Section 9: Identifying Threats, Attacks and Vulnerabilities Flashcards
If you install a freeware program that analyzes your computer and then finds 40,000 exploits and asks you to purchase the full version, what type of attack is this?
When you part with your money, this is ransomware.
Describe how a fileless virus operates.
Piggybacks itself onto a legitimate application, and they both launch together.
Using Malwarebytes would alert you of both launching at the same time.
How does an attacker carry out credential harvesting?
A phishing attack where you are warned that an account has been hacked, and it gives you a link to a website to resolve it. When you try to log in, they collect your details.
How is pretexting used in an attack?
An attacker manufactures a scenario and they ask you to confirm your account details to steal them.
How does an invoice scam work?
An attacker obtains the details of a legitimate invoice and substitutes the bank details with their own.
How does an attacker carry out password spraying?
An attacker works out what standard naming convention a company is using, and they then obtain the names of employees from the internet. They then try common passwords against those accounts.
How does an attacker use a malicious USB drive?
An attacker leaves a malicious USB drive inside a company where it can be found. There is only one shortcut, so when the finder puts it in their computer to try and find the owner, they click on the shortcut and release the virus into their system. The attacker can now control their computer.
How does artificial intelligence training help attackers?
AI uses machine learning to teach the machine to think like a human and detect attacks. If it is tainted, it will ignore some attacks.
When you go to a restaurant, how can you protect yourself against card cloning?
Ensure that the server does not disappear with your card, make sure it is always visible to you.
What is an on-path attack?
An interception attack. I.e. a replay or man-in-the-middle attack.
Why is operational technology vulnerable to attack?
Operational technology is where we have removed CCTV standalone systems that were air-gapped and now use a fully integrated solution that is fully connected, leaving them vulnerable to attack.
Give an example of crypto-malware?
Ransomware where the victim’s hard drive is encrypted and held to ransom. It could also have popups.
What type of malware self-replicates and which virus self-propagates itself?
A virus self-replicates.
A worm self-propagates.
What type of virus inserts a .dll into either the SysWOW64 or System32 folder?
Trojan.
What is an RAT?
Remote Access Trojan (RAT) is a trojan that sends the user’s username and password to an external source so that a remote session can be created.
What type of virus attack keeps coming back even when the operating system has been reinstalled on Windows, or the Bash shell on Linux?
A rootkit virus, because it resides in the Master Boot Record (MBR) or uses the Bash shell in Linux.
How does a logic bomb virus work?
Triggered by an event; for example, a Fourth of July logic bomb would activate when the date on the computer was July 4. It is triggered by time, script, .bat/ .cmd files or a task scheduler.
What is the purpose of a keylogger?
Can run from a USB flash drive plugged into the back of a computer which then records all the keystrokes being used. It can capture sensitive data that is typed in.
What is a botnet?
A group of computers that have been infected so that they can be used to carry out malicious acts without the real attacker being identified. They could be used for a DDoS attack.
Explain a phishing attack.
A type of attack in which an indiscrimate email asks users to fill in a form requesting their bank details or PII.
How does spear phishing differ from a phishing attack?
A phishing attack that has been sent to a specific group of users.
What is a whaling attack?
Uses email to target a CEO or high-level executive in a company.
What type of attack can include leaving a voicemail?
Vishing.
What is tailgating?
A form of social engineering where someone has used a smart card or entered a pin to access a door, and then someone behind them passes through the door before it closes, entering no creds.
