Threats, Attacks, and Vulnerabilities

Pharming

A phishing attack that automatically redirects the user to a fake site.

OSINT (Open Source Intelligence)

Information for collection from publicly available information sources such as publication, geospatial information, and many online resources

Worms

destructive programs that replicate themselves without requiring another program to provide a safe environment for replication

Threat

A circumstance or event that has the potential to compromise confidentiality, integrity, or availability. Threats can be natural (hurricanes, floods, earthquakes, etc), manmade (malicious software, hackers, etc). Can not prvent threats, but reduce impact.

zombie

A computer that is controlled by a hacker who uses it to launch attacks on other computer systems. Can be updated automatically and remotely

Integer Overflow

A condition that occurs when a very large integer exceeds its storage capacity.

MITM

A form of active interception allowing an attacker to intercept traffic and insert malicious code sent to other clients. Kerberos provides mutual authentication and helps prevent MITM attacks. Prevents MITM attack: arp -s IPAddr hexidecimal addr

Replay Attack

A form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. Kerberos prevents this by using timestamps and USN

Bluejacking

A hacking method that allows an individual to send anonymous messages to Bluetooth-enabled devices. When paired with the attacker's device the user's data becomes available for unauthorized access, modification, or deletion. (bluesnarfing)

Insider Threat

A malicious insider

Banner Grabbing

A method used to gain information about a remote system, often as part of a finger printing attack. It identifies the operating system of the DMZ and other details on the remote system such as patch level version, application patch level, and app version.

Vulnerability Scan

A passive scan that has little impact on a system during a test. Detects vulnerabilities, misconfigurations, and lack of security controls. Helps to identify which systems are vulnerable to attack.

In-Line Scanner

A passive scan used to detect anomalies in network traffic, such as a possible attack. Scanner will then send an alert and log the attack.

Whaling

A phishing attack that is targeted to senior business executives and government leaders

Vishing

A phishing attack that uses a telephone call instead of using e-mail, often with a fake caller ID in an attempt to get account details

Remote Access Trojan (RAT)

A remote administration tool maliciously installed as a Trojan horse to give a remote user some level of control of the infected system via a backdoor into the infected system. Important part of a botnet. • Symptoms: Usually undetectable until activated. System damage, data loss. • Action: Restore system from backups.

Credentialed Vulnerability Scan

A scan that provides credentials to the scanner so that tests for additional internal vulnerabilities (such as uncommon open ports, files, versions, and registry values on the host) can be performed; reduces false positives and will likely produce the most information

Buffer Overflow

A series of No operation commands (x90) Occurs when an app receives more input, or different input, than is expected. The result is an error that exposes system memory that would otherwise be protected and inaccessible. Attacker is able to write malicious code into extra allocated memory. echo "vrfy 'perl -e 'print "hi" x 500 ' ' " | nc www.company.com 25

Keylogger

A small hardware device or a program that monitors each keystroke a user types on the computer's keyboard.

Dynamic Link Library (DLL) Injection

A software vulnerability that can occur when a Windows-based application attempts to force another running application to load a dynamic-link library (DLL) in memory, causing the victim application to experience instability (crashes) or leak sensitive information. To mitigate, all calls to different DLLs should be hard-coded in the application.

Flood Guard

A switch feature that protects against media access control (MAC) flood attacks

Spanning Tree Protocol (STP)

A switching protocol that protects against switching loops by dynamically disabling links as needed and should always be enabled.

Pivoting

A technique in which an attacker uses a single compromised system as a platform for launching attacks deeper into a company's network

Black Box Testing

A testing approach that focuses on the functionality of the application or product without knowledge of the code

Spyware/Adware

A type of Malware that may monitor/collect browser activity and log keystrokes, and may impact computer performance and generate pop-ups

Rogue Access Points

A type of MiTM attack, unauthorized access points (evil twin) that are set up by a department or an individual.

Downgrade Attack/POODLE

A type of attack that forces a system to downgrade its security. The attacker then exploits the lesser security control. MITM Exploit that affects SSLv3.0 with CBC mode cipher

Macro Virus

A virus that's distributed by hiding it inside a macro.

