Chapter 2 Quiz

security vulnerability :

any type of hardware or software defect that malicious users attempt to exploit

exploit :

a program written to take advantage of a known security vulnerability

cyberattack :

the act of using an exploit against a vulnerability with the goal of breaking into the target system

software vulnerabilities :

usually caused by errors in operating system or application code

security patches and updates :

released by operating system and application producers to avoid exploitation of vulnerabilities

Project Zero :

Created by Google, this is an example of a third-party permanent team of researchers that is dedicated to finding software vulnerabilities.

hardware vulnerabilities :

security weaknesses caused by design flaws in computer devices and components. They are usually limited to specific device models and are commonly exploited through targeted attacks.

buffer overflow :

a software vulnerability that occurs when data is written beyond the limits of memory areas that are allocated to an application. This vulnerability can cause an application to access memory that is allocated to other processes.

non-validated input :

a vulnerability in which data supplied to a program by a user or exploit causes the application to behave in an unintended way

race conditions :

a vulnerability that occurs when an ordered or timed set of processes is disrupted or altered by an exploit

access-control problems :

improper use of practices that manage physical control of equipment, data, or applications

malware :

any computer code that can be used to steal data, bypass access controls, or harm or compromise a system

spyware :

malware designed to track the actions of users and capture data

adware :

software that automatically delivers advertisements. Some types contain spyware.

bot :

malware designed to automatically perform actions over the Internet

ransomware :

a type of malware that holds a computer system captive, frequently by encrypting essential data, until a payment is made to the attacker

rootkit :

malware designed to modify operating systems to allow unauthorized remote access through a backdoor. Rootkits can modify user privileges, system files and system forensics and monitoring tools, which makes them extremely difficult to detect and remove.

virus :

malicious executable code that can be attached to legitimate programs. Viruses usually require end user activation and can be relatively harmless or very destructive. They frequently spread by USB drives, optical media, network shares, or email.

Trojan horse :

malware that carries out malicious operations while appearing to have a desired function. They are included in non-executable files, unlike viruses, which are executable.

worms :

malware in the form of malicious code that replicates itself independently by exploiting vulnerabilities in networks. They spread very rapidly over a network because they run by themselves. All share similar patterns including an enabling vulnerability, a way to propagate themselves, and a payload.

man-in-the-middle (MitM) :

a technique in which a an attacker can take control of a device without the owner's knowledge. The attacker can intercept and capture information that passes through the device on its way to another destination.

man-in-the-mobile (MitMO) :

an attack that is a variation of (MitM). A mobile device is infected with malware that takes control of the device and causes it to forward sensitive information to attackers.

social engineering :

a way of gaining access to resources that manipulates individuals into performing actions or divulging confidential information. Attackers attempt to exploit our willingness to help or exploit our weaknesses.

pretexting :

a type of social engineering attack in which an individual lies in order to gain access to privileged information

tailgating :

a type of social engineering attack in which an attacker follows an authorized person into a secure location

something for something :

a type of social engineering attack in which an attacker requests personal information in exchange for something such as a free gift

Wi-Fi password cracking :

the act of discovering a password that is used to protect a wireless network

brute-force attacks :

the use of a software program to challenge a password repeatedly with all the possible values that could be used for a password, or with a list of words that are commonly used in passwords. Complex passwords are much more difficult to guess.

network sniffing :

the use of software to capture packets on a wireless network. Unencrypted passwords can be captured and used in an attack, and encrypted passwords could be cracked with a software tool.

phishing :

use of a generic fraudulent email that appears to be sent by a legitimate source. The email tricks people into installing malware or sharing confidential information.

spear phishing :

a highly targeted attack in which emails that appear to be sent from a legitimate source are customized for specific persons. An attacker researches the interests of the target in order to create an email that tricks that specific person.

vulnerability exploitation :

the use of various methods, including software tools or social engineering, to gain information about a system. This attacker uses this information to find weaknesses that exist in that specific system.

advanced persistent threat (APT) :

a multi-phase, long term, stealthy, and advanced attack against a specific target. APTs are complex and require a high level of skill, so the attacks are usually well-funded and target organizations or nations for business or political reasons. They usually involve network-based espionage that uses malware that is undetected on the target systems.

whois :

a public Internet database that contains information about Internet domain names and the people or organizations that registered the domains. It is a source of information that can be used to exploit system vulnerabilities.

nmap :

a popular port scanning tool that can be used to discover vulnerabilities in networked systems

denial-of-service (DoS) :

an attack that interrupts network services to users, devices, or applications

overwhelming quantity of traffic :

a DoS attack in which an enormous number of packets are sent to a network at a rate that the network systems cannot handle. This results in a slowdown of network transmission or response, or the crash of a device or service.

maliciously formatted packets :

the use of network data structures that have been created to disrupt the operation of network devices

distributed denial-of-service (DDoS) :

the use of multiple distributed systems to send data that disrupts services provided by networks and network devices

botnet :

a network of distributed infected hosts that is used to launch a DDoS attack

search engine optimization (SEO) poisoning :

the manipulation of the ranking of a malicious website in order to attract users to the site so that malicious code will be distributed or social engineering can be used to gather confidential information

blended attack :

the use of multiple techniques to compromise a target

impact reduction :

the use of techniques to limit the damage caused by a successful attack. These techniques include ways of communicating about the attack to employees and clients, investigation of the attack, and measures to prevent future attacks.