Attacks, Threats, and Vulnerabilities Flashcards
Cross-site Request Forgery (XSRF)
is a malicious script hosted on the attacker’s site that can exploit a session started on another site in the same browser.
Cross-site scripting (XSS)
is a malicious script hosted on the attacker’s site or coded in a link injected onto a trusted site designed to compromise clients browsing the trusted site.
Exploits the fact that the browser is likely to trust scripts that appear to come from a site the user has chosen to visit
Shimming
is the process of developing and implementing additional code between an application and the operating system to enable functionality that would otherwise be unavailable.
How serious are Memory leaks in the OS kernel? What could it mean?
are extremely serious. A memory leak may itself be a sign of a malicious or corrupted process.
If the pointer that references an object at a memory location was set to a null value by a malicious process,
then this can create a null pointer exception, causing instability and crashes.
When does a memory leak vulnerability occur?
What does it lead to?
A memory leak vulnerability occurs when software does not release allocated memory when it has finished using it, potentially leading to system instability.
If the pointer is set to a null value by a malicious process
this creates a null pointer exception, and the process will crash. Programmers can use logic statements to test that a pointer is not null before trying to use it.
Document Object Model (DOM) Cross-Site Scripting (XSS) exploits vulnerabilities in …
client-side scripts to modify the content and layout of a web page.
What is a Stored (or persistent) Cross-Site Scripting (XSS)
is a server-side script attack that inserts code into a back-end database used by the trusted site.
Reflected Cross-Site Scripting (XSS)
is a server-side input validation exploit that injects a script into a website. Once the victim visits the infected website, the malicious code executes in the user’s browser.
Clickjacking
occurs when the attacker inserts an invisible layer into a trusted web page that can intercept or redirect input without the user realizing it.
What Error or exception handling?
is the process of responding to the occurrence of an error in the form of an outputted message. This can provide insight to issues in the code which are not necessarily related to security.
What is a client-side (or cross-site) request forgery?
is an attack that forces a user to execute unwanted actions to a web server that the user is currently authenticated to.
What does a “server-side request forgery” do?
abuses the functionality and services of backend servers to read and update internal resources. This can expose, for example, database information, even without an authenticated session
What does a command injection attack do?
What does it allow?
runs OS shell commands from the browser, and allows commands to operate outside of the server’s directory root, allowing commands to run as the web “guest” user.
describe a DLL injection
is not a vulnerability of an application, but of the way the operating system allows one process to attach to another, and then forces it to load a malicious link library.
Improper input handling exposes …
software to input validation attacks. When an attacker exploits improper input handling, it crashes the process hosting the code, performs
What is “Refactoring” (coding, programing)
means the code performs the same function by using different methods. Refactoring means that the antivirus software may no longer identify the malware by its signature.
Pointer dereference, what is it and what would it do?
is a software vulnerability that can occur when the code attempts to remove the relationship between a pointer and the thing it points to (pointee). Dereferencing may crash the application and corrupt memory.
An integer overflow attack
causes the target software to calculate a value that exceeds the upper and lower bounds.
How To exploit a buffer overflow vulnerability,
the attacker passes data that deliberately overfills the buffer (an area of memory) that the application reserves to store the expected data.
Default application settings may expose more information than necessary when errors occur.
Exposing such information over an HTTP connection may provide insight of the environment to the attacker.
An application programming interface (API) intrusion occurs when
an attacker takes advantage of unsecure communication with application services to perform denial of service attacks using multiple API calls, for example.
An application programming interface (API) intrusion occurs when …
an attacker takes advantage of unsecure communication with application services to perform denial of service attacks using multiple API calls, for example.
Why are API calls use keys, made up of alphanumeric characters, used for?
to authorize requests to the web application. These keys are exposed over an unsecure connection such as HTTP. An attacker can use the key to perform other API calls.
A “time of check to time of use” (TOCTTOU) vulnerability
will take advantage of this timing to modify data before finally using it. - it’s a race condition.
Describe a race condition
(software vulnerability)
When does it occur?
What do Attackers used this as?
It’s when the execution processes are dependent on the timing of certain events, and those events fail to execute in the order and timing intended.
Occurs when multiple threads are attempting to write at the same memory location.
Attackers have used race conditions as an anti-virus evasion technique
An integer overflow attack causes …
the target software to calculate a value that exceeds the upper and lower bounds.
A pointer is a reference to …
An object in memory.
Attempting to access that memory address is called dereferencing. An integer is a positive or negative whole number.
A shim is a …
Code library that intercepts and redirects calls to enable legacy mode on a system.
The shim database represents a way that malware with local administrator privileges can run on reboot (persistence).
Transitive access describes…
the problem of authorizing a request for a service that depends on an intermediate service.
Directory traversal occurs when…
The attacker gets access to a file outside the web server’s root directory.
The attack uses specific code to request for information from a web server’s root directory by submitting the directory path.
An SQL injection attack inserts…
An SQL query as part of user input, which allows an attacker to extract or insert information into the database or execute arbitrary code.
A replay attack consists of…
Intercepting a key or password hash, then reusing it to gain access to a resource. Using once-only session tokens or timestamping sessions prevents this type of attack. - Cookie Stealing
An attacker with system access is able to obtain keys from system memory or pagefiles/scratch disks. Privilege escalation is the practice of exploiting flaws in an operating system or other application to gain a greater level of access than intended for the user or application.
Pass-the-hash occurs when…
The attacker steals hashed credentials and uses them to authenticate to the network. Using once-only session tokens or timestamping sessions prevents this type of attack.
In what layer does packet filtering operate?
What does it do?
Layer 3 firewall technology that compares packet headers against ACLs to determine which network traffic to accept.
A DoS attack causes …
A service at a given host to fail or to become unavailable to legitimate users. DoS attacks focus on overloading a service by using up CPU, system RAM, disk space, or network bandwidth (resource exhaustion). Reconfiguring default web settings to throttle or limit calls can prevent this. AKA resource exhaustion
DRDoS or amplification attack is …
A more powerful TCP SYN flood attack where the adversary spoofs the victim’s IP address and attempts to open connections with multiple servers.
SYN attacks cause …
resource exhaustion on the host’s processing requests, consuming CPU cycles, and memory. This delays the processing of legitimate traffic and could potentially crash the host system completely.
What is a mine? (cyber security)
Is it easily detectable?
scripted trap that runs in the event an account gets deleted or disabled. Anti-virus software is unlikely to detect this kind of malicious script or program, so the security specialist would not be able to discover the script during an investigation. The security specialist would uncover the mine once it gets executed and causes damage.
Fileless malicious software (malware)
does not write code to disk. The malware uses memory resident techniques to run in its own process.
can be classified as using low observable characteristics (LOC) attacks which can make it less intrusive than other malware.
uses “live off the land” techniques rather than compiled executables to evade detection. This means that the malware code uses legitimate scripting tools like Windows PowerShell.
What is a rootkit?
backdoor malware that changes core system files and programming interfaces so that local shell processes no longer reveal their presence.
Man-in-the-Middle (MitM) attack is a …
form of eavesdropping in which the attacker makes an independent connection between two victims and steals information to use fraudulently
Pass-the-Hash attacks
if an attacker obtains the hash of a user’s password, it is possible to authenticate with the hash, without cracking it
Describe Birthday Attack
Describe a collision.
What can this attack do?
Is a type of Brute force attack aimed at exploiting collisions in hash functions.
A collision is where a function produces the same hash value for two different plaintexts. This type of attack can forge a digital signature.
