Understanding Cyber Threats & Threat Sources

Threats

• A threat is a possible undesirable event that could eventually damage and/or disrupt an organization's operations and functions
• Cyber threats are used by attackers to infiltrate systems and steal data like individuals' personal, financial, and login information

Examples of Threats

• Stealing sensitive data
• Causing server shutdowns
• Tricking employees into revealing sensitive information
• Infecting systems with malware
• Spoofing identities to gain unauthorized access
• Modifying data transfers
• Remotely altering database servers
• Performing URL redirection/forwarding
• Escalating privileges for unauthorized access
• Executing denial-of-service attacks
• Eavesdropping on unauthorized communications

Threat Sources

• Unintentional threats are due to potential unintentional errors, including insider security breaches, negligence, operator errors, unskilled administrators, and accidents
• Intentional threats consist of two sources: internal and external

Natural Threats

• Fires, floods, power failures, lightning, meteors, and earthquakes are all Natural threats
• These may cause severe physical damage to computer systems.

Intentional Threats

• Most computer and Internet-related crimes are internal attacks that are carried out of disgruntled employees that can harm the organization intentionally or unintentionally
• These attacks are usually performed by privileged users
• Structured external threats are initiated by skilled attackers to use tools in order to gain access to a network with the aim of disrupting services. Motivations include criminal bribes, racism, politics, terrorism, etc.
• Examples: Distributed ICMP floods and spoofing
• Unstructured external threats are executed by unskilled attackers, often script kiddies to access networks, most of the time out of curiosity instead of criminal intentions
• Examples: Using online tools to launch a network attack or crashing a website
• Unstructured external threats are able to be prevented with security solutions

Threat Actors/Agents

• Black Hats use computing skills for illegal activities. They are also known as crackers.
• White Hats, or penetration testers, use hacking skills for defensive purposes with permission from the system owner.
• Gray Hats work both offensively and defensively. They may assist hackers and help vendors improve product security.
• Suicide Hackers aim to disrupt critical infrastructure for a "cause" and are not deterred by potential punishments.
• Script Kiddies are unskilled hackers who use tools developed by others
• They lack specific targets and aim to gain popularity or prove skills

Other Threat Actors/Agents

• Cyber Terrorists disrupt computer networks with wide range of skills, motivated by religious or political beliefs
• State-Sponsored Hackers penetrate and damage other governments' information systems with expertise in hacking while working for the government
• Industrial Spies perform corporate espionage by illegally spying on competitors to steal critical information
• Insider Threats misuse their trusted access to critical data and resources and can bypass the security rules
• Hacker Teams work together and detect vulnerabilities while researching in order to develop advanced tools, and execute attacks with proper planning
• Criminal Syndicates embezzle money and exploit victims from distinct jurisdictions with the aim of illegally embezzling money by performing sophisticated cyber-attacks and money-laundering
• Hacktivist break into computer systems as an act of protest, to deface/disable websites to promote a political agenda.

Attributes of Threat Actors

• Internal threat actiors are entrusted insiders who have permission and authorized access to organization's network.
• External threat actors are the outsiders who do not have any authorized acess
• How sophisticated the attack is
• How motivated the threat actor in launching the the attack

Threat Vectors

• A medium through which an attacker gains access to system where identified vulnerabilities can be exploited
• Gaining physical access to the target system and performing malicious activities
• Devices which might contain malware that run automatically on the host system to steal or corrupt critical files
• Implementing an unsecured wireless hotspot or using cracking/spoofing tools to gain access
• Using Email for phishing attacks such as clicking on malicious links with malicious attachments.
• Injecting malware into cloud resources to gain access to user information
• Unpatched vulnerablilities that inject ransomware.
• Compromising the target by exploiting vulnerabilities in the resources supplied by a third-party vendor.
• Using supply chain attacks to gain access to the customers' information of third party organizations

Mitigation: Autorun.inf

• Here is how to mitigate such infection
• Turn off the Autostart functionality with the following content of an Autorun.inf file:
  • [autorun]
  • open=setup.exe To mitigate such infection, turn off the Autostart functionality. Follow the instructions below to turn off Autoplay in Windows 10::

1. Click Start. Type gpedit.msc in the Start Search box, and then press ENTER.
2. If you are prompted for an administrator password or confirmation, type the password, or click Allow.
3. Under Computer Configuration, expand Administrative Templates, expand Windows Components, and then click Autoplay Policies.
4. In the Details pane, double-click Turn off Autoplay.
5. Click Enabled, and then select All drives in the Turn off Autoplay box to disable Autorun on all drives.
6. Restart the computer.

