1.0 - Threats, Attacks and Vulnerabilities Flashcards
1
Q
Code is changing after each use, so that signature-based scanning does not always work.
Type of threat?
A
Polymorphic Malware
2
Q
Code is encrypted so that it cannot be decomplied or reverse engineered.
Type of threat?
A
Armored Virus
3
Q
Files are encrypted, either permanently or until a ransom is paid.
Type of threat?
A
Crypto-Malware
4
Q
Files are encrypted, and request for ransom is received.
Type of threat?
A
Ransomware
5
Q
Malicious code that attaches itself to another piece of executable code. It only runs when the executable it is attached to is run.
Type of threat?
A
Virus
6
Q
Malicious code that spreads across a network without being attached to another executable. Can also move via email, open network shares, IIS, SQL. Type of threat?
A
Worm
7
Q
Software that appears to do one thing, such as a game, but also has embedded malicious code.
Type of threat?
A
Trojan
8
Q
Threat that modifies the OS, often by re-writing the kernel.
Type of threat?
A
Rootkit
9
Q
Malicious code that records keystrokes.
Type of threat?
A
Keylogger
10
Q
Software that makes ads appear. Can be malicious or legitimate.
Type of software?
A
Adware
11
Q
Software that monitors a user’s activities, including: keylogging, browsing, cheating on games, software usage.
Type of software?
A
Spyware
12
Q
A large number of infected PCs that can be controlled by one malicious user.
Type of threat?
A
Botnet
13
Q
A hacker installs a toolkit on a remote PC that lets them record keystrokes, take screenshots, install software, see and change system settings.
What is this toolkit called?
A
RAT (Remote-Access Trojan)
14
Q
An administrator installs a piece of code that will delete files or do other damage if they are fired.
What is this called?
A
Logic Bomb (or Time Bomb if it will go off a specific number of days later)
15
Q
A developer is able to get back into a system even after new layers of security have been added.
What method did they use.
A
Backdoor / Trapdoor. Often a hard-coded password, which is difficult to remove.
16
Q
List common Indicators of Compromise (IOC)
A
Common IOCs are:
Network:
- Unusual outbound network traffic
- Geographical irregularities in network traffic
- HTML response sizes
- Mismatched port-application traffic
- Unusual DNS requests
- Signs of DDoS activity
- Web traffic with nonhuman behavior
Accounts:
- Anomalies in privileged user account activity
- Account login red flags
OS & Applications:
- Increase in database read volumes
- Large number of requests for the same file
- Suspicious registry or system file changes
- Unexpected patching of systems
- Mobile device profile changes
- Bundles of data in the wrong place
17
Q
A threat returns even after the OS is wiped and reloaded while the system is air-gapped.
Likely type of threat?
A
Firmware Rootkit, possibly in a video card or expansion card firmware.
18
Q
This threat loads before the OS, as a virtualization layer for the OS. This allows it to intercept hardware calls to the OS.
A
Virtual Rootkit or Vitual Machine-Based Rootkit (VMBR).
19
Q
This type of threat operates at the OS level, giving it priviledged access to the system.
A
Kernal Rootkit
20
Q
This type of threat infects libraries, such as .DLL files, so they can execute inside a target process to spoof it, or overwrite the memory of the target application.
A
Library Rootkit
21
Q
Any threat will attack at least one of the three security requirements (the CIA of security). These are?
A
Confidentiality
Integrity
Availability
22
Q
A user receives an email indicating that they need to login to resolve an account issue at a website.
What type of threat is this?
A
Phishing
23
Q
Members of just the accounting team receive emails asking them to login to the corporate bank account, with an invalid link.
What type of attack is this?
A
Spear Phishing
24
Q
The CEO receives a ficticious email or phone call, which was tailored just for her. What type of attack is this?
A
Whaling
25
A threat actor spoofs the company's HR phone number and calls users asking them for personal information. What kind of attack is this?
Vishing
26
How can users protect against phishing and vishing attacks?
Never use the link or phone number provided in the incoming message.
Educate users about these threats.
27
Someone sparks up a conversation with an employee as they are heading into work, then follows them though the door without authenicating. What just happened and how can it be avoided?
The treat actor was Tailgating to gain entry to the building. Educating employees about proper entry procedures or a mantrap are possible solutions.
28
How might a threat actor avoid third-party authorization?
They may:
1. Arrive with knowledge of an existing project or issue
2. Use the guise of trouble to create a sense of urgency
3. Name drop someone important who is currently unavailable
29
What types of parties might a threat actor impersonate?
