when a hacker tries to trick an employee into compromising security by calling, e-mailing, or having an in person conversation with the employee.
What techniques hackers use in a social engineering attack?
Impersonation and phishing
What is a phishing attack?
the hacker typically emails a user and pretends to be a representative from a bank or a company such as ebay.
What is shoulder surfing?
when the hacker tries to view confidential inforamtion or information that may help the attacker compromise security by looing over employees shoulders to view information either on their desk or on the computer screen.
What is dumpster diving?
a popular attack where the hacker goes through the victims garbage looking for documents or information that could facilitate an attack.
What is tailgating?
when the hacker walks through a secure area by following someone who ha unlocked the door for themselves.
What are hoaxes?
Email hoaxes are email messages that users receive giving a false story and asking the user to take some type of action.
What is Whaling?
sending an email to trick someone into giving out their account name and password to sites masquerading as another site. Typically, this email is sent to someone in upper-management.
What is Vishing?
When a hacker calls to trick people and steam money from them.
What are some techniques hackers will impersonate when using a social engineering method?
How does an administrator prevent social engineering??
Training and awareness and ensuring that there is a method to validate all employees.
What is Denial of Service?
The hacker will overload a system with requests so that a the system is so busy servicing the hackers request that it cannot service valid requests from other clients.
What is a Distributed Denial of service?
when the hacker uses a number of system to perform the attack, which helps the hacker create a large number os requests.
What are zombies?
When a hacker compromises a system and takes control of it and then uses the system to help with an attack.
What is a smurf attack?
when the hacker sends Ping messages to a number of systems, but also spoofing the source IP address so that they appear to come from the intended victim.
What is spoofing?
type of attack where the hacker alters the source address of inforamtion to make the information look like its coming from a different person.
What are the three spoofing methods?
IP spoofing, MAC spoofing and e-mail spoofing.
What are some programs used to spoof packets?
Nemesis, Hping2, and Macchanger
What is eavesdropping?
hacker captures network traffic and is able to view the contents of the packets traveling along the network.
What are some software that is used when eavesdropping?
Wireshark, TCPdump, and airodump-ng
What is a Replay attack?
When a hacker captures traffic and then the hacker resubmits the trafic onto the network. The hacker may alter the traffic first and then replay it, or the hacker may simply be replaying traffic to generate more traffic.
what are the popular commands to replay traffic?
tcpreplay: tcpreplay output.txt -i eth0
What is a man in the middle attack?
hacker inserts himself in the middle of two systems that are communicating.
What is DNS posioning?
when the hacker alters the DNS cache that is located o your company's local DNS servers.
What is ARP posioning?
when a hacker alters the ARP cache on a system, or group of systems, so that all systems have the wrong MAC address stored in the ARP cache for a specific IP address, maybe the address of the default gateway.
What is Pharming?
leading someone to the wrong site by modifying DNS or host file.
What is SPAM?
sending the same unsolicited email mesasge to a number of email.
What is Priviledge escalation?
Invovles someone who has user level access to a system and being able to elevate their priviledges to gain admin access to the system.
What is a Port Scan?
when the hacker runs software on the network that does a port scan against the system, which indicates to the hacker what ports are open.
What are some of the different types of port scans?
TCP connect scan, SYN Scan ( Half-open scan), and XMAS scan.
-Implement physical security controls - Ensure systems are up to date.
What is a password attack?
When a hacker tries to figure out the password for user accounts stored on the system.
What are the three types of password attacks?
Dictionary attack, Brute force attack, and hybrid attack.
What is a dictionary attack?
when the hacker uses a program that has a list of popular usernames in one text file and a list of words in a language dictionary that are to be tried as passwords in another file.
What is the disadvantage of a dictionary attack?
most passwords today are complex password in the sense that they require letters, numbers and symbols.
What is a brute force attack?
a password attack that involves using the password-cracking software to mathematically calculate every possible password.
What is the disadvantage of brute force attack?
the time it takes to complete the crack.
What is a Hybrid attack?
involves the password cracking software using a dictionary file, but after the software tries a word from the dictionary file, it then tries to modify the word. Examples of modifications that the cracking software will use are to replace numbers after the word and possibly to replace the characters.
What is a Birthday Attack?
It's a type of attach that is performed on hashing functions.
What are rainbow tables?
are used to speed up the process of performing brute force attack.
How can you prevent dictionary attacks?
Strong password policy and make sure users have a complex password.
How can you prevent Brute force attack?
Account lock out policy
What is a offline password attack?
when the hacker gets physical access to the system, copies the user account database to a flash drive, and takes the database away.
What are some popular password auditing and cracking tools?
LC4, Cain and Abel, NAT, Brutus, and John the ripper
What is SQL?
Standard querey language and is the common language used by programmers to manipulate a database.
What is a SQL injection attack?
When the hacker users the SQL commands that are executing behind the scene in order to manipulate the data in the database.
What is a buffer?
an area of memory used to store information sent to an application.
What is a buffer overflow attack?
When a hacker sends to much information to the application, causing the information to fill both the buffer and memory outside the buffer.
What is cross site scripting?
when a hacker inserts script code into a form on a web page and submitting the script code to the server.
What is Directory Traversal command injection?
is used to inject commands inside the HTTP message.
What is a LDAP injection?
when the hacker fills out a web form that normally uses the firm data to query a database with an LDAP call, but because the application developer has not validated any of the input,the hacker can insert whatever they want into the page, and the content will get executed by the server.
What is XML injection?
An XML injection is similar to SQL injection and an LDAP injection except that the hacker is inserting XML code into the application.
What is integer overflow?
when a program performs a mathematical function and the result is larger than the space in memory allocated by the programmer.
What is zero day?
it's an exploit in an application that is unknown to the developers of the application.
What are cookies and attachments?
Cookies are text files on your system that web developers use to store inforamtion such as your preferences.
File attachments are documents sent with an email message, which may contain a virus.
What are malicious add-ons?
when your system downloads a piece of software used by the browser and slows the system down or exploits a vulnerability in the system.
What is a header manipulation?
when the hacker modifies the header data of that application so they can manipulate how the application works.
What is Arbitrary code execution/remote code execution?
When a hacker exploits a system, if they have the capabilities to run remote code, or arbitrary code, that code usually executes in teh security context of an administrative account due to the exploit.
What is Typo squatting/URL hacking?
Typo squatting is also known as URL hijacking where the hacker assumed the user will have typos when they type a URL into the browser and are led to the hackers site.
What is Watering Hole attack?
When a hacker determines sites you may want to use and then compromises those sites by planting viruses or malicious code on them.
What is Locally Shared Objects?
Also known as Flash cookies, these are a method that flash programmers use to store information on a users computer.
How do you prevent application attacks?
Application developers need to validate any data that is sent to the application before processing the data or sending the data to a database.