ISCS 376 Final Exam
The ______________________ are hacker that are generally legally hacking for the government of their country. They are usually well trained and will have a set a focused target.
Nation State Actor
T/F: Keyloggers can come packaged with other types of malware, such as Trojans.
True
A __________________ is an attack on hashed password that utilizes the same logic as the birthday problem. Which is to say, even if there are many different possible hashing outputs, you are likely to find two different inputs with the same hash.
birthday attack
A _________________ can be used to perform a Denial of Service (DoS) or Distributed Denial of Service (DDoS) attack.
botnet
A ______________________ is an attempt to manually guess a password, pin, or any other passphrase-like authentications in order to gain access to an account or system.
brute-force attack
A _____________________ is a condition where a process attempts to store more data into a memory variable than that variable accepts. Basically it writes too much data into an application's memory and causes the application to crash.
buffer overflow
The most common exploit of an Internet-exposed network service or a web server is a ______________________.
buffer overflow
A ________________ is similar to a brute-force but instead of systematically working through otherwise random passwords, a dictionary attack goes after common passwords first.
dictionary attack
A ____________________, (also known as a deauthentication attack) is when an attacker manages to cause a user's connection to Wi-Fi to get broken, or deauthenticated.
disassociation attack
How can you prevent piggybacking?
double entry doors, security guards, and turnstiles
A _________________ is an attack that forces a system to utilize a weaker form of encryption or security. This way, the attacker can have an easier time breaking the weaker encryption as opposed to the previously implemented one.
downgrade attack
A ______________________ is a method of evaluating the security of a computer system or network by simulating an attack from a malicious source, known as a Black Hat Hacker or Cracker.
penetration test
A ________________ can occur when a system incorrectly manages memory allocations in such a way that memory that is no longer being utilized or needed is not release.
memory leak
A computer programs that can copy itself and infect computer without the permission or knowledge of the owner.
Virus
__________ is phishing using the telephone as a means to find a target.
Vishing (Voice Phishing or VoIP Phishing)
A ___________ can autonomously replicate itself across networks.
worm
What is one way to prevent the spread of viruses?
you should enable email attachment scanning
A ____________________ or threat is a computer threat that tries to exploit computer application vulnerabilities that are unknown to others or the software developer
zero-day attack
What are the characteristics of a virus?
- replication mechanism - activation mechanism - objective
What are the 6 Cryptographic Attacks?
1. Birthday Attack 2. Rainbow Tables 3. Dictionary 4. Weak Implementation 5. Bruteforce 6. Downgrade
What are the two attack that can cause you to be redirected to a spoofed website?
1. DNS Poisoning 2. Altered hosts file
What are the 8 wireless attacks that can occur?
1. Replay Attack 2. Evil Twin/Rogue AP 3. Jamming 4. WPS Attack 5. Bluejacking 6. Bluesnarfing 7. NFC 8. Disassociation
What are the 6 types of actors?
1. Script Kiddies 2. Hacktivist 3. Organized Crime 4. Nation States/APT 5. Insider Threats 6. Competitors
What are the principles (reasons for effectiveness) of Social Engineering?
1. authority 2. intimidation 3. scarcity 4. urgency 5. familiarity/ liking 6. trust
How to detect a rootkit?
A malware scanner is a utility that can find a rootkit
Malware which consists of a program designed to hide or obscure the fact that a system has been compromised.
A rootkit
A false email message warning the recipient of a virus that is going around.
A virus hoax
A self-replicating computer program. It uses a network to send copies of itself to other nodes, and it may do without any user intervention.
A worm
What is the difference between a Trojan horse and a Worm?
A worm self-replicates while a trojan horse does not.
An _________________________ describes a group of well organized attackers, possibly from an enemy country, who use very sophisticated and targeted attacks against your organization.
Advanced Persistent Threat (APT)
The method for finding a host's link layer (hardware) address when only its IP or some other Network Layer address is known.