Help Desk / Support
Contractors / Outside Parties
30
What is the best defense against impersonation attacks?
A standard process for verifying identity and user education.
31
An attacker goes through the organization trash looking for sensitive information. What is this technique called?
Dumpster Diving
32
An attacker watches the keypad on an ATM machine to get users' PIN numbers, possibily from afar with a telephoto lens. What type of attack is this?
Shoulder Surfing
33
What are some methods to prevent shoulder surfing?
Blinders around PIN keypads
Keypads the move the numbers around
User education
34
Users receive a viral email telling them to delete an important system file in order to prevent future attacks. What is this?
A Hoax, but a damaging one.
35
A website is altered to distribute malware, often just to users in a certain geographical area. What is this attack called?
Watering Hole
These are difficult and time-consuming to setup, so they tend to use zero-day attacks, and are often backed by nation states.
36
A threat actor pretends to be calling from from the IRS. What social engineering principal are they using?
Authority
37
A threat actor implies that a user's job may be on the line if they do not cooperate. What social engineering principal are they using?
Intimidation
38
A threat actor works within a group to push the decision making process in a particular direction. What social engineering principal are they using?
Consensus
39
A phishing email says that user only has a few minutes to reset their account. What social engineering principal is being used?
Urgency
40
An advertisment says that only a few items are left for sale. What social engineering principal is being used?
Scarcity
41
A threat actor talks to a user about how they have been in similar situations or had similar feelings. What social engineering principal is being used?
Familiarity
42
A social engineer's goal is not to force someone to do something they don't want to do, but to create a perception in their mind that they are doing the right thing. What social engineering principal is this?
Trust
43
Describe a social engineer's primary goal and technique.
Their goal is to manipulate a person's perception in order to change their actions.
They do this by preying on a person's beliefs, biases and stereotypes.
44
A system if flooded with TCP SYN requests that return back to a non-existent IP address. This causes the system to lock up. What type of attack is this?
DoS (Denial of Service)
45
A threat actor is able to send commands to a few master systems, which control hundreds or thousands of zombie PCs, which are infected with the correct malware. When the order is received these systems all flood one target with requests, bringing it down. What type of attack is this?
DDoS (Distributed Denial of Service)
46
What precautions can be taken against DDoS attacks?
Precautions against DDoS attacks include:
1. Consistent patching
2. Shorter timeouts for TCP connections
3. Distributed workloads
4. Block ICMP packets at the border
5. Scan your network for zombie systems (helps others more than you)
47
An attacker steals a cookie from a user and is able to hijack their session, by rerouting all communication through another PC. This allows the attacker to see the data being moved (if not encrypted) and see who the target is communicating with. What type of attack is this?
Man-in-the-Middle (session hijacking specifically)
48
Lack of input error-checking in programs is the root cause of this common attack where new commands are injected into a program through the input fields.
Buffer Overflow
49
Describe the 2014 Heartbleed attack.
It took advantage of a buffer overflow vulnerability in the OpenSSL library.
50
Describe some types of Injection attacks.
SQL injection - allows unauthorized SQL commands to run
XML injection - allows access to data
LDAP injection - allows access to data
Command injection - gives privledged command-line access
51
What is the difference between XSS and SQL injection?
XSS is a client-side vulnerability that targets other application users, while SQL injection is a server-side vulnerability that targets the application's database.
52
Lack of input validation on a web site allows attackers to include a script and have it rendered. What is this method called?
Cross-Site Scripting (XSS)
53
How can Cross-Site Scripting (XSS) be migated?
Cross-Site Scripting (XSS) mitigation:
* Use anti-XSS libraries to strip scripts from the input strings
* Limit types of uploads, screen or whitelist uploads
* Testing with encoded and unencoded inputs to find vulnerabilities
54
A user is logged into a banking site. Meanwhile code is executed in a separate browser tab to perform a transaction at the site without the user's knowledge. What type of attack is this?
Cross-Site Request Forgery (XSRF)
55
What methods can migate against Cross-Site Request Forgeries (XSRF)?
* Re-validate the user on important transactions
* Limit authentication time
* Cookie expiration
* Use anti-CSRF tokens in form submissions. These are sent to the user at authentication, then included in subsequent HTTP requests. This the most effective method.
56
An attacker gets standard access to a system, then duplicates an elevated token to run processes as an elevated user. What type of attack is this?
Privilege Escalation
57
What methods can mitigate privilege escalation attacks?
