Malware Threats and Entry Points

Malicious software designed to harm or disable computer systems, or give unauthorized control to the creator for theft or fraud.

A type of malware that disguises itself as harmless software, allowing hackers to gain unauthorized access and control over a computer system.

Methods used by hackers to spread malware, including malicious websites, compromised legitimate sites, and drive-by downloads.

Trojans can delete critical files, disable security software, generate attacks, create backdoors, and steal information.

Malware can enter systems through various means, such as malicious links, infected attachments, or exploiting software vulnerabilities.

A Trojan that bundles itself with a legitimate application (like a game or office program).

A Trojan that gives remote access to a command prompt (shell) on the victim's computer.

A Trojan that provides complete graphical user interface (GUI) access to a victim's computer from a remote location.

A Trojan that infects many computers to form a network controlled by the attacker's Command and Control center.

A self-replicating program that attaches to other programs or system files, spreading copies of itself.

A computer virus infects other programs, alters data, replicates, corrupts files, encrypts itself, and damages systems.

Virus development using programming languages or special kits.

Virus replicates within a system, then spreads to others.

Virus activation triggered by user action (like opening a file).

A virus is identified and recognized as a threat.

Antivirus developers create defenses against the virus.

Users install updates or antivirus software to remove the virus.

People create viruses for various reasons, including harming competitors, personal gain, research, pranks, vandalism, or political messages.

Computers get infected by opening suspicious email attachments, installing pirated software, ignoring updates, and not using the latest antivirus.

Encryption viruses encrypt their code to avoid detection by antivirus software.

A network attack where an attacker intercepts and reads network traffic passing through a network, potentially capturing sensitive data like passwords and user credentials.

Certain network protocols transmit data in plain text, making them susceptible to sniffing attacks. Examples include HTTP, Telnet, FTP, and POP3.

Sniffers operate at the Data Link layer of the OSI model, capturing network traffic before it's processed by higher layers, making it invisible to the targeted application.

A specialized device that captures network traffic without altering it, allowing security professionals to monitor network activity and detect suspicious behavior.

Hardware protocol analyzers are used to monitor network traffic and identify malicious network traffic generated by hacking software installed on the network.

Sniffing is the process of capturing and analyzing network traffic data packets. This is done by listening to all data passing through a specific network segment, often using sniffing tools.

Promiscuous mode is a network interface card (NIC) setting that allows the card to capture all network traffic passing through it, not just the data intended for the device. It enables sniffing tools to capture all data packets, even those not directed at the sniffing device.

Passive sniffing involves capturing network traffic without actively modifying or altering the network. It typically occurs on networks using hubs where all traffic is broadcast to every device connected.

Active sniffing involves actively manipulating network traffic to capture data. This often involves using techniques like ARP spoofing to redirect traffic through the attacker's device, allowing them to capture data packets not intended for their device.

ARP poisoning is a technique used in active sniffing where an attacker sends false ARP messages to a network, to deceive other devices and cause them to send traffic through the attacker's device.

A device that captures data packets, decodes them, and analyzes their content based on predefined rules. It provides insights into network traffic, helping identify issues and potential security threats.

Secretly monitoring and recording conversations or data transmissions between two parties without their knowledge or consent. It's an invasive method of gathering information and often illegal.

Wiretapping that not only monitors and records communication but also modifies it or injects new data into the traffic flow.

Wiretapping that solely focuses on monitoring and recording communication without making any changes to it.

Legally authorized monitoring of communications data for surveillance purposes, usually involving court orders or requests for wiretaps.

A data collection program designed to gather and analyze foreign intelligence data that passes through US servers, raising concerns about privacy and potential abuse.

A physical device used for analyzing network traffic, providing in-depth insights into the network's behavior and performance.

A real-world example of how wiretapping techniques are used to monitor and collect data, potentially raising ethical and legal concerns.

A unit of data transmitted over a network, containing information about the sender, receiver, and the data itself.

Specific criteria or patterns used to analyze data packets, helping to identify anomalies or interesting information.

An attacker steals a target's password file and attempts to decipher passwords offline using various methods.

A pre-computed database of password hashes used to quickly crack passwords offline.

An attack that uses a list of common words and phrases to guess passwords.

An attack that tries every possible combination of characters until the correct password is found.

An attacker uses gathered information to create a list of potential passwords and tries them manually.

The process of exploiting system vulnerabilities to gain unauthorized access, escalate privileges, execute malicious code, hide activities, and cover tracks.

Techniques used to recover passwords from systems, often by trying multiple combinations until the correct one is found.

Different approaches to cracking passwords, categorized by attacker's method and communication with the target system.

Password cracking methods that don't involve computers, relying on social engineering or physical access.

Password cracking techniques that involve direct communication with the target system, such as brute forcing or phishing.

An attacker copies downloaded files to a USB drive, then uses the drive to execute a program (like PassView) that steals passwords and stores them in a .TXT file on the USB drive.

A passive online attack where attackers use tools to capture and record network traffic, including sensitive information like passwords and emails.

An attacker captures and records authentication tokens from network traffic. They then replay these tokens to gain unauthorized access.

An attacker intercepts communication between a victim and a server, gaining access to the information being exchanged.

An offline attack that uses a precomputed table of password hashes to quickly crack passwords by comparing captured password hashes with the table.

An attacker gaining higher access privileges on a system, often exploiting vulnerabilities to gain administrative control.

Gaining access to a higher level of privileges than the current user's, for example, going from a regular user to an administrator.

Gaining the same level of privileges but assuming the identity of another user with similar permissions.

Limiting direct user access to a system as a defence against privilege escalation.

Running users and applications with the minimum privileges necessary to perform their tasks, limiting potential damage if a system is compromised.