Computer Security: Vulnerabilities, Threats & Cyber Attacks

Introduction to Computer Security

• Computer security protects computer assets or systems that are valued.
• Security protection is required for hardware, software, and data contained in computer systems because they have value.

Key Concepts: Vulnerabilities, Threats, and Controls

• A vulnerability is a weakness that can be exploited to cause loss or harm in a system's procedures, design, or implementation.
• A threat is a set of circumstances with the potential to cause loss or harm to a computing system.
• Potential harm to assets can be assessed by examining possible negative events and their causes.
• Risk management involves choosing threats to control and allocating resources for protection.
• Harm is the negative consequence of a threat becoming real and being actualized.

Cyber Attackers

• An attack on a system is perpetrated by a human exploiting a vulnerability.
• An attack can also be launched by another system.
• To be successful, a malicious attacker requires a method, an opportunity, and a motive.
• One can prevent the success of an attack if deny any of the method, the opportunity, and the motive from an attacker.
• Attackers include terrorists, hackers, organized crime members, and individuals.

Security Goals

• Confidentiality ensures only authorized parties can view an asset.
• Integrity ensures an asset is modified only by authorized parties.
• Availability ensures authorized parties can use an asset.

Controls

• It is possible to Control vulnerabilities by using a control or countermeasure as protection to prevent threats.
• Harm can be dealt with by preventing, deterring, deflecting, mitigating, detecting, or recovering from its effects.

Types of Security Controls

• Physical controls: use tangible means to stop or block an attack, such as fences, locks, guards, sprinklers, and fire extinguishers.
• Procedural or administrative controls: use commands or agreements to influence behavior, like laws, regulations, policies, procedures, guidelines, copyrights, patents, and contracts.
• Technical controls: counter threats with technology such as hardware and software, including passwords, access controls, network protocols, firewalls, intrusion detection systems, encryption, and network traffic flow regulators.
• Overlapping controls or defense in depth can be effective, even when there is more than one class of control.

Attack Lifecycle

• Common phases: initial comprise, establish foothold, escalate privileges, internal recon, move laterally, maintain presence, and complete mission.

Case Study #1: Show Me the Money

• In early January, an attacker exploited a SQL injection vulnerability on a web page hosted by WEB1.
• WEB1 was in a demilitarized zone (DMZ) for a small business unit.
• Exploiting the vulnerability allowed the attacker to execute commands on the backend DB1 database system.
• The attacker implanted a backdoor one week post internal access.
• The backdoor gave access to the corporate environment without the necessity to re-use SQL injection.
• The attacker extracted and cracked DB1's local administrator account's password hash to obtain local administrative access to the majority of the systems in the environment.
• The attacker installed keystroke-logging malware following reconnaissance efforts.
• By mid-February, 20 backdoors or more were put in place by the attacker.
• The BKDOOR malware family facilitated modification to evade antivirus detection, file control, Remote Desktop Protocol (RDP) tunneling, and network traffic proxying.
• The RC4 algorithm was used by the BKDOOR malware to encrypt command and control functions (C2) to a server outside the controlled environment of the victim, for use by the attacker.
• The BKDOOR malware maintained persistence via "DLL search order hijacking.”
• The second malware family, PROXY, proxied connections to a specified location.
• The attacker targeted usernames, passwords, network architecture data, and other IT data
• The attacker obtained data on how the company managed financial information to plan the next course of action.
• The attacker exfiltrated data using outbound FTP and transferred data to the backdoor's C2 server.
• Attackers discovered JMPSRV jump server in June, it is limited system used to give system administrators with access to sensitive segements handling all the financial information.

Initial Compromise

• The attacker used a SQL injection attack against a vulnerable database server.

Establish Foothold

• The attacker ensures remote access to a recently compromised system.
• Backdoor malware was established on a system within the internal environment.

Escalate Privileges

• The attacker used password hash dumping before cracking them for domain admin access.

Internal Reconnaissance

• The attackers manually explored local user directories.

Move Laterally

• The attacker leveraged RDP connections, mapped network shares, and interacted with backdoors.

Maintain Presence

• The attacker implanted different backdoor variants.
• Each family operates uniquely, evading single-point detection.

Complete Mission

• The the attacker stole the cardholder data.

Explore computer security fundamentals including vulnerabilities, threats, and controls. Learn how vulnerabilities can be exploited, threats can cause harm, and the role of risk management in protection. Understand the nature and actors involved in cyber attacks on computer systems.