Ohne Titel

Seite 1

????

1.Finding Security Vulnerabilities:

*Any kind of software or hardware detect

* Exploit vulnerabilities:Term to describe a program written to take advantage of a know vulnerabilities/usually an attack on access to system

2.Software Vulnerabilities

*Errors in the operating systems or application code

3.Hardware Vulnerabilities

*Introduced by hardware design flaws

4.Buffer Overflow:When data is written beyond the limits of a buffer

*This can lead to a system crash,data compromise or provide escalation of privileges.

*Memory areas allocated to an application

5.Non-Validated Input:Programs working with data input.

*A malicious user could craft an image file with invalid image dimensions./Force program to allocate buffers of incorrect and unexpected sizes.

6.Race Conditions:Event based on order or time outputs

*Becomes a source of vulnerabilities when required order or time outputs happened in proper timing

7.Weaknessess in Security Practices:Systems and sensitive data can be protected through techniques such as authentication,authorization,and encryption.

*Strongly advised that developers use security libraries that have already created,tested,and verified.

8.Access-Control Problems:Is the process of controlling who does what and ranges from managing physical access to equipment to files and so on…

Summary:Nearly all access controls and security practices can be overcome if the attacker has physical access to target equipment. For example, no matter what you set a file’s permissions to, the operating system cannot prevent someone from bypassing the operating system and reading the data directly off the disk. To protect the machine and the data it contains, physical access must be restricted and encryption techniques must be used to protect data from being stolen or corrupted.

9. Vocab Mini Quizz Like:

*Non-Validated Input:Data coming in a program with malicious content designed to force a program to behave in an unintended way.

*Weakness in Security Practices:When developers attempt to create their own security applications.

*Races Conditions:When the output of an event depends on the order or timed outputs

*Buffer Overflow:When a malicious application access is memory allocated to other processors .

*Access Control Problems:Incorrectly regulating who does what and what they can do with resources.

Vocab:

Spyware:This malware is designed to track and spy on the user. Spyware often includes Activity trackers, keystroke collection, and data capture. An attempt to overcome security measures, spyware often modifies security settings. Spyware often bundles itself with legitimate software or with Trojan horses.

Adware:Advertising supported software is designed to automatically deliver advertisements. Hardware is often installed with some versions of software. Some adware is designed to only deliver advertisements but it is also common for adware to come with spyware.

Bot:This malware is designed to hold a computer system for the data it contains captive until a payment is made. Ransomware usually works by encrypting data in the computer with a key unknown to the userOther versions of ransomware can take advantage of specific system vulnerabilities to lock down the system. Ransomware is a spread by downloaded file or some software vulnerability.

Scareware:This is a type of malware designed to persuade the user to take a specific action based on fear. Scareware forges pop-up windows that resemble operating system dialog Windows. Use Windows convert convey messages saying the system is at risk or needs the execution of a specific program to return as normal operations. Reality, no problems were assessed or detected and if the user agrees an Clears the mention program to execute, his or her system will be infected with malware

Rootkit:Just know where it is designed to modify the operating system to create a back door. Attackers then use the back door to access the computer remotely. Most chicks take advantage of software vulnerabilities to perform privilege escalation in modified system files. It is also, for rootkit to modify system forensics and monitoring tools, making them very hard to detect. Often, a computer affected by rootkit must be wiped and reinstalled.

Virus:A virus is a malicious executable code that is attached to other excludable files, often legitimate programs. Most viruses require end-user activation and can activate at a specific time or date. I was just going to be harmless and simply display a picture or they can be destructive, such as those that modify or delete data. Viruses can also be programmed to multiply to avoid detection. Most viruses are now spread by USB drives, optical disc, Network shares, or email.

Trojan Horse:Trojan horses malware that carries out malicious operations under the disguise of the desired operation.This malicious code exploits the Privileges of the user that runs it. Often, Trojans are found in image files, audio files or games of a trojan horse, the first one virus because it finds itself in non-executable files.

Worms:Worms are malicious code that replicate themselves by independently exploiting vulnerabilities and networks. Worms usually slow down networks. We're areas a virus requires a host program to run, worms can run by themselves. Other than the initial infection, they no longer require user participation. After the host is infected, the warm is able to spread very quickly over the network. Worms share similar patterns. They all have an enabling vulnerability, a way to propagate themselves, and they all continue to payload.

Man-In-Middle (MitM):MitM allows attackers to take control over a device without the user's knowledge. Without level access, the attacker can intercept and capture user information before relying on it to its intended destination. Attacks are widely used to steal financial information. Where and techniques exist to provide attackers with MitM capabilities.

