Understanding Cyber Threats

What is a Threat?

• Threats are potential occurrences of undesirable events which can damage and disrupt activities in an organization.
• Attackers use cyber threats to infiltrate and steal data, such as personal information, financial data, and login credentials.

Examples of Threats

• Attackers stealing sensitive data from an organization.
• Attackers causing a server shutdown.
• Attackers tricking employees into revealing sensitive information.
• Attackers infecting systems with malware.
• Attackers spoofing the identity of authorized personnel for unauthorized access.
• Attackers modifying/tampering with transferred data over a network.
• Attackers remotely altering data in a database server.
• Attackers performing URL redirection or URL forwarding.
• Attackers performing privilege escalation for unauthorized access.
• Attackers executing denial-of-service (DoS) attacks, rendering resources unavailable.
• Attackers eavesdropping on communication channels without authorized access.

Threat Sources

• Threat sources can be natural, unintentional, or intentional.

Natural Threats

• Natural factors can threaten organizational assets.
• Fires, floods, power failures, lightning, meteor strikes, and earthquakes are natural threats.
• These cause severe physical damage to computer systems.

Unintentional Threats

• Unintentional errors can incite threats.
• Insider-originating security breaches, operator errors, negligence, unskilled administrators, lazy or untrained employees and accidents can be unintentional threats

Intentional Threats

• Internal and external threats are two sources of intentional threats.
• Internal threats includes computer and Internet-related crimes are from insiders or internal attacks.
• Disgruntled or negligent employees are internal threats that harm an organization intentionally or not, they often have privileged network access.
• External threats leverage network vulnerabilities without insider's help, and the severity of these identified network weaknesses dictates the harm caused..

External Threats Further Classified

• Structred Threats: implemented by technically skilled attackers to disrupt services.
  • Motivations include bribes, racism, terrorism, and politics.
    • Examples: distributed ICMP floods, spoofing executing attacks from multiple sources.
  • Attackers are difficult to identify
• Unstructred Threats: implemented by unskilled attackers, to access networks.
  • Untrained attackers use available online tools for network attacks or crashing public websites.
  • They are primarily motivated by curiosity, not criminal intent.
  • Prevented with port-scanning and address-sweeping tools.

Threat Actors/Agents

• Hackers and other malicious actors are categorized into Black Hats, White Hats, Gray Hats, Suicide Hackers, and Script Kiddies.

Black Hats

• They use extraordinary computing skills for illegal or malicious purposes.
• Often involved in criminal activities.

White Hats

• Penetration testers use hacking skills for defensive purposes.
• Security analysts secure networks and systems against malicious attacks with system owner’s permission.

Gray Hats

• Individuals work both offensively and defensively.
• They help hackers discover network vulnerabilities, and help vendors by checking limitations making them secure.

Suicide Hackers

• Aim to disrupt critical infrastructure for a "cause".
• Not concerned about punishment.

Script Kiddies

• Unskilled hackers use scripts, tools, and pre-made software.
• They focus on quantity over quality of attacks performed.
• They aim to gain popularity or prove technical skills.

Other Types of Threat Actors/Agents:

• Cyber Terrorists.
• State-Sponsored Hackers.
• Industrial Spies.
• Insiders.
• Hacker Teams.
• Criminal Syndicates.
• Hacktivists.
• Organized Hackers.

Cyber Terrorists

• Motivated by political/religious beliefs to create fear through large-scale network disruptions.

State-Sponsored Hackers

Skilled hackers used by governments to obtain secret information/damage systems of other governments/military organizations.

• They are detecting/exploiting nation's infrastructure and gathering intelligence

Industrial Spies

• Illegally spy on competitors focusing on designs and stealing corporate secrets.
• Often use Advanced Persistent Threats (APTs).
• May use social engineering to steal sensitive data, which result in financial loss.

Insiders

• Trusted people in an organization who has access to critical assets.
• They use privileged access to violate rules/cause harm involving data corruption.
• Disgruntled or terminated employees, or undertrained staff members are insider threats.

Hacker Teams

• Skilled hackers have own resources and search to gain vulnerabilities.
• Team of hackers also develop advanced techniques executing attacks.