* Follow the least-privilege model
* Regularly review administrative accounts
* Monitor privileged accounts for unusual behavior
* Reduce processes and services that run in elevated mode
58
An attacker sends incorrect ARP and RARP requests to a network, feeding incorrect data into system ARP tables. They then use this corruption to setup a man-in-the-middle attack. What is this method?
ARP Poisoning
59
An attacker sends ICMP Ping commands to a network address, with the reply aimed at a specific PC. This floods the target PC with ping requests. When an attacker is able to create a greater effect than would be possible with a single client, what is it called?
Amplification
60
Running nslookup shows that a system's local DNS cache is pointing certain DNS names to the wrong IP addresses. What type of attack has occurred?
DNS Poisoning
61
You login to GoDaddy to discover that you no longer own and control one of you domain names. What has occurred?
Domain Hijacking
62
A trojan element is added to a user's browser that intercepts and changes data as they browse certain websites. What is this attack called?
Man-in-the-Browser (MitB)
63
An attacker uses a vulnerability that is unknown to the developer, so even the latest patches will not protect systems. What is this called?
Zero Day attack
64
An attacker captures communication between two parties and retransmits them at a later time. What is this called?
Replay
65
What best defends against replay attacks?
Defenses against replay attacks:
* Encryption
* Short time frames for transactions
66
An attacker captures a hash file and injects it into a system. This allows them to authenticate without knowing the password. What is this called?
Pass the Hash.
This is technically demanding attack, but tools have been developed to make it easier.
67
When a user clicks on a certain design element, their click is altered by a transparent overlay, causing them to click elsewhere and executing the attacker's code. What is this type of attack?
Clickjacking
68
A user receives a DoS attack, taking down their system. At the same time, the attacker takes over a Telnet or web session that the user was running. What is this called?
Session Hijacking
69
A peice of malware alters the URL a user is attempting to browse to, causing them to go to a fake website. What is this called?
URL Hijacking
70
A user receives an email from the bank asking them to login. The URL in the mail looks similar to their bank's, but the actual domain is different. What is this called?
URL Hijacking, Fake URL, Brandjacking, Typo Squatting
71
An attack puts a layer of code between a driver and the OS, changing hardware responses without altering the driver itself. What is this form of driver manipulation called?
Shimming
72
An attacker modifies internal code to add functionality without changing other external behavior of the code or driver. What is this called?
Refactoring
73
An attacker puts the IP of the target system into certain web traffic to facilitate an attack. What is this called?
IP Spoofing
74
A target system is flooded with ICMP requests after the attacker sent the ICMP request to the network address. What technique was used?
IP Spoofing - in the initial request to the network address. This called a Smurf attack.
75
What can mitigate IP spoofing attacks?
* Limit trust relationships between hosts
* Configure firewalls to reject packets from outside that have an inside IP in the From address
76
Why are IP spoofing SYN/ACK attacks more difficult from outside the network?
The attacker will have to guess the sequence numbers for the SYN/ACK transaction.
77
Wireless networks are especially succeptible to this attack where conversations are recorded and sent later on.
Replay attacks
78
WEP wireless encryption was suseptible to this exploit where an initial key sequence was send in the plaintext part of the message.
Initialization Vector (IV). Software such as AirSnort can intercept each packet with weak IV and eventually crack the WEP encryption key for a WAP.
79
You discover a wireless access point hidden in a cupboard. It is configured to emulate a company WAP and intercept user data. What is this called?
Evil Twin
80
A non-company owned AP is allowing clients to authenticate to a real company AP. The attacker uses this to collect user credentials.
Rogue AP
81
A certain radio spectrum is targed by a rogue wireless device. What is this called?
Jamming
82
This easy to use wireless authentication system has the user enter an 8-digit code to authenticate and is susceptible to brute-force attacks.
WPS (Wi-Fi Protected Setup)
83
A user is in a crowded airport when they receive a text message or image via Bluetooth from an unknown and unauthorized user. What type of attack is this?
Bluejacking
84
What can be done to avoid bluejacking?
* Disable Bluetooth
* Set Bluetooth devices to nondiscoverable
85
An attacker copies data from a target phone via Bluetooth. This can include emails, contacts, calendar, and media files. What is this attack called?
Bluesnarfing
86
What is the key difference between bluejacking and bluesnarfing?
Bluejacking sends unauthorized data. Bluesnaring uses an authorized connection to steal data.
87
What types of attacks are RFID readers succeptible to?
* Replay - the attacker intercepts signals and replays them later to authenticate.
* Cloning - a dupilcate RFID card can be created using eavesdropping data.
88
An attacker sends deauthentication frames to a WAP to remove it from the network. What is this called?