ARP Poisoning
______________________ is used to later launch a man-in-the-middle attack.
ARP Poisoning
________________________ refers to the act of attempted to gather information from a group, website, etc. by the use of scanners, software, or a similar method requiring technical knowledge.
Active reconnaissance
Software installed that automatically displays and downloads advertising material when a user is online.
Adware
What type of malware is typically downloaded secretly and has the potential to continue to install more of itself or other malware as long as the user is online?
Adware
___________ comes in the form of banners, pop-ups, browser search bars, etc.
Adware
What is an example of a replay attack?
An example of this would be an attacker capturing part of a communication stream and then later sending that communication stream to the server while pretending to be the client.
How can you prevent SQL Injections?
Any procedure that construct SQL statements should be reviewed for injection vulnerabilities because SQL Server will execute all syntactically valid queries that it receives.
A computer virus that is wrapped in layers of encryption and complex code to make it difficult for researchers to take apart in a lab.
Armored virus
A jargon term for a collection of software robots, or bots, that run autonomously and automatically.
Botnet
When someone tries to pass themselves off as someone else. A simple strategy used to obtain information and/or access for a future attack.
Impersonating
______________ is a short ranged wireless communication, that can be tampered with like any other wireless communication.
NFC
A ____________ attack is one that uses a method of bypassing normal authentication and can take form of any type of virus that has found a way around conventional security.
Backdoor
Why would the end user's browser allow the XSS script to execute?
Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.
_____________________ is a testing technique where the internal workings of the item being tested are not known by the tester. You are working "in the dark".
Black box testing
______________________ allows hackers to gain access to data stored on a Bluetooth enabled phone using Bluetooth wireless technology without alerting the phone's user of the connection made to the device.
Bluejacking
A condition where a process attempts to store more data into a memory variable than that variable accepts. Basically it writes too much data into an application's memory and causes the application to crash.
Buffer overflow
Tricking a user into clicking a link other than what they had initially intended to.
Clickjacking
How to prevent a logic bomb from occuring?
Code review and change management processes are the best way to stop logic bombs from showing up in your applications
_____________________ are perpetrated by individuals that are a part of the targeted group/company.
Insider Threats
When an attacker manages to sneak malicious code into a "legitimate" device driver.
Driver manipulation
When attackers sort through the garbage of a company to gain information used for a subsequent attack.
Dumpster diving
What is the wireless version of the phishing scam?
Evil twin
_______________ attacks are when malicious scripts are injected into benign or otherwise trusted websites.
Cross-Site Scripting (XSS)
A type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site for which the user is currently authenticated.
Cross-site Request Forgery (XSRF)
A maliciously created or unintended situation that provides data to a Domain Name Server that did not originate from authoritative DNS sources.
DNS Poisoning
What type of attack is this example showing? You are trying to connect to PayPal, but the URL changes to a different site (one that looks just like PayPal asking for your financial information).
DNS Poisoning
Type of attack that is an incident in which a user or organization is deprived of the services of a resource they would normally expect to have.
Denial of Service (DoS)
Type of attack that includes large numbers of compromised systems (zombies/bots) attack a single target in attempt to crash it.
Distributed Denial of Service (DDoS)
When an attacker manages to take control of somebody else's domain. This can be accomplished a number of ways, but getting admin access is generally involved.
Domain hijacking
A term for a rogue, or counterfeit, Wi-Fi access point that appears to be a legitimate one offered on the premises. These WAPs have been set up by a hacker to eavesdrop on wireless communications among Internet surfers
Evil Twin
A _________________ is a person that uses hacking to promote a cause or push a political agenda.
Hacktivist
To prevent XSS or XSRF attacks, use _____________________ and __________________________.
Input Validation and restrict the use of special characters in input
____________________, also called data validation, is the process of ensuring that a program operates on clean, correct, and useful data.
Input validation
What is well known for containing Trojans?
Keygens (Key Generators)
A piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met.
