Security Flashcards
CIA triad
Confidentiality like encryption
Integrity like hashing
Availability like uptime or redundancy
Non-compliant System
System that is not compliant with the configuration baseline of what is approved by the organization
Configuration baseline
set of recommendations for deploying a computer in a hardened configuration
Unprotected System
system not protected by any antivirus or firewall
Unpatched System
system without patches or updates applied even though they are available
What are some Windows releases that are EOL as of 2023?
Windows XP
Windows Vista
Windows 7
Bring Your Own Device (BYOD)
Use of personal devices in an office environment
Zero-day Exploit
unknown exploit that exposes previously unknown vulnerabilities
Denial of Service (DOS)
attack that attempts to make a computer or server’s resources unavailable
Flood Attack
type of DoS that attempts to send more packets to a server or host than it can handle
Ping Flood
Flood attack that happens when too many pings (ICMP echo) are being sent
SYN Flood
Attacker initiates multiple TCP sessions but never completes the three-way handshake
Permanent Denial of Service (PDoS)
attack that exploits a security flaw to permanently break a networking device by reflashing its firmware
Fork Bomb
attack that creates a large number of processes to use up the available processing power of a computer. It is not considered a “worm” because it does not infect the programs.
Distributed Denial of Service (DDoS)
uses lots of machines to attack a server to create a DoS
DNS Amplification
the attacker typically uses a botnet or a group of compromised computers to send a large number of DNS queries to open DNS resolvers. The source IP address of these queries is spoofed on the hackers machine to make it look like they are coming from the victim’s IP address. When the open DNS resolvers respond to these queries, the response is sent to the spoofed source IP address, which is the victim’s IP address. Because the response is typically much larger than the original query, this can overwhelm the victim’s network and cause a denial of service.
Blackhole/Sinkhole
identifies attacking IP addresses and routes them to a non-existent server through the null interface
Spoofing
occurs when an attacker masquerades as another person by falsifying their identity
ARP Spoofing/”Poisoning”
sending fake ARP messages to a local netowkr in order to associate a fake MAC address with a legitimate IP address, thereby intercepting network traffic intended for the legitimate device.
On-Path Attack
occurs when an attacker puts themself between the victim and the intended destination
Replay
occurs when valid data is captured by the attacker and is then repeated immediately, or delayed, and then repeated. an example is capturing someone’s log-in credentials and storing it, and then logging into their account later on in the day.
Relay attack
when the attacker inserts themself in between the two hosts and intercepts legitimate communication but relaying the information to a C2 or 3rd party.
SSL Stripping
when an attacker tricks the encryption application into presenting the user with an HTTP connection instead of an HTTPS connection
Downgrade Attack
when an attacker attempts to have a client or server abandon a higher security mode in favor of a lower security mode by intercepting the communication between two systems that are negotiating the protocol version to be used, and then modifying the negotiation messages to suggest an older and less secure protocol version.
SQL injection
attack consisting of the insertion or injection of an SQL query via input data from the client to a web application
Injection Attack
insertion of additional information or code through data input from a client to an application. Common types are SQL, HTML, XML, LDAP
Cross-Site Scripting (XSS)
when an attacker embeds malicious scripting commands on a trusted website
Stored/Persistent - XSS attack
attacker injects malicious code into a web application that is then stored on the server and served to all users who access the page. Like adding a comment with XSS injection of a JS alert that whenever someone else loads the page, it shows them that alert. Blind XSS is the same but you cannot see it, like adding XSS into a private report comment to an admin.
Reflected - XSS attack
when an attacker injects malicious code into a website that is then reflected back to the user in a dynamic response, such as a search query or a form submission. The victim’s browser then executes the malicious code, allowing the attacker to steal sensitive information or perform other malicious actions on behalf of the victim.
Document Object Model (DOM) - XSS attack
attempt to exploit the victim’s web browser
How to prevent SQL injections?
ensure your website has data validation and sanitizing user inputs
How to prevent XSS attacks?
with output encoding and proper input validation
Cross-Site Request Forgery (XSRF/CSRF)
when an attacker tricks a user into performing an action on a website that they did not intend to perform while they are already authenticated on the website. An example is an attacker sending a malicious link that when clicked, will have the victim go to their online banking app and transfer funds to the attackers account.
How to prevent XSRF/CSRF?
with tokens, encryption, XML file scanning, and cookie verification
Password Analysis Tool
Used to test the strength of passwords to ensure password policies are being followed
Password Cracker
uses comparative analysis to break passwords and systematically continues guessing until the password is determined
What are the different types of password cracking methods?
password guessing, dictionary attack, brute-force attack, cryptanalysis attack
Password Guessing
occurs when a weak password is simply figured out by a person
Dictionary Attack
method where a program attempts to guess the password by using a list of possible passwords
Brute-Force Attack
method where a program attempts to try every possible combination until it cracks the password
Cryptanalysis Attack
comparing a precomputed encrypted password to a value in a lookup table. Example is a rainbow attack - breaching the target machines password storage of hashes, and using a rainbow table to compare.
Insider Threat
An employee or other trusted insider who uses their authorized network access in unauthorized ways to harm the company
Logic Bomb
specific type of malware that is tied to either a logical event or a specific time
Boot sector - Virus
virus that is stored in the first sector of a hard drive and is loaded into memory upon boot. Only targets MBR and is installed via removable media
Macro - Virus
virus embedded into a document and is executed when the document is opened by the user
Program - Virus
seeks out executables or application files to infect
Multipartite - Virus
combines boot and program viruses to first attach itself to the boot sector and system files before attacking other files on the computer
Encryption - Virus
uses a cipher to encrypt its contents to avoid any antivirus software
Polymorphic - Virus
will encrypt its own code in a unique way so that is appears different each time it infects a new file or system in order to evade antivirus software
Metamorphic - Virus
has the ability to rewrite itself entirely before attempting to infect a file
Armored - Virus
has a layer of protection to confuse a program or a person who’s trying to analyze it
Hoax Viruses
tries to trick a user to infect its own machine
Worm
malicious software that can replicate itself without any user interaction
Trojan
a piece of malicious software that is disguised as a piece of harmless or desirable software
Remote Access Trojan (RAT)
provides the attacker with remote control of a victim computer
Stealth Viruses
a category for any virus protecting itself
Virus
malicious code that runs on a machine without the user’s knowledge and infects the computer when executed
Ransomware
malware that restricts access to a victim’s computer system until a ransom is received
Spyware
malware that secretly gather information about the user without their consent
Adware
displays advertisements based on your activity. falls into the category of spyware
Grayware
software that isn’t benign nor malicious and tends to behave improperly without serious consequences