Disassociation
89
Why would an attacker disassociate a WAP?
* To sniff the reconnect, including the WPA four-way handshake. This provides initial information needed in a brute-force or dictionary-based WPA attack.
* It forces users to reconnect, which is a chance to mount a man-in-the-middle attack.
90
This brute-force cryptographic attack looks for collisions within hash functions, or duplicate hash functions.
Birthday attack
91
An attacker gathers the original plaintext and the ciphertext for that message, then uses them to key through brute-force attemptes. What is this attack called?
Known Plaintext/Ciphertext
92
What can be done to mitigate Known Plaintext/Ciphertext attacks?
Large keyspace, so that a brute-force attack is no longer feasible.
93
These lists of hash values associated with passwords make password cracking easier.
Rainbow tables
94
What method makes rainbow tables useless?
Salted Hashes, where an additional salt value makes the precomputing process not replicable.
95
A list of common words is used to crack a password.
Dictionary attack
96
Every possible password is attemted against a system or hash file, in this computing-intensive attack.
Brute Force
97
Which type of brute force attack is easy to notice?
Online Brute Force attacks are often detected as the system sees many authentication attempts on the same account.
98
This type of brute force attack requries that the attacker first steal the hash file.
Offline Brute Force attack
99
What types of methods are often part of a hybrid password attack?
Hybrid password attack may start with a dictionary attack, the move on to brute force methods.
100
When two different inputs produce the same output of a hash function, what type of attack is possible?
Collision attack. Many versions of the hash file are produced, then a birthday attack is used to find collisions between them.
101
An attacker take acvantage of a backword compatibility feature in the protocol and forces a TSL/SSL conversation to use a lesser form of encryption. What is this method?
Downgrade
102
If developers do not follow best practices, attackers can record and use conversations to break even encrypted systems with this relatively simple technique.
Replay
103
This common web security protocol has been hacked in all of its version but is still commonly used. What is it, and what should it be replaced with.
SSL has been cracked. It should be replace with TLS. Unfortunately, weak implementations are one of the main issues in IT security.
104
This type of threat actor has little technical knowledge and relies on pre-fab tools.
Script Kiddies
105
When hackers work collectively, usually on the behalf if a cause, they are what?
Hacktivists
106
These type of hackers work to monetize their efforts and work in large, organized units.
Organized Crime. Criminal cybersecurity is now larger in dollar terms and the international drug trade.
107
Often the most skilled of hackers work for these organizations, useing highly structured attacks and defenses.
Nation States. They often use Advanced Persistent Threats (APT) against other nation states or economic interests.
108
With this method, hackers achieve a presense on a target network over a long period of time to gather as much data as possible.
Advanced Persistent Threat (APT)
109
This group of intruders are especially difficult to protect against since they already have some access and understanding of the systems.
Insiders
110
This type of attack is used sparingly - only when other methods are not available - because it usually cannot be used more than once.
Zero Day
111
List the common attributes of threat actors.
Attributes of threat actors include:
* Resources
* Level of sophistication
* Location
* Motivation
112
A cooperative group of government and non-government, sharing and analyzing threat data is an example of what?
Open Source Intelligence
113
Would a penetration test use a zero day attack? Why or why not?
Pen Tests look for common and known vulnerabilities, so they can be mitigated.
114
What goals would a pen tester set?
To hack the system with the same objectives as a likely threat actor. Try to get to the data or system that is most valued to a hacker.
115
Pen testers use tools to directly interract with the target network and learn about it. What is this called?
Active Reconnaissance
116
Pen testers may use publicly-available sources to gather information about a target network. What is this called?
Passive Reconnaissance
117
Pen testers use passive and active tools. What is the difference?
Passive tools scan a network without detection. Active tools can be detected.
118
An attacker establishes a presence on a PC, uploads tools to it, and uses it to scan that portion of the network. They repeat this process to gain information about larger portions of the network. What is the process called?
Pivoting or network traversal
119
This step in the pen testing process shows that a network vulnerability exists, but stops short of damaging any systems.
Initial Exploitation
120
List some common techinques used by pen testers.
Common pen testing techniques include:
* Initial exploitation
* Pivoting / network traversal
* Escalation of privilege
* Perstence
121
This testing technique exposes the program, system or network to malformed input data and looks for flaws in the output data. The tester has no knowledge of how the syhstem works.
Black Box Testing.
This is a common testing technique for web-based applications.
122
This testing technique looks at the internal structures and data processing of an application. The tester has detailed knowledge of the application.