Logic bomb
A technique for changing a factory-assigned MAC address of a network interface on a networked device in order to deceive certain securities.
MAC spoofing
A form of active eavesdropping, or network sniffing, in which the attacker makes independent connections with the victims and relays messages between them.
Man-in-the-middle attack
A computer virus that infects multiple targets within the same system.
Multipartite virus
Why do attackers use keyloggers?
Often used covertly and remotely using software in order to record sensitive information such as passwords, credit numbers, etc.
_____________________________ is publicly available information that any corporation or individual can utilize in order to keep up to date on many types of attacks and threats
Open-source intelligence (OSINT)
_________________________ is characterized by the lack of technical expertise used to glean information.
Passive reconnaissance
In a _____________________, after the initial attack, the attacker will continue to monitor the target network.
Persistent Penetration Attack
The act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft.
Phishing
When an authorized person allows (intentionally) others to pass through on their security principles.
Piggybacking
A type of stealth virus that attempts to avoid detection and removal by frequently changing its file and process names.
Polymorphic virus
______________________ can prevent the installation of rogue access points.
Port Security
____________________ is the act of exploiting a bug or design flaw in a software application to gain access to resources which normally would have been protected from an application or user.
Privilege escalation
A _________________ is when multiple events try to be processed by a system at the same time, potentially causing them to be processed in the wrong order.
Race Condition
Locks your computer or encrypts your data and threatens to delete it unless you pay a ransom to the attacker.
Ransomware
A software that is used by a malicious attacker to remotely control a system without being allowed explicitly by the owner.
Remote Access Trojan (RAT)
An attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution.
SQL Injection
A _________________ is some form of unskilled hacker who has no real skill of their own. They will utilize common or easily implemented vulnerabilities that can be found online.
Script Kiddie
Using direct observation techniques, such as looking over someone's shoulder, to get information.
Shoulder Surfing
An email spoofing fraud attempt that targets a specific organization in order to seek unauthorized access to confidential data.
Spear phishing
__________________ are not typically initiated by "random hackers" but are more likely to be conducted by perpetrators out for financial gain, trade secrets, or military information.
Spear phishing
__________________ targets specific employees of a company.
Spear phishing
_________________ is claiming to be something it/you are not.
Spoofing
A type of malware that is installed on computers and that collects information about users without their knowledge.
Spyware
_________ is secretly installed on the user's personal computer or on a shared computer. It can negatively affect confidentiality.
Spyware
The act of an unauthorized, or authorized, person who follows someone to a restricted area without the consent of the authorized person.
Tailgating
How do hackers use a SQL Injection?
They attempt to have the receiving server pass information to a back-end database from which it can compromise the stored data
How do attackers use Denial of Service (DoS) attacks?
They commonly attack web servers of a single external user. They are often accomplished using buffer overflows or by using multiple servers and/or routers to overwhelm another router or host.
The _____________ describes a class of computer threats that appears to perform a desirable function, but, in fact, performs undisclosed malicious function.
Trojan horse
An attack that relies on typographical errors made by users when inputting a web address in a browser.
URL hijacking or Typo squatting
How can you prevent a hoax virus?
User training and email spam filters are needed to stop a virus hoax from affecting your company.
______________________ can utilize a pin which is inherently unsecure and easily brute-forced. This type of attack is possible because of the simple nature of the pin.
WSP Attack
When an attacker finds a website or service frequented by whichever specific group that the attacker is targeting.
Watering Hole Attack
A type of spear-phishing that targets executives and high-profile targets.
Whaling
_____________________ is a testing technique whereby explicit knowledge of the internal workings of the item being tested is used to select the test data.
White box testing
______________________ can easily occur on a network because wireless traffic traverses over an otherwise easily accessible medium, air.
Wireless jamming
Unlike cross-site scripting, which exploits the trust a user has for a particular site, _________________ exploits the trust that a site has in a user's browser.