System Sprawl

A vulnerability that occurs when an organization has more systems than it needs, undocumented assets, and systems it owns are underutilized. Asset management prevents system sprawl. Compare with VM sprawl.

Packet Sniffing/ Protocol Analyzer

Allows an attacker to capture and analyze IP headers and examine data/traffic being sent over a network if the data being transmitted is unencrypted/clear text, identify the type of traffic, the source of the traffic and the protocol flags used within the individual packets. TCPDUMP is classified as sniffer

WPS Attack

An attack against an AP. A WPS attack discovers the eight-digit WPS PIN and uses it to discover the AP passphrase.

Pass The Hash Attack

An exploit in which an attacker steals a hashed user credential and uses them as-is to try to authenticate to the same network the hashed credentials originated on. Directed at Windows-based systems, SSO vulnerability, Prevent by removing NTLM (new technology lan manager)

Penetration Testing

An invasive test that identify and repair vulnerabilities by hacking into a network, accessing data without being granted access. Primary Phases: Planning (Reconnaissance), discovery (Initial Exploitation), attack (exploit vulnerabilities) and reporting (Penetration Test Report listing the exploited vulnerabilities)

memory leak

An undesirable state in which a program requests memory but never releases it, which can eventually prevent other programs from running. Found in the task manager, app pool is constantly being recycled

Zero-Day Attack

Attack that exploits previously unknown vendor vulnerabilities, so victims have no time (zero days) to prepare for or defend against the attack.

Amplification Attack

Attack that significantly increases the amount of traffic sent to a victim. DDoS is a type

Plain text Attack

Attacker knows some of the plain text data used to create the encrypted data.

ARP Poisoning

Attackers alter a system's ARP table so it contains incorrect MAC address information, poisoning its table associations of other devices. Uses unsolicited ARP replies

Armored Viruses

Attempt to trick or shield themselves from antivirus software and security professionals.

Threat Actor (People)

Attributes: Actors Relationship to the org, motive, intent, capabilities Types: Script kiddies, insiders, hacktivits, organized crime, competitors, and nation states. Competitors are more likely to want to steal intellectual property to gain a competitive advantage.

Rootkits

Can be installed and hidden on a computer mainly for the purpose of compromising the system. Malware scanners can be used to locate

Tracking Cookie

Can be used by Spyware. Used to track your path through a Web site, the time you spend there, what links you click on, and other details recorded, usually for marketing purposes.

XSRF

Cross-site request forgery. An attack that causes users to perform actions on websites without their knowledge. In some cases, attackers use header manipulation to steal cookies and harvest passwords.

XSS

Cross-site scripting. Used to hijack a user's session. Can be prevented by using input validation techniques to filter special characters used in HTML or java code

Honey Pot

Divert malicious attackers to a harmless area of your network, away from production servers and real data.

False Negative

Does not report an actual attack

Privilege Escalation

Exploiting a vulnerability in software to gain access to resources that the user or application would normally be restricted from obtaining.

DoS and DDoS (AKA Smurf)

Flooding a site with packets to prevent access and contributes to resource exhaustion (based on ICMP echo reply called a Smurf attack) DoS is an attack from one attacker against one target. DDos attacks have one attacker and attack many targets

Jabber

Has serious implications for larger orgs and can potentially allow an attacker to capture conversations

Host Enumeration

Identifies hosts on a network

Viruses

Infect systems and spread copies of themselves

Malware

Malicious software running on a host, Types: Adware (popups), Virus (replication mechanism, attaches to something to activate, usually looking for a result (backdoor)...updated antivirus reduces viruses), Spyware (collect information about computer habits and sell to unauthorized party), reduces performance, can exploit DNS, Trojan

Untrained User

Most likely vulnerable to clicking on a malicious link in an email

NullPointerException

Occurs when an application tried to use an object reference with a null value

Penetration Attack Phase

Order: Initial Exploitation: A successful attack on a single computer, escalation of privilege, pivot and persistence (initial exploitation has concluded, and tester is interested in maintaining their access to the network)

Salt Hashing

Password randomization, preventing a rainbow table attack on password hashes

Syn Stealth Scan

Perfoms a half-open scan. Does not complete the 3-way handshake; instead response exposes IP addresses of systems who respond. Then, an RST (reset) is sent in response to the SYN, closing the connection.