Man-In-Mobile (MitMo)-A variation of man in Middle, meet MitMo is a type of attack used to take control over mobile devices. When infected, the mobile device can be instructed Two extra loves Trey use your dad sensitive information and send it to that hacker. Zeus, an example of an exploit with MitMo capabilities, allows attackers quietly to capture 2 - step verification SMS messages sent to users.

Symptoms Of Malware

*There is an increase in CPU usage.

*There's a decrease in computer speed.

*Computer freezes or crashes often.

*There's decreasing web browsing speed.

*There are unexplainable problems with network connections.

*Files are deleted

*Files are modified

*There is a presence of unknown files, programs or desktop icons

*There Are unknown processes running

*Programs are turning off or reconfiguring themselves

*Noah's being sent without the user's knowledge or consent

Activity:Identify Malware Types

*Bot:Malware designed to automatically perform action, usually online.

*Ransomware:Malware designed to hold a computer system or the data it contains captive until payment is made.

*RootKit:Malware designed to modify the operating system to create a backdoor.

*Spyware:Bundled with legitimate software, this malware is designed to track a user's activity

*Virus: Malicious executable code that is attached to other excludable files, often legitimate programs.

*Trojan Horse:Malware that carries out malicious operations under the guide of a desired operation.

*Adware:sometimes bundled with other software, this malware is designed to automatically deliver advertisements

*MitMo:Now we're used to take control over mobile device

*Scareware:Malware designed to persuade the user to take a specific action based on fear

*Worm:malicious code that replicates Itself by indepently exploiting vulnerabilities in networks

Social Engineering:

Pretexting:This is when an attacker calls an individual And lies to them and attempts to gain access to privileged data. An example involves an attacker who pretends to need personal or financial data in order to confirm the identity of the recipient

Tailgating-This is when an attacker quickly follows in a unauthorized person into a secure location

Something for Something(QUid Pro Quo)-This is when an attack to request personal information from a party in exchange for something, like a free gift

Wi-Fi Password Cracking-Wi-Fi password cracking is the process of discovering the password used to protect the wireless network. These are some techniques using password-cracking:

Social Engineering-Attack manipulates a person who knows a password into providing it

Brute-Force Attacks-Attackers try several possible passwords in an attempt to guess a password. The password is a 4 digit number, for example, the attacker would have to try every one of 10000 combinations. Brute-Force attacks usually involve a wordlist file.This is a text file containing a list of words taken from a dictionary. A program then tries each word in common combinations. Because Brute Force attacks take time. Complex passwords take much longer to guess. A few passwords Brute Force to include Ophcrack,L0phtCrack, THC Hydra,Rainbow cracked,and Medusa

Networking Sniffing:The listening and capturing packets sent on the network, an attacker may be able to discover the password when the password is being sent unencrypted in plain text. the password is encrypted the attacker may still be able to reveal it by using a password cracking tool

Vulnerability Exploitation:

Step 1:Gather information about the targeted system. This could be done in many different ways such as Port scanner or social engineering. The goal is to learn as much as possible about the Target computer

Step 2:One of the pieces of relevant information learned in step one might be the operating system, it's version, and a list of services running on it.

Step 3:Target's operating system and version is known, the attacker looks for any known vulnerabilities specific to that version of Os or other OS services.

Step 4:When a vulnerability is found, the hacker looks for a previous written exploit to use. If no exploits have been written, the attacker may consider writing an exploit.

Overwhelming Quality Of Traffic-This is what a network / host / or application is sent an enormous quantity of data at a rate which cannot handle. This causes a Slowdown in transmission or response, or crash of a device or service

Malicious Formatted Packets-This is when a malicious formatted pocket is sent to a host or application in the receiver is unable to handle it. For example, an attacker forwards packets containing errors that cannot be identified by the application or forwards improperly format this causes the receiving device to run very slow or crash

DoS attacks are considered a major risk because they can easily interrupt communication and cause significant loss of time and money. These attacks are relatively simple to conduct, even by an unskilled attacker.

DDoS:A Distributed DoS Attack (DDoS) is similar to a DoS attack but originates from multiple, coordinated sources.

SEO Poisoning:Search Engine Optimization to make a malicious website appear higher in search

results

Identify the attack type activity

*DoS-Relatively simple to conduct,even by an unskilled attacker.

*DDoS-Originates from multiple,coordinated sources.

*DDoS-Zombies are controlled by handle systems

*DoS-when a malicious formatted packet is sent to a host or application and the receiver is unable to handle it.

*SEO Poisoning:Make a malicious website appear higher in search results.

*SEO Poisoning-Increases traffic to malicious sites that mau host malware or perform social engineering

*DDoS-Attacker builds a network of infected hosts,called a boynet

*DoS-When a network,host,or application is sent an enormous quantity of data at a rate which it cannot handle.