Cybersecurity Chapter 2: Attacks and Techniques

Chapter 2: Attacks, Concepts, and Techniques

• This chapter covers security vulnerabilities, exploits, attacks, and malware.

Finding Security Vulnerabilities

• Security vulnerabilities are flaws in software or hardware.
• Malicious users exploit vulnerabilities.
• An exploit is a program designed to take advantage of a vulnerability.
• An attack is the act of using an exploit against a vulnerability.

Software Vulnerabilities

• Software vulnerabilities often arise from errors in operating systems or application code.
• Operating system vendors regularly release patches and updates to address these flaws.
• SYNful Knock (2015) was a significant vulnerability in Cisco IOS, allowing attackers to control routers, monitor network communication, and infect other devices.

Software Vulnerabilities (continued)

• Software updates aim to prevent exploitation of vulnerabilities.
• Some companies have dedicated security teams focused on discovering vulnerabilities in software, like Google's Project Zero.

Hardware Vulnerabilities

• Hardware vulnerabilities stem from design flaws.
• Rowhammer is an exploit that takes advantage of close capacitor placement in RAM memory, affecting neighboring capacitors.
• Hardware vulnerabilities are often specific to device models.
• Hardware exploits are prevalent in targeted attacks.

Categorizing Security Vulnerabilities: Software

• Buffer Overflow: Writing data beyond a buffer's allocated memory, potentially causing system crashes, data compromises, or privilege escalation.
• Non-validated Input: Programs accepting potentially malicious data without proper validation, leading to memory issues and security flaws (e.g., malicious image files with incorrect dimensions).
• Race Conditions: Event outcomes depending on the order or timing of events, when these are not properly synchronized can lead to security vulnerabilities.
• Weaknesses in Security Practices: Avoiding creating custom security algorithms and relying on pre-tested security libraries to avoid introducing new weaknesses.

Categorizing Security Vulnerabilities: Access-Control Problems

• Proper management of physical access to equipment is crucial.
• Access controls define who can access resources.
• Operating systems sometimes cannot enforce access restrictions if read or write access directly to storage devices bypass them. Protecting machines and data requires access restrictions and data encryption.

Types of Malware

• Malware is malicious software.
• Spyware: Monitors user activity.
• Adware: Displays advertisements.
• Bot: A malicious program acting under commands from a botnet.
• Ransomware: Holds systems or data hostage until a ransom is paid. It encrypts data, making it inaccessible.
• Scareware: Attempts to trick users into taking actions by using fear and posing as operating system components.
• Rootkits: Backdoor access, modifies system utilities, and are very difficult to detect. Requires a wipe and reinstall to remove.
• Virus: Self-replicating code attached to executable files. Can be harmless or destructive and can spread through various means.
• Trojan Horse: A disguised malware that conceals malicious code. Commonly disguised as benign files, often found in images, videos, audio clips.
• Worms: Self-replicating malware that spreads over networks. They often cause significant network congestion.
• Man-in-the-Middle (MitM) & Man-in-the-Mobile (MitMo): Intercepting communication between two parties without their knowledge to steal information like financial data, or capture two step authentication SMS messages.

Symptoms of Malware

• Increased CPU usage, decreased computer speed, frequent freezes/crashes, network issues, file modifications or deletions, appearance of unknown files/programs, erratic program behavior, unauthorized email sending.