DNS poisoning

Perpetrator redirects traffic by changing the IP record for a specific domain (permitting attackers to send legitimate traffic anywhere they choose)

Default Accounts,Passwords, & Configurations

Provide a simple means for an attacker to gain access to a system bc the system is vulnerable

Security Content Automation Protocol (SCAP)

Provides automation methods for managing vulnerabilities

Password Guessing/Brute Force/ Dictionary Attacks

Repeated guessing of logons and passwords Hybrid Attack: Combo of dictionary and brute-force attacks

Race Condition Vulnerability

Results when several threads try to access and modify the same data concurrently, causing system malfunction, crashes or privilege escalation

Ping Scan

Sends ICMP pings to a range of IP addresses. If the IP responds, the network scanner knows there is a host operations with that IP addr. Most FWs block this capability, so results are inconsistent.

Ransomware

Software that encrypts programs and data until a ransom is paid to remove it.

White Box Testing

Testers use their knowledge of system internals when testing the system

Port Scanning

The act of systematically scanning and identifying a computer's open ports to determine what services are running on the system.

Risk

The possibility of a threat exploiting a vulnerability and resulting in a loss. Risk = Threat * Vulneability

Fuzzing

The practice of sending unexpected input to an application for penetration testing and can be used in a security assessment.

Spoofing

The process of making data look as if it came from a trusted or legitimate source. Create rules to block all incoming traffic from private IP addresses to prevent spoofing

Refactoring

The process of modifying a working program to improve function interfaces and other qualities of the code.

Exploitation Framework

Toolsets that can be used offensively or defensively and are often used by pen testers as well as hackers. Stores information about security vulnerabilities to detect and exploit software. Used for penetration testing and risk assessment

Logic Bombs

Trigger on a particular condition

System Hardening

Use a configuration Compliance Scanner to: Remediate non-compliant config items, disable unnecessary services, restrict administrative access, and enable auditing controls on a server

Gray Box Testing

Uses a combo of white and black box techniques. Tester has some understanding of or limited knowledge of inner workings

Fingerprinting Attack

Usually part of a reconnaissance attack by identifying specific info about a system. It identifies IP addresses used in the target network using method such as ICMP sweep or host enumeration sweep. Ping scanners are also used

False Positives

When a vulnerability is incorrectly identified. False positives from an IDS can cause an increased workload because they falsely indicate an alert has occurred.

Data Execution Prevention (DEP)

Windows feature that uses a combination of software and hardware to prevent the execution of code in unintended areas of memory to protect against buffer overflow attacks.

Class C fire extinguisher

a fire extinguisher rated to put out electrical fires.

Botnet

a group of compromised computers or mobile devices connected to a network

spear phishing

a phishing expedition in which the emails are carefully designed to target a particular person or organization

Whitelisting

a process in which a company identifies the software that it will allow to run on its computers

Password Cracker

a program that attempts to discover passwords

Phishing

a technique to gain personal information for the purpose of identity theft, usually by means of fraudulent e-mail

Rainbow Table Attack

attempts to discover the password from the hash lookup using databases of precomputed hashes and Bypasses maximum failed login restrictions; countermeasure is salting

Trojans

disguised as legit software, harmful software that tricks people into loading and executing on their systems; does not infect files or self replicate

Clickjacking

is a technique that tricks users into clicking on a malicious link by adding the link to a transparent layer over what appears to be a legitimate web page.

Input Validation/Handling

the process of inspecting data given to a program by the user and determining if it is valid. Prevents input that can impact data flow, allowing an attacker to gain control of a system or remotely execute commands. Server-side input validation results in a more secure system than client-side input validation