Criminal Syndicates

• They engage in criminal activities, exploiting victims in various jurisdictions.
• Illegally embezzle money with cyber attacks and money-laundering.

Hacktivist

• Form of activism in which hackers break systems as an act of protest.
• They hack to raise awareness boost their reputation with a political agenda.
• They deface websites revel information perceiving a threat unauthorized access is a crime.

Organized Hackers

• Hierarchical hacker groups are organized in criminal activities.
• Using not their own devices and botnets are rented from crimeware to attacks.
• Money is stolen and re-sold for stealing data and intellectual property to covertly penetrate the target network undetected.

Attributes of Threat Actors

 - Internal, External, Level of Sophistication, Resources/Funding, Intent/Motivation

• Internal:
  • Insiders are trusted with authorized systems network and resources.
• External:
  • Outsiders who never have authorized access to systems/networks using physical resources.
• Level of Sophistication:
  • Highly sophisticated actors are more successful.
• Resources/Funding:
  • Attack support is obtained financially on software.
• Intent/Motivation:
  • High level of motivation can be launched connected to attacker political, or personal goals.

Threat Vectors

• A threat vector is the method by which an attacker gains access to a system via known vulnerability.
• Vectors: Direct Access, Removable Media, Wireless, Email, Cloud, Ransomware, Supply Chain, Business Partners

Direct Access

• Attacker gains physical access and performs malicious activities, such as OS change/Keyloggers/software worms
• Attackers download data backup media/portable devices

Removable Media

• USB drives, phones and printers is a threat when plugged in.
• Steals or corrupts files with data with malware on host systems.
• Data leakage through removable media can be difficult to prevent/detect

Wireless

• Unsecured wireless corporate hotspots is open to attack
• Attackers can use authentication credits or spoofing to gain access for the corporate network attack

Email

• Attachments may perform phishing campaigns with malware, or to get information to infect systems

Cloud

• Injecting malware to gain information of user data by decepting cloud systems.
• Accounts are exploited with weak credential, also with access to data in target cloud services

Ransomware/Malware

• Advantage can be extracted using attacks from trojans/file-less/ad/malware to exploit/infiltrate organization

Supply chain

• Vulnerabilities can exploit data or resources to use 3rd party vender.
• Introduce a solution to the use attacks.

Business Partner

• Attacks with 3rd party attacks is for accesses.
• transparency is neeed for introducing cybersecurity is needed to have a solid mutual understanding of trust on mitigating

Intro to Malware

• Malware: Malicious software that damages/disables systems and grants control theft or fraud
• Malware Used for:
  • Attack browsers, Track websites visits, slow down systems, Hardware failure, Steal personal information

Ways for Malware to Enter a System

• Instant Messenger applications; Portable hardware removable media devices; Browsers and software bugs; Untrusted sites; Downloading files Internet; Email attachments are different ways
• Installation by other malware; bluetooth wireless networks

Autorun

• Turn off autoplay to mitigate setup.exe.
• Computer Configuration > expand Admin > Windows Components > Autoplay Policies.
• "Turn off Autoplay" and enable "All Drives".

Techniques to Distribute Malware on the Web

• Black Hat SEO, social-engineering/click jacking; Spear phishing sites; malvertising; compromised websites downloads.
• Emails

Black Hat SEO

• Ranking by aggressive keyword stuffing.

Social Engineered Click-jacking

• Inject malware to execute websites to click malware.

Spear Phishing Sites

• Steal credentials, bank accounts, mimicking institutions

Malvertising

• Embedding illegitimate ads with malware advertisements on systems

Downloads/Infections, Spam

• A website is simply visiting, downloading unintentionally software.
• When using users websites that have system infections their computers perform malicious actives.
• Use emails to send viruses compromised attached

Components of Malware:

• Crypter; Downloader; Dropper; Exploit; Injector; Obfuscator; Packer; Payload
• Java, Activex, Plug installions, and pushed web servers.

Crypter

• Conceals and protects malware from detection through reverse engineering and analysis.

Downloader

• downloads malicious code and files from the Internet to an infected device
• Attackers first gain first access to intall a downloader

Dropper

• Insides drop code need and intial intall of programs to have scanners undetected.

