Scribd
Upload
8 views5 pages

ch8 Short

The document provides an overview of various cybersecurity threats and defense mechanisms, including malware inspection using sandboxes, network attacks targeting organizations and households, and specific attack types like DDoS and DNS attacks. It highlights the importance of recognizing malicious code and indicators of attack (IoAs) to mitigate risks. Additionally, it discusses wireless attacks and credential replay methods, emphasizing the need for robust security practices.

Uploaded by

amansharma2318
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
8 views5 pages

ch8 Short

The document provides an overview of various cybersecurity threats and defense mechanisms, including malware inspection using sandboxes, network attacks targeting organizations and households, and specific attack types like DDoS and DNS attacks. It highlights the importance of recognizing malicious code and indicators of attack (IoAs) to mitigate risks. Additionally, it discusses wireless attacks and credential replay methods, emphasizing the need for robust security practices.

Uploaded by

amansharma2318
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 5

Cybersecurity CH-8 Revision Notes

Malware Inspection
●​ Cybersecurity teams investigate malware and viruses using a
sandbox, an isolated virtual machine.​

●​ Tools like Cuckoo (open-source sandbox) help analyze


malicious applications safely.​

●​ Malicious applications can be tested without harming network


users.​

●​ Sandboxing is useful for patching, testing, and managing


dangerous applications.​

Network Attacks
●​ Malicious, unauthorized attempts to disrupt, compromise, or
gain access to networks and data.​

●​ Target both organizations and households.​

●​ Typically server-side attacks, targeting:​

○​ Domain controllers (manage user accounts)​

○​ SQL servers (hold confidential data, credit card info)​

●​ Common attack types:​

○​ Pivoting​

○​ Distributed Denial-of-Service (DDoS)​


○​ ARP Poisoning​

○​ DNS Attacks​

DDoS Attacks
●​ DoS: One host disrupts victim services.​

●​ DDoS: Multiple hosts (e.g., botnets, IoT devices) overwhelm


the target.​

●​ Examples:​

○​ SYN flood attacks: Overload system resources.​

○​ Amplifying attacks: Small request triggers large


response (e.g., ICMP, Smurf attack).​

○​ Reflected attacks: Send requests using victim’s IP, often


seen in smart cities.​

●​ Motivations: Financial extortion, hacktivism, geopolitical gain.​

●​ Defenses: Traffic filtering, network upgrades, adaptive


response mechanisms.​

DNS Attacks
●​ DNS translates domain names (e.g., www.packtpub.com) into
IP addresses.​

●​ DNS resolution order:​

○​ DNS cache (view with ipconfig /displaydns)​

○​ HOSTS file (C:\Windows\System32\drivers\etc)​


○​ Root hints (query other DNS servers)​

●​ Attacks:​

○​ DNS sinkhole: Redirects malicious traffic or traps


attackers in honeypots.​

○​ DNS cache poisoning/DNS spoofing: Alters cache or


HOSTS file to redirect users to fake sites.​

Wireless Attacks
●​ Wireless networks offer convenience but are vulnerable.​

●​ Attack methods:​

○​ Rogue APs: Fake access points (e.g., via Raspberry Pi)


deceive users.​

○​ Evil twin: Mimics real network to intercept data.​

○​ Deauthentication/Jamming: Disrupts connections;


jamming is illegal.​

○​ MAC spoofing/Device impersonation: Fake MAC


addresses impersonate devices.​

○​ Wi-Fi analyzer: Identifies signal strength, interference,


and nearby networks.​

On-Path Attacks (Man-in-the-Middle)


●​ Attackers intercept communications to manipulate or steal
data.​

●​ Types:​
○​ Session replay: Captures session tokens via XSS, MITM,
or man-in-the-browser.​

○​ Replay attacks: Reuses intercepted data; Kerberos


prevents this using timestamps and sequence numbers.​

Credential Replay
●​ Use of tools like keyloggers, Wireshark, tcpdump, or malware
to steal credentials.​

●​ Attack types:​

○​ Credential replay: Use stolen credentials from valid


logins. Avoid Telnet; use SSH. Discourage NTLM.​

○​ Credential stuffing: Reuses credentials across


platforms. Defenses: password managers, security
awareness, unique passwords, monitor login spikes.​

Malicious Code
●​ Code intended to steal data, disrupt systems, or cause
damage.​

●​ Warning signs: Unusual traffic, unexpected behavior,


unknown files/software.​

●​ Examples:​

○​ Bash shell: Runs unauthorized commands.​

○​ Python: Used for keylogging, data theft, especially via


phishing.​

○​ JavaScript: Used in client-side attacks such as XSS.​


Indicators of Attack (IoAs)
●​ Warning signs of suspicious behavior indicating cyber
threats.​

●​ Examples:​

○​ Account lockouts (especially admin accounts)​

○​ Concurrent session usage​

○​ Blocked content alerts (via ACL, DLP)​

○​ Impossible travel (logins from distant places in short


time)​

○​ High resource consumption (CPU/memory)​

○​ Unavailable resources (e.g., DDoS impact)​

○​ Out-of-cycle logging​

○​ Missing logs (may indicate tampering)​

○​ Known vulnerabilities/configurations being exploited​

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy