Threats, Vulnerabilities and Mitigations 2.1-2.2 Flashcards
Threat Vectors
Method used by the attacker to infect or gain access to the target.
A lot of work goes into finding vulnerabilities
Places where malicious code can be stored.
An adobe PDF file,
ZIP/RAR files
Microsoft office - Marcos within documents
Voice call vectors
Vishing - phising over the phone
Scam over IP - Large scale phone calls
War dialling
Call tampering - Disrupting phone calls
Removable device vectors
USB - helps to get into an air gapped network. (No connection to a network)
Attributes of threat actors
- Internal/External
- Resources/funding
- Level of Sophistication/Capability
Motivations of threat actors
- Data exfiltration
-Espionage
-Service disruption
-Blackmail
-Financial gain
-Philosophical/Politcal Beliefs
-Ethical
-Revenge - Chaos
-War
Motivations for a nation state to act as a threat actor
Motivations:
Data exfiltration
Philosophical
Revenge
Disruption
War
Resources and Sophistication of nation states acting as a threat actor?
Commonly an Advanced Persistent threat (APT)
Has massive resources, are highly sophisticated.
Example: Stuxnet Worm - destroy nuclear centrifuges
Unskilled attackers
Run pre-made scripted without any knowledge of whats really happening. Motivated by the hunt. Can be internal or external, Not very Sophisticated.
Hacktivist
A hacker with a purpose, motivated by philosophy, revenge disruption, etc.
Funding may be limited
Insider threat
Extensive resources - using the organisations resources against themselves
An internal entity -
Medium level of sophistication - insider has very specific knowledge which can be directed at vulnerable systems.
Organised Crime
Professional Criminals - Motivated by making money
Very Sophisticated
lots of capital to fund hacking activities
May have corporate structure.
Shadow IT
Going rogue within the the existing organisation. Working around the internal IT organisation
Builds their own infrastructure.
Limited Resources
Message based vectors
Email
Sms
Phishing attacks
Image based vectors
Images which contain malicious code within them, less easy to identify the threat.
vulnerable client software vector
Infected executable
Known or unknown vulnerability
May require constant updates.
Vulnerable agent software vectors
No installed executable
Compromised software on the server would affect all users
Attacker can distribute this easily because each new connection to this server runs a new instance ach time.
Unsupported System Vectors
Patching is an important prevention tool.
Unsupported systems may not have patching options because they are outdated and the manufacturer doesn’t provide updates
Unsecure network vectors
Wireless outdated security protocols such as WEP, WPA, WPA2
Wired or wireless unsecure interfaces can be made more secure with 802.1x which will prevent connection without credentials
Bluetooth can be used bt a threat actor for reconnaissance.
Phishing
Social engineering which methods which is designed to make people think something is real when it is not. (example: a URL which takes you to a fake website which looks like a real one)
Phishing Tricks and misdirection
- Typosquating Misdirection
-Pretexting - Lying to get information
-Vishing (Voice Phishing)
-Smishing (SMS Phishing).
Impersonation
Attacker pretends to be someone they aren’t.
Attack the victim as someone higher in rank
Throw tons of technical details
Identity Fruad
Credit Card Fraud
Bank Fraud
Loan Fraud
Government benefits fraud
How to protect against impersonation
Never volunteer information
Don’t disclose personal details
Always verify before revealing info
Verification should be encouraged.
Open service Ports ?
Most network-based services connect over a TCP or a UDP port
Threat actors can access systems via to open ports
Supply chain threat vector
Threat Actors can tamper with the underlying infrastructure during the manufacturing process before it is in installed.
MSP -Managed service provider (attackers can target the MSP)
Phishing
Social Engineering to trick people into believing a fake scam to get information from them.,
Often delivered by email, text
Methods tricks and misdirection used by attackers
Typosquatting - URL hijacking
Prextexting - Lying to get information
Vishing (Voice Phishing)
Smishing (SMS phishing)
Impersonation
Attackers pretend to be someone they aren’t
Use some of those details from reconnaissance
attack the victim as a higher rank
Identity fraud
Your identity can be stolen by others
Credit card fraud
Bank fraud
Loan Fraud
Government benefit fraud
How to protect against impersonation
Never volunteer information
Don’t disclose personal details
Always verify before revealing info
Verification should be encouraged.
Waterhole attack
Attacker will put malicious or infectious software on a website or software that the victim group uses and waits for them to visit the website.
How to defend against a watering hole attack
Layered defence, Firewalls and IPS (Stop the network traffic before things get bad).
Other social networking technique
Misinformation/Disinformation
- Disseminate factually incorrect information
-Influence campaigns
-Nation-state actors
Advertising is an option
