Malicious Activity Flashcards

Question

Where are Replay Attacks commonly seen? 重放攻击通常发生在哪些场景？

Answer 1

Banking, email, online shopping, social media, and wireless authentication (especially WEP). 银行业务、电子邮件、网购、社交媒体，以及无线认证（尤其是旧的WEP协议）中常见。

Answer 2

It captures a user’s login credentials and reuses them for unauthorized access. 凭证重放攻击是捕获用户登录凭证，然后用于非法访问。

Answer 3

Use session tokens and implement multi-factor authentication (MFA). 使用会话令牌（Session Tokens）和多因素认证（MFA）。

Answer 4

Tracks and identifies users across different actions on a web application. ## Footnote 在网页应用中跟踪并识别用户。

Answer 5

Session cookies are temporary and deleted when the browser closes. Persistent cookies are stored in the browser until manually deleted or expired. ## Footnote 会话Cookie浏览器关闭即删除；持久性Cookie则长期保存在浏览器中。

Answer 6

An attacker steals or manipulates a user's session to impersonate them. ## Footnote 攻击者窃取或篡改用户的会话信息，冒充用户。

Answer 7

The attacker guesses the session token to hijack a session. ## Footnote 攻击者通过猜测Session令牌来劫持会话。

Answer 8

Modifying the contents of a cookie to exploit vulnerabilities in a web application. ## Footnote 修改Cookie内容以攻击Web应用。

Answer 9

An attacker secretly inserts themselves between two communicating hosts. ## Footnote 攻击者偷偷插入通信链路，窃听或篡改数据。

Answer 10

Manipulating ARP tables to redirect network traffic. ## Footnote 篡改局域网ARP表，将流量引向攻击者。

Answer 11

Capturing valid data and sending it later to trick a system. ## Footnote 捕获正常数据包并重放以欺骗系统。

Answer 12

Downgrading HTTPS connections to HTTP to capture unencrypted data. ## Footnote 把HTTPS降级成HTTP，从而窃取明文数据。

Answer 13

Enforce the use of strong encryption protocols like TLS 1.3. ## Footnote 强制使用强加密协议（如TLS 1.3），禁止旧协议。

Answer 14

An attacker sneaks malicious input into an application to make it execute unintended commands. ## Footnote 攻击者将恶意输入塞入应用，让其执行意料之外的命令。

Answer 15

Fabricating LDAP queries to manipulate authentication or data lookup. ## Footnote 伪造LDAP查询，干扰用户验证或数据检索。

Answer 16

Forcing a vulnerable app to execute system-level shell commands. ## Footnote 让漏洞应用执行系统级命令。

Answer 17

DLL Injection and Process Hollowing. ## Footnote DLL注入和进程空洞（Process Hollowing）。

Answer 18

Input validation, endpoint security, security kernel modules, and least privilege practices. ## Footnote 输入验证、端点安全、核心模块保护、最小权限原则。

Answer 19

Attaching a malicious DLL file to a running process to execute malicious code. ## Footnote 将恶意DLL文件注入到正在运行的进程中，让其执行恶意代码。

Answer 20

Taking control of an existing thread and forcing it to run malicious code. ## Footnote 控制已有线程，让它执行恶意代码。

Answer 21

Starting a legitimate process, removing its code, and replacing it with malware. ## Footnote 启动正常进程后，清空其原始代码，并注入恶意代码替换运行。

Answer 22

Using NTFS file system tricks to create a malicious process that appears legitimate to security tools. ## Footnote 利用NTFS事务伪装成正常进程，骗过安全检测。

Answer 23

Queuing malicious code to a thread’s execution via an asynchronous call. ## Footnote 通过异步调用，把恶意代码插入线程执行队列。

Answer 24

Injecting malicious code directly into the structure of a Portable Executable file. ## Footnote 直接将恶意代码注入到可执行文件（PE文件）结构中。

Answer 25

Too many failed login attempts cause the account to be locked. ## Footnote 多次登录失败导致账号被锁定。

Answer 26

The same account is logged in from multiple places at the same time. ## Footnote 同一个账号在多个地方同时登录。

Answer 27

Trying to access restricted or forbidden resources. ## Footnote 尝试访问受限或禁止的资源。

Answer 28

Login attempts from distant locations within a short time frame. ## Footnote 短时间内从相隔很远的地方登录。

Answer 29

Unusual spikes in CPU, memory, or network usage. ## Footnote CPU、内存或网络使用量异常飙升。

Answer 30

Inability to access files or services. ## Footnote 无法访问文件或服务。

Answer 31

Logs appear at strange or unexpected times. ## Footnote 日志记录在奇怪或异常的时间。

Answer 32

Important logs have been deleted or are missing. ## Footnote 重要日志被删除或丢失。

Answer 33

Hackers publicly boasting about their attacks in articles or posts. ## Footnote 黑客在文章或帖子中公开炫耀自己的攻击行为。