Exploit

• Containing code that benefits digital systems and have users breach security

Injector

• Injects exploit to change malicious execution by preventing removal injection.

Obfuscator

• Concealing malware to prevent system detection from malware

Packer

• Software compresses the malware for conversion.

Payload

• Activated Malware to effect perform open of deletion and modification to port activity

Key Malware Type:

Trojan, virus, ransomware, worms and rootkits.

Characteristics Of Trojans

• Appears to be helpful/legitimate applications, can be installed/opened by unwitting users.
• When opened, the malicious code runs in the background, gives the person a connection and transfers data

Typical Indications of a Trojan Attack:

• Erratic program behavior, new/unfamiliar icons on toolabar, and performance.
• High CPU usage are all signs to know if trojan attack

How the hackers then use trojans:

• Delete/Replace programs or OS files.
• Recording victims can't see.
• Encrypt all data with the victim doesn't have control

Common Ports Used by Trojans

• Ports 20,21,22,23,23, 68, 80 to 7789

Key Trojans Examples:

• Remote access; Backdoor ; DDoS; Point of Sale; Security Software ; Distabler
• Remoted access from the use system and accounting etc. back doors to access from network computer

Back Door

• Bypasses firewalls for undetected access by hacker leveraging accesses machine networks.
• Users may be able to download it or install without knowledge.

Worms

• They replicate with code that's independent and execute connections
• Resources don’t want use human interactions the worm has a payload that install back doors.

Worm vs Virus

• Virus infects system while worm uses OS/Applications.
• Virus change or add data, worms does not modify any stored programs.
• Worm also is easier to remove than virus

LOLJax

• Is from UEFI can be to automatically inject Malware.
• It evade traditional detections and have a persistence of OS data protection and maintains

Potentially Unwanted Applications

• PUAs; are harmful for free software.
• They are covert data monitors on software and free ware types

Adware

Display advertisement, collect data.

Torrent

• Downloading Torrent compell users.

Marketing

• Browser to apps

Cryptomining

• Financial data on bitcoin

Dialers

• Contacts without consent

Spyware

• User interface without record send data to control

Spyware types

• Spy, power spying, and monitors on a computer are some spying applications

Spyware Actions

• Collect user data and send is a prime objective.

Spytech SpyAgent

• Monitor can do ever program key stroke.

KeyLoggers

Hardware and software to monitor keystroke

• Gather confidential data. like banking and pwds that is sensitive accesss.

What they do

• record activities that users monitor like websites data.

Rootkits

• Used to hide presences attack act access is guaranteed.

Common Areas of Vulnerability

End-User Carelessness and Intentional acts are common reasons vulnerabilities arise from end-user acts.

• Natural to be taken due security. Human factor easy effect serious comes losing info.
• Account info gets the bad and loss or be a 3rd party with network on attack

Act/Ends Acts

• Acts can lead to heavy information that’s financial and heavy to get from security.

Techno Vulnerables:

TCIP is insecure/OS’s need updating/Devices need lack of auth and routing.

Configuration Vulnerabilities

• User accounts, System accounts and system

Internet Service

• Default and settings:

Impact Caused Due to Vulnerabilities

• Disclosure; Privilege Escalation; Data modification.

Risk

• Is is asset and vuls it can potential

A Risk

• Is either damage and shutting down the data of business. stealing data all that

Misconfigurations

• Network and hostile misconfiguration is the human is the cause

Default Installation

• Devices and set is needed when downloading or installing the software and the systems

Application Issues

• Buffer overflows are often by data.
• Integer and improper.

Poor Patch Management

• Application, Devices or Serves Can is unpatched to do so.

Design Flaws

• Incorrect validation has data issues for logical attacks
• Data attack have the mechanisms to be hard to see so access happens

Operating System Flaws

• Attacks use malicious code with sensitive info stolen of them.

Classificatins

• Configuration/Operational Platform/ known vulnerabilities

Summary of the Module:

• Topic discussion is about network actors with examples
• It vector info includes data for threat factors. In malware distribution. Types are explained for the cyber security reasons It covers various reasons as per vulnerabilities in different categories from classification