Threats, Attacks, and Vulnerabilities Flashcards
Passive Information Gathering vs. Active Information Gathering
Passive Information Gathering
* where you gather open-source or publicly available information without the organization being aware that the information has been accessed
Active Information Gathering
* probe the organization using DNS Enumeration, Port Scanning, and OS Fingerprinting techniques
Vishing
Phising conducted over voice and phone calls
Phishing
An attempt to fraudulently obtain information from a user
Spear Phishing
Like phishing but usually targeting a specific indivdual/group
Whaling
Form of spear phishing that targets any high-value target in an organization
Like CEO, CFO, CIO, CSO etc.
Pharming
Phishing attempt to trick a user to access a different or fake website
Smishing/Spimming
Phishing conducted of text messaging (SMS)
What kind of attack is an example of IP spoofing?
On-path attack
On-path attacks intercept communications between two systems
What ports would web-based attacks likely appear on?
Port 80 (HTTP) and port 443 (HTTPS)
Zero-day attack
Attack against a vulnerability that is unknown to the original developer or manufacturer
When you see ‘dot-dot-slash (../)’ sequence, it is most likely a…
Directory Traversal Attack
aims to access files and directories stored outside webroot folder
Spoofing
the act of disguising a communication from an unknown source as being known, trusted source
Smurf Attack
Uses a single ping with a spoofed source address sent to the broadcast address of a network
What team monitors and manages defenders’ and attackers’ technical environment during a cybersecurity training excercise?
White team
judge, enforce rules, observes, scores and resolves any problems
Zombie
a computer connected to the internet that has been compromised by as hacker, computer virus, or trojan horse program adn can be used to perform malicious attacks of one sort or another under remote direction
SYN Flood
A variant of DoS where the attacker initiates multiple TCP sessions but never completes the 3-way handshake
Privilege Escalation
Occurs when a user is able to gain the rights of another user or adminstrator
Vertical Privilege Escalation and Horizontal Privilege Escalation
SQL Injections
SQL injections target data stored in enterprise databases by exploiting flaws in client-facing applications, most commonly web applications
What is a way to identify rogue devices on a wired network?
Router and switch-based MAC address reporting
MAC Address
A hardware identifier that uniquely identifies each device on a network
A computer is infected with malware that has infected the Windwos kernal to hide. What type of malware is this?
Rootkit
Rootkit
Software designed to gain administrative level control over a system without detection
Threat Vectors
- Direct Access
- Wireless
- Supply Chain
- Social Media
Bluetooth Attacks
Bluejacking (sending) and Bluesnarfing (taking)
Race Condition
occur when the outcome from execution process is directly dependent on the order and timing of certain events
those events fail to execute in the order and timing inteded by the developer
What technique should be used to mitigate the risk of data remanence when moving virtual hosts from one server to another in the cloud?
Use full-disk encryption
this will ensure that all data is encrypted and cannot be exposed to other organizations
Shoulder Surfing
type of social engineering technique used to obtain personal identification numbers (PINs), passwords, and other confidential data by looking over the victim’s shoulder
Integer Overflow Attack
occurs when an arithmetic operation results in a large number to be stored in the space allocated for it
Threat Hunting
the utilization of insights gained from threat research and threat modeling to proactively discover evidence of an adversarial TTP within a network or system
Banner Grabbing
not on exam objectives?
conducted by actively connecting to the server using telnet or netcat and collecting the web server’s response
this banner usually contains the server’s operating system and the version number of the service (SSH) being run
this is the fastest and easiest way to determine the SSH version being run on this web server
True Positive Alert
Malicious activity is identified as an attack
True Negative Alert
Legitimate activity is identified as legitimate trafic
False Positive Alert
Legitimate activity is identified as an attack
False Negative Alert
Malicious activity is identified as legitimate traffic
Private IP Adresses
should this be in a diff section?
Private IP Adresses are either:
10.x.x.x
172.16-31.x.x
192.168.x.x
ALL other IP addresses are considered publicly routable over the internet (except localhost and APIPA addresses)
Network Mapping
should this be in a diff section?
the study of the physical and logical connectivity of networks
helps develop adequate detailed network documentation
Signature-based Monitoring
analyzes frames and packets of network traffic for predetermined attack patterns
attack patterns are known as signatures
Anomaly-based Monitoring
definition?
zero-day attacks are best mitigated with behavior- or anomaly-based detection methods
Polymorphic Virus
Polymorphic viruses change their signature each time they run to avoid antivirus software
Fileless Virus
reside in memory
often take advantage of PowerShell to perform actions once they have used a vulnerability in a browser or broswer plug-in to inject themselves into system memory
XSRF or CSRF
Cross-site Request Forgery
sends forged requests to a website, supposedly from a trusted user
War Driving/Flying
When dial-up modems were in heavy use, hackers would conduct ware dialing exercises to many phones numbers to find modems that would answer
When wireless networks became the norm, the same type of language was used, leading to terms like war driving, walking and even war flying
ARP Poisoning
consists of abusing the weaknesses in ARP to corrupt the MAC-to-IP mapping of other devices on the network
DoS
Denial-of-service
may target a memory leak
Uncredtialed Scans
Uncredentialed scans are generally unable to detect many vulnerabilities on a device
Rogue Anti-virus
a form of malicious software and internet fraud that misleads users into believing there is a virus on their computer and to pay money for a fake malware removal tool
“Your computer is infected with a virus, click here to remove it!”
Password Spraying
when an attacker uses common passwords to attempt to access several accounts
SSL Stripping/HTTP Downgrade
STRIPS THE S FROM HTTPS
combines an on-path attack with a downgrade attack
attacker MUST sit in the middle of the conversation, victim does not see any significant problem except browser isnt encrypted
Shimming
filling in the space between two objects
Windows includes it’s own shim, malware authors write their own shims
Refactoring
metamorhpics malware
make it appear different each time, can intelligently redesign itself, difficult to match with signature-based detection
Initialization Vector (IV)
way to add randomization to the encryption scheme being used
WEP, SSL implementations
Visual Basic for Applications (VBA)
programming language developed and owned by Microsoft
with VBA you can create macros
Shadow IT
use of IT-related hardware or software by a department or individual without the knowledge or approval of IT
Non-intrusive Scan
simply identify and report on a vulnerability
gathers information
Intrusive Scan
attemp to exploit a vulnerability when it is found
Non-credentialed Scan
the scanner cannot login to the remote device
Credentialed Scan
youu’re a normal user, emulates an insider attack
Common Vulnerabilities and Exposures (CVE)/ Common Vulnerability Scoring System (CVSS)
list of publicly disclosed computer security flaws
Fake Telemetry
machine learning
train the machine with actual data but then send the machine learning model fake telemetry to think that the malware is actually good
i used the word in the definition D:
DNS Sinkhole
A DNS that hands out incorrect IP addresses
an attacker can redirect users to a malicious site
DNS Posioning
attempt to insert incorrect or malicious entries into a trusted DNS server
Pass the hash
process of harvesting an account’s cached credentials when the user logs in to a SSO system
allows the attacker to use the credentials on other systems
Cognitive Password Attack
form of knowledge-based authentication that requires a user to answer a question, presumably something they intrinsically know, to verify their identity
like finding personal info on social media and using that information to crack your password
