software disabler
– Denial of Service (DoS)
– Keylogger
Denial of Service (DoS) :
Slows or halts network activity.
Type of Trojan Horse ::
– Remote-access
– Data-sending
– Destructive
– Proxy
– FTP
– Security software disabler
– Denial of Service (DoS)
– Keylogger
Keylogger :
Actively attempts to steal confidential information, such as credit card numbers, by recording keystrokes entered into a web form.
Worms Computer
worms are similar to viruses because they replicate and can cause the same type of damage.
Specifically, worms replicate themselves by independently exploiting vulnerabilities in networks.
Worms can slow down networks as they spread from system to system.
Whereas a virus requires a host program to run, worms can run by themselves.
Other than the initial infection, they no longer require user participation. After a host is infected, the worm is able to spread very quickly over the network.
Worms are responsible for some of the most devastating attacks on the internet.
In 2001, the Code Red worm had initially infected 658 servers. Within 19 hours, the worm had infected over 300,000 servers. – Initial Code Red Worm Infection – Code Red Infection 19 hours later
Whereas a virus requires a host program to run, worms can run by themselves. Other than the initial infection, they no longer require user participation.
After a host is infected, the worm is able to spread very quickly over the network. Worms are responsible for some of the most devastating attacks on the internet.
In 2001, the Code Red worm had initially infected 658 servers. Within 19 hours, the worm had infected over 300,000 servers. – Initial Code Red Worm Infection – Code Red Infection 19 hours later
Initial Code Red Worm Infection : The initial infection of the SQL Slammer worm is known as the worm that ate the internet. SQL Slammer was a denial of service (DoS) attack that exploited a buffer overflow bug in Microsoft’s SQL Server.
At its peak, the number of infected servers doubled in size every 8.5 seconds. This is why it was able to infect 250,000+ hosts within 30 minutes.
When it was released on the weekend of January 25, 2003, it disrupted the internet, financial institutions, ATM cash machines, and more.
Ironically, a patch for this vulnerability had been released 6 months earlier. The infected servers did not have the updated patch applied. This was a wake-up call for many organizations to implement a security policy requiring that updates and patches be applied in a timely fashion.
Whereas a virus requires a host program to run, worms can run by themselves.
Other than the initial infection, they no longer require user participation. After a host is infected, the worm is able to spread very quickly over the network.
Worms are responsible for some of the most devastating attacks on the internet. In 2001, the Code Red worm had initially infected 658 servers.
Within 19 hours, the worm had infected over 300,000 servers. – Initial Code Red Worm Infection – Code Red Infection 19 hours later
Code Red Infection 19 hours later : The initial infection of the SQL Slammer worm is known as the worm that ate the internet. SQL Slammer was a denial of service (DoS) attack that exploited a buffer overflow bug in Microsoft’s SQL Server.
At its peak, the number of infected servers doubled in size every 8.5 seconds. This is why it was able to infect 250,000+ hosts within 30 minutes.
When it was released on the weekend of January 25, 2003, it disrupted the internet, financial institutions, ATM cash machines, and more. Ironically, a patch for this vulnerability had been released 6 months earlier.
The infected servers did not have the updated patch applied. This was a wake-up call for many organizations to implement a security policy requiring that updates and patches be applied in a timely fashion.
Worms share similar characteristics.
They all exploit an enabling vulnerability, have a way to propagate themselves, and they all contain a payload.
Worms share similar characteristics.
They all exploit an enabling vulnerability, have a way to propagate themselves, and they all contain a payload.
Worm Components
Despite the mitigation techniques that have emerged over the years, worms have continued to evolve and pose a persistent threat.
Worms have become more sophisticated over time, but they still tend to be based on exploiting weaknesses in software applications.
Common Worm Pattern :
– Enabling vulnerability
– Propagation mechanism
– Payload
Common Worm Pattern :
– Enabling vulnerability
– Propagation mechanism
– Payload
Enabling vulnerability :
A worm installs itself using an exploit mechanism, such as an email attachment, an executable file, or a Trojan horse, on a vulnerable system.
Common Worm Pattern :
– Enabling vulnerability
– Propagation mechanism
– Payload
Propagation mechanism :
After gaining access to a device, the worm replicates itself and locates new targets.
Common Worm Pattern :
– Enabling vulnerability
– Propagation mechanism
– Payload
Payload :
Any malicious code that results in some action is a payload.
Most often this is used to create a backdoor that allows a threat actor access to the infected host or to create a DoS attack.
Worms are self-contained programs that attack a system to exploit a known vulnerability.
Upon successful exploitation, the worm copies itself from the attacking host to the newly exploited system and the cycle begins again.
Their propagation mechanisms are commonly deployed in a way that is difficult to detect.
The propagation technique used by the Code Red worm is shown in the figure.
Code Red Worm Propagation
https://snipboard.io/ZKmzPE.jpg
Note: Worms never really stop spreading on the internet. After they are released, worms continue to propagate until all possible sources of infection are properly patched.
Ransomware Threat
actors have used viruses, worms, and Trojan horses to carry their payloads and for other malicious reasons.
However, malware continues to evolve.
Currently, the most dominating malware is ransomware.
Ransomware is malware that denies access to the infected computer system or its data.
The cybercriminals then demand payment to release the computer system.
Ransomware
Ransomware has evolved to become the most profitable malware type in history.
In the first half of 2016, ransomware campaigns targeting both individual and enterprise users became more widespread and potent.
There are dozens of ransomware variants. Ransomware frequently uses an encryption algorithm to encrypt system files and data.
