Attack Types

Página 1

Phishing- fake websites asking for credentials

Vishing- Voice phishing

Tailgating- using someone else to gain access to a secure area

Mantrap/airlock- one person at a time (???)

Hoaxes- can tell you there is a virus have u pay but there really isnt a virus

Watering Hole Attack- bad guys attack sites you visit and wn u visit then you then become infected

Social Engineering- a form of manipulation to gain access to information, can be done by verbal intimidation or authority

Denial of Service- making a service unavailble by taking advantage of design vulnerability, over whelming of a service causing it to be denied, deny DNS server then create their own. Botnet, amplification.

Man in the middle- intercepts your traffic then redirects it to the recipent , bad guy will send bad ARP request to original work station, then all info work station send to router will go through bad guy first

Man- on the Browser- creat a proxy in your system and send info througth proxy without having to be n local network (COME BACK TO THIS )

ARP- IP associated to MAC saved in computre for future reference

Buffer overflows- when info being wrtitten to memory overflowsfrom alloted space. Bad guys grab data that has over flowed.

Data Injection-poorly written code in application, bad guy injects his own code

SQL- structer query language, most common way to inject,

Cross Site Scripting- Non Persisent (REflected attack) , putting Java script into a search box on a website to have it perform a specific function like sending user info or tokens. Could disable java but that will prevent u from accessing a lot of other websites that run on java

Cross site request Forgery-shouldnt happen if encryption is good. 3 devices, bad guy, site visitor, web server. Bad Guy creates request (funds), sends hyper link to 3rd party user, they click link, link sends request to server to do transfer. Transfer is validated by the bank.

Privilege Escalation- Gaining more access to a system than was originally intended, could possibly become the system administrator.

DNS Poisioning - could change the client host file to direct someone to a wrong IP address. OR change whats inside the DNS server to affect more clients.

Domain hijacking- gain access to domain registration. change domain information to a bad guys IP

Zero Day Attacks- exploits a new found vulnerability before it can be patched

Replay attacks- copy off all info sent from orginal user is sent to bad guy as well, he replays the it over net work making the server think its the same person and granting them access. Now a days the passwords have a different hash each time they are sent.

Client Highjacking attack-

URL Highjacking- taking traffic that was ment for your site and redirdting it. Misspell= typo squating

Session High jacking - gaining access to the session ID (via cookie?) and using it to access account

Driver manipulation- putting malicious code onto hardware drivers

Refactoring- Changing the way Malware looks everytime

Spoofing-Pretending to be a webserver, DNS server or person. Email, area code, MAC, IP address.

Wirelss Replay Attack- easier to capture data since data its transmitted OTA. Need to capture aprox 15 thousand data packets then run the cracking program against the recently collected data file

Rouge Access Point- Someone plugs in an access point to provide service to more users. Should configure 802.1x, its authentication control so everyone must ahenticate before going on network.

Wireless Evil Twin- Congifureing a WAP to look exactly like the original with the same password and BSSID so people connect to that instead of original . Signal from Wireless Evil Twin may over power original

Wireless Jamming- Over Whelming the signal, making the netowrk non useable.Must be in close proximity to what you are jamming ( Fox hunting is finding where the jamming is commin from)

WPS (Wifi Protected Setup)- pin w/ access point, button on acces point, NFC, USB. Had design flaw, Personal ID number is a 7 digit number with a check number at the end, these can be brut forced within 4 hours. No longer used

Blue Jacking - Relativly harmless, just sending data over buetooth did not grant access to your data

Blue snarfing- Contacts, Calendar, email and pics could be downloaded if you know the file name.

RFID- we power the device via radio freq, use for tracking products mostly

NFC- two way wirless netowork used for paying mostly, can be jammed

Wireless Dissasociation Attack - Its a denial of service to a wireless network. Takes 802.11 packets that are transfered OTA and denies BSSID and Station MACs.

Cryptographic attack-

KPA(known plain text attack)- when they have the crypto info and a small part of the plain text, they can then break out the rest of the crytpography

Threat Actors (Bad Guys)

Script Kiddie-Runs premade scripts to find vulnerabilities. Looking for easist exploits

Hacktivist- They have a mission for social change/ political agenda

Organized Crime- Professionals, mostly money motiviated. They belong to an organiztion, have capital, goal is to make money,

Governments- National security, hack against external org or government. All the rescources

Insiders- Has institutonal knowledge, extensive resources

Competitors- trying to find ways to bring down system, make you look bad or just get inside information.

Penetration Testing- Simulating an attack against another device on a known vulnerability

Should first passivly gather information from open source methods

Black box- No information provided

White Box- Give testers all the information about OS

Grey Box- Focusing on a subset of network or services

Vulnerability Scan- Gahering information about system with out penetration. Will gather a lot of information. Does not preform an exploit

Non-Intrusive- Gather info, dont try to exploit

Intrusive-Try out vulnerability to see if it works

Non Credentialed Scans- Scanner cant log into remote device

Credentialed Scan- Login as a normal user then emulates an insider attack

Vulnerability Types

Digital- Code

Physcial- hardware

Race Condition- Coding Problem, when two cmmands are executed at the same time

End of life- Device or software is no longer under support by vendor, so it stops geting security patches now its vulnerable.Always upgrade to latst version so you keep getting patches.

Embedded Systems -No direct access to operating system,usually connected to internet. (Security system)

Lack of Vendor Support- They are the only ones who can do upgrades and patching.

Improper Input Handling- putting malicious code in an application (SQL injection,buffer overflow)

Improper Error Handling-Error messages with too much information

Misconfiguration- Leaving a back door open or giving access to public

Default Configuration- leaving all defualt configs, botnets can brute force into it but trying all known default

Weak Cipher Suite- Encryption protocol, lengthy encryption key, hashSome Suites are easier to crack than others (TLS and SSL )

Memory Leak-Unused memory is not properly released. allocated then never un allocated. Use more and more of the memory then uses all memory and crashes app or computer