Components of Malware:

• Crypter eludes antivirus detection and protects malware from reverse engineering or analysis
• Downloader downloads other malware (or) malicious code and files from the Internet to a PC or device
• Dropper is a covert carrier of malware that perform the installation task covertly can transport malware code and execute malware on a target system without being detected by antivirus scanners.
• Exploit breaches the system’s security through software vulnerabilities
• Injector injects exploits or malicious code available in the malware into other vulnerable running processes and changes the method of execution to hide or prevent its removal
• Obfuscator conceals the malicious code of malware via various techniques
• Packer compresses the malware file to convert the code and data of the malware into an unreadable format
• Payload performs the desired activity when activated such as deleting, modifying files, degrading the system performance, opening ports, changing settings, etc.
• Malicious code defines the basic functionality of the malware such as Java Applets or Browser Plug-ins

Common Techniques Attakers use to Distribute Malware on the Web:

• Black hat SEO (unethical SEO) uses aggressive SEO to get higher search engine rankings for malware pages
• Social Engineered Click-jacking injects malware into website, it triggers the knowledge before the user clicks.
• Spear-phishing mimics sites by mimicing legitimate institutions.
• Malvertising embeds malwares.
• Drive by Downloads exploits flaws in browser software by installation malware.
• Compromised Leginimate Websites use websites to infect with malicious activities.
• Spam Emails attaches malicious files to email in order to trick users into executing them

Types of Trojans

• Remote Access Trojans (RATs) provide attackers with full control over the victim's system
• Backdoor Trojans bypass the standard system protocol
• They trick regular computer users into downloading Trojan-infected files to their systems through phishing, SEO hacking, URL redirection
• Rootkit Trojans attack the root or OS and have full victim control to the OS
• E-banking Trojans are extremely dangerous and steal monetary amounts, also install a malicious advertisement
• Point of Sale Trojans obtain sensitive information.
• Defacement Trojans change the entire continent of the databse
• Mobile Trojans attack phones through banking and social networking credential stealing
• Io T Trojans attack Io T networks Security Software Disabler Trojans are entry Trojans that allow an attacker to perform the next level of attack on the target system.
• Destructive Trojans delete files on a target system
• DDos Attack Trojans perform DDoS attacks on target machines, networks, or web addresses
• Command Shell Trojans provide remote control of command shell

Indicators of a Trojan

• The DVD-ROM drawer opens and closes automatically.
• The computer screen blinks, flips upside-down, or is inverted .
• Pop-ups with bizarre messages suddenly appear.
• Strange warnings or question boxes appear.
• The Task Manager is disabled.
• The default background or wallpaper settings change automatically.

Types of Creating a Virus

• The virus can be created with these tools:
  • Writing a Virus Program
  • Using Virus Maker Tools

Types of Viruses

• System or Boot Sector infects boot record sector (MBR)
• File Viruses infects COM, EXE, SYS,
• Multipartite Virus combines both approaches to a infection, the boot sector and the executable or program files
• Macro Virus infects Microsoft Word or similar applications by automatically a sequence of action.
• Cluster Virus infects files without changing the file or planting additional files
• Stealth/Tunneling Virus These viruses try to hide from antivirus programs by actively altering and corrupting the service call interrupts while running.

Types of Using Using Virus Maker Tools

• To customize and craft your virus into a single executable file it have to perform these task:
  • Disable Windows command prompt and Windows Task Manager
  • Shut down the system
  • Infect all executable files Inject itself into the Windows registry and start up with Windows -Perform non-malicious activity such as unusual mouse and keyboard actions

Malware: Ransomware

• A type of malware that restrict access to the computer system's files and demand an online ransom money for it

Characteristics of Worms

• Malicious programs replicate, execute, and spreads across network connections independently.
• Consume bandwidth without human interaction
• Attackers use worm payloads to install backdoors in infected computer

Examples of Potential Ransomware

• eCh0raix, SamSam,WannaCry, Petya, GandCrab,MegaCortex,LockerGoga,NamPoHyu,Ryuk,Cryptghost;

How is a Worm Different From a Virus?

• A worm does not attack itself to another programs in a system or computer
• Worms attacks through file or other transports
• A worms replicate but its speed is not uniformed

How to spot an Adware

• Frequent system log with a system crash displays the blue screen
• Homepage changes unexpectedly and redirects to malicious pages

Types of unwanted Applications

• Adware display unsolicited advertisements
• Torrent application with a peer sharing.

Types of what and why:

• Viruses and worms
• Trojans and how the code and system functions

Popular Rootkits

• LoJax is the name of the system and what it does
• Popularities of the UEF

Areas of Vulnerability

• Users : Intentional or unintentional human errors
• Operating System : bugs in the operating system The applications themselves
• Network Devices : Failing to change default settings
• Network Infrastructure
• Io T
• Configuration Files

Impact Caused Due to Vulneratilities

• A website or application and information disclosure, denial of service, privilege, identity, access
• Loss reputation and damages

Types of Vulnerabilities

These items are a combination of Misconfigurations, Weak, Application, Design, Default and Operating System