XSRF
An attacker can use __________ to send a malicious script to an unsuspecting user. The end user's browser has no way to know that the script should not be trusted.
XSS
A type of attack or threat that is a computer threat that tries to exploit computer application vulnerabilities that are unknown to others or the software developer.
Zero-day attack or also called zero-day vulnerabilities
What is the comparison between a virus and a hoax virus?
a hoax virus can create as much damage as a real virus. Users are ticked into changing system configuration and technical support resources are consumed by increased user calls.
Threats posed by ________________ are, simply, threats perpetrated by competing groups in order to gain some sort of edge or handicap their rivals.
competitors
How does the principles of Social Engineering help an attacker?
could help an attacker trick a victim into divulging information or unwittingly aiding in an attack
ARP Poisoning allows traffic to be redirected through a malicious machine by sending ___________________________ updates to a victim.
false hardware address
XSRF involves unauthorized commands coming from a trusted user to the website. This is often done without the user's knowledge and employs some type of social networking to pull it off, such as _______________.
forums
Weak encryption based attacks target the ___________________ or the algorithm itself, that is used in implementing password based authentication.
implementation
How are backdoors installed?
installed by malware so that other malware has an easier time accessing the user's computer. It is often introduced as a rootkit.
An __________________ is when some integer is expected, but an integer outside of the expect range is forced into the application.
integer overflow
What can happen if a buffer overflow is successful?
it can lead to a DoS
What must happen in order for a remote access trojan to be effective?
it needs to be launched on the victim's computer, this usually requires human interaction. Normally accomplished through email, like most virus, or through fake downloads masquerading as legitimate software
Records every keystroke on a device, trying to pick out patterns that synchronize with certain information.
keylogger
A ____________ is a type of malicious attack that is set off by a specific event, date, or time. It is not able to be discovered by an antivirus scan.
logic bomb
A _______________________ is when there is an interruption of network traffic for spying, and possibly accompanied by the insertion of malicious code.
man-in-the-middle attack
A ____________________ is a table of common hashes for plaintext while using various hashing algorithms. These tables are pre-calculated so an attacker has to do little work to utilize one.
rainbow table
A ________________ is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed.
replay attack
A _______________ is a wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator or has been created to allow an attacker to conduct a man-in-the-middle attack.
rogue access point
A ___________ hides its processes, applications, and files from being detected.
rootkit
What is the form of malware that a Watering Hole Attack might use?
the associated malware is usually some form of spyware to collect information of the target group. Effective against targets even if they are trained against social engineering attacks, as it exploits an otherwise trusted website.
How do hackers use vishing?
the hacker will typically use a war dialer to send a recorded message stating that there is an error with a victims credit card or bank account and leave a number to call back. If the victim calls back, they will usually be asked personal information, such as SS# or account numbers.
How to prevent a rootkit?
the most effective action would be to reformat and reinstall the operating system
Why would an attacker want to use a rootkit?
to replace vital system executables which may then be used to hide processes and files the attacker has installed along with the presence of the rootkit itself.
Bluejacking is when ___________________ are sent to Bluetooth-enabled phones.
unsolicited messages
How can you prevent Dumpster Diving?
use a shredder or shredding service
How do you prevent phishing?
user training needs to happen in order to be effective in stopping phishing attempts
How can you prevent Shoulder Surfing?
using password masking, privacy screens, and proximity readers instead of key-punch locks
What is the most common way Trojans are installed?
via a thumb drive
How do most network viruses spread?
via email
A __________ is a security threat to a system that requires interaction from a user.
virus
A ___________________ is a computer program designed to search for and map systems for weaknesses in an application, computer, or network.
vulnerability scanner
What are the attacks that can be performed against an NFC communication
• Eavesdropping: Simply listening in to traffic. • Replay: Data is replayed to emulate older traffic. • MitM: An attacker intercepts NFC traffic, changes or monitors it, and forwards it to its final destination.