White Box Testing
123
This testing technique is efficient becuase the testers have some knowledge of the software, network or system they are testing. This is efficient becuase entire paths can be eliminated from the test.
Grey Box Testing
124
What is the difference between Pen Testing and Vulnerablility Scanning?
Vulnerability Scanning will find vulnerabilities, whether they can be exploited or not.
Pen Testing will determine which vulnerabilities can be exploitated.
125
What is the difference between credential and non-credentialed vulnerability scans? Why are both scans important?
The difference is whether the vulnerability scan tool was given valid account credentials to use.
Both tests should be run, as a real attacker may not have credentials initially, but might later on in the process.
126
List the common steps in a vulnerability scan.
Common steps in the vulnerability scan are:
* Identify vulnerability
* Identify missing or ineffective security contols
* Identify common misconfigurations
127
What is the difference between intrusive and non-intrusive vulnerability tests?
Intrusive tests will make a change to the system state. This is more accurate at detecting vulnerabilities but it can cause system disruption.
128
An attacker sends similar commands in fast sequence. The data is not received in the expected order, allowing the attacker to gain access. This is an example of what?
Race Conditions
129
What methods can be used to prevent race conditions?
Race conditions can be prevented by:
* Reference counters
* Kernal locks
* Thread syncronization
130
An organization chooses to continue using a server that is running and older OS, which no longer receives updates. What type of vulnerability is this?
End of Life System
131
The primary software on a server receives patches from the vendor, but some of the lesser components from a third party are not patched. What are these vulnerable components called?
Embedded Systems
132
Your organization is using a software that is many versions old, so the vendor support contract has run out. What vulnerability is this?
Lack of Vendor Support
133
This is the most common general type of software vulnerabilty, and can be mitigated with input validation.
Improper Input Handling
134
List types of Improper Input Handling
Types of Improper Input Handing include:
* Buffer Overflows
* Cross-Site Scripting (XSS)
* Cross-Site Request Forgery (XSRF)
* Injection attacks
* Canonical Structure Errors
135
Which is a better error handling method? Report error to user, or write it to a log file.
Writing errors to a log file is safer, if it is stored where access can be limited by an ACL.
136
A hacker forces errors in a system and records each error message to learn more about the system. What vulnerability is this?
Improper Error Handling
137
A new system is configured with older, less secure, protocols enabled even though they are not needed. What vulnerability is this?
Misconfiguration or Weak Configuration
138
New access points are installed without changing the factory-set admin password. What vulnerability is this?
Default Configuration
139
An attacker floods a target sytem with requests until it runs out of memory or bandwidth and it crashes. What is this technique?
Resource Exhaustion
140
Someone in marketing clicks on the URL in a phishing email, causing a system failure. What would have best prevented this event?
User training
141
A user is able to get into an advanced system because IT Security didn't realize that one of his group memberships also grants the extra access. What type of vulnerability is this?
Improperly Configured Account
142
The accounting software is confgured to pay on invoices without matching them to purchase orders. What type of vulnerabilty is this?
Vulnerable Business Process
143
The security team would like to build their own custom cryptographic algorithm and implementation. Is this a good idea?
No. Custom cipher suites are not considered secure because they are very difficult to create and implement effectively. It is better to choose an existing cypher system that has been proven to be effective.
144
SSL or TLS?
SSL bad
TLS good
145
A program crashes after a certain amount of time, after mis-written memory overwrites parts of the program's memory space. What is this called?
Memory Leak
146
An attacker crashes a system by sending it numerical values that are larger than the programmers intended. What is this technique called?
Integer Overflow
147
An attacker enters 150 digits into the phone number field of a form, causing the program to crash or execute an unintended command. What is this called?
Buffer Overflow
148
An attacker inputs invalid data designed to prompt the program to reference the wrong area a memory. What is this called?
Pointer Dereference
149
You discover that a copy of MS Office now has extra functions, including dangerous tools that could be used by a hacker. What is the likely type of attack?
DLL Injection
150
Your organization has acquired numerous smaller companies. As a result, some of the system are not documented or accounted for. This is an example of what?
System Sprawl and Undocumented Assets
151
Your large network has no subnets or VLANs. This is what type of vulnerability?
Architecture / Design Weakness
152
Your organization receives a successful targeted attack, despite all of the latest patches being applied. What is the likely type of attack?
Zero Day
153
Compensating Controls can block the path of an attack without directly addressing the underlying vulnerability. What type of attack are they especially effective against?
Zero Day
154
The employee who updates the certificate server got a job in Florida last year and has not been replaced. What vulnerabilty does your network likely have now?
Improper Certificate and Key Management
