Explaining Network security concepts Flashcards

Question

What is threat research?

Answer 1

A counterintelligence gathering effort in which security companies and researchers attempt to discover the tactics, techniques, and procedures (TTPs) of threat actors.

Answer 2

Behavioral threat