The majority of known ransomware encryption algorithms cannot be easily decrypted, leaving victims with little option but to pay the asking price.
Payments are typically paid in Bitcoin because users of bitcoin can remain anonymous.
Bitcoin is an open-source, digital currency that nobody owns or controls.
Ransomware Email and malicious advertising, also known as malvertising, are vectors for ransomware campaigns.
Social engineering is also used, as when cybercriminals who identify themselves as security technicians call homes and persuade users to connect to a website that downloads the ransomware to the user’s computer..
Email and malicious advertising, also known as malvertising, are vectors for ransomware campaigns.
Social engineering is also used, as when cybercriminals who identify themselves as security technicians call homes and persuade users to connect to a website that downloads the ransomware to the user’s computer..
Other Malware These are some examples of the varieties of modern malware:
– Spyware
– Adware
– Scareware
– Phishing
– Rootkits
This list will continue to grow as the internet evolves. New malware will always be developed. A major goal of cybersecurity operations is to learn about new malware and how to promptly mitigate it.
Spyware :
Used to gather information about a user and send the information to another entity without the user’s consent.
Spyware can be a system monitor, Trojan horse, Adware, tracking cookies, and key loggers.
Other Malware These are some examples of the varieties of modern malware:
– Spyware
– Adware
– Scareware
– Phishing
– Rootkits
This list will continue to grow as the internet evolves. New malware will always be developed. A major goal of cybersecurity operations is to learn about new malware and how to promptly mitigate it.
Adware :
Displays annoying pop-ups to generate revenue for its author. The malware may analyze user interests by tracking the websites visited.
It can then send pop-up advertising pertinent to those sites.
Other Malware These are some examples of the varieties of modern malware:
– Spyware
– Adware
– Scareware
– Phishing
– Rootkits
This list will continue to grow as the internet evolves. New malware will always be developed. A major goal of cybersecurity operations is to learn about new malware and how to promptly mitigate it.
Scareware :
Includes scam software which uses social engineering to shock or induce anxiety by creating the perception of a threat.
It is generally directed at an unsuspecting user and attempts to persuade the user to infect a computer by taking action to address the bogus threat.
Other Malware These are some examples of the varieties of modern malware:
– Spyware
– Adware
– Scareware
– Phishing
– Rootkits
This list will continue to grow as the internet evolves. New malware will always be developed. A major goal of cybersecurity operations is to learn about new malware and how to promptly mitigate it.
Phishing :
Attempts to convince people to divulge sensitive information.
Examples include receiving an email from their bank asking users to divulge their account and PIN numbers.
Other Malware These are some examples of the varieties of modern malware:
– Spyware
– Adware
– Scareware
– Phishing
– Rootkits
This list will continue to grow as the internet evolves. New malware will always be developed. A major goal of cybersecurity operations is to learn about new malware and how to promptly mitigate it.
Rootkits :
Installed on a compromised system.
After it is installed, it continues to hide its intrusion and provide privileged access to the threat actor.
Common Malware Behaviors
Cybercriminals continually modify malware code to change how it spreads and infects computers.
However, most produce similar symptoms that can be detected through network and device log monitoring.
Computers infected with malware often exhibit one or more of the following symptoms:
Appearance of strange files, programs, or desktop icons
Antivirus and firewall programs are turning off or reconfiguring settings
Computer screen is freezing or system is crashing
Emails are spontaneously being sent without your knowledge to your contact list
- Files have been modified or deleted
- Increased CPU and/or memory usage
- Problems connecting to networks
- Slow computer or web browser speeds
- Unknown processes or services running
- Unknown TCP or UDP ports open
- Connections are made to hosts on the Internet without user action
- Strange computer behavior
Note: Malware behavior is not limited to the above list.
Common Network Attacks
- Reconnaissance,
Access, and
Social Engineering
Types of Network Attacks Malware is a means to get a payload delivered. When it is delivered and installed, the payload can be used to cause a variety of network-related attacks from the inside. Threat actors can also attack the network from outside.
Why do threat actors attack networks?
There are many motives including money, greed, revenge, or political, religious, or sociological beliefs.
Network security professionals must understand the types of attacks used to counter these threats to ensure the security of the LAN.
Why do threat actors attack networks?
There are many motives including money, greed, revenge, or political, religious, or sociological beliefs.
Network security professionals must understand the types of attacks used to counter these threats to ensure the security of the LAN.
To mitigate attacks, it is useful to first categorize the various types of attacks.
By categorizing network attacks, it is possible to address types of attacks rather than individual attacks.
To mitigate attacks, it is useful to first categorize the various types of attacks.
By categorizing network attacks, it is possible to address types of attacks rather than individual attacks.
Although, there is no standardized way of categorizing network attacks, the method used in this course classifies attacks in three major categories.
Reconnaissance Attacks Access Attacks DoS Attacks
Reconnaissance Attacks
Reconnaissance is information gathering.
It is analogous to a thief surveying a neighborhood by going door-to-door pretending to sell something.
What the thief is actually doing is looking for vulnerable homes to break into, such as unoccupied residences, residences with easy-to-open doors or windows, and those residences without security systems or security cameras.
Threat actors use reconnaissance (or recon) attacks to do unauthorized discovery and mapping of systems, services, or vulnerabilities.
Recon attacks precede access attacks or DoS attacks. Some of the techniques used by malicious threat actors to conduct reconnaissance attacks are described in the table.
– Perform an information query of a target
– Initiate a ping sweep of the target network
– Initiate a port scan of active IP addresses
– Run vulnerability scanners
– Run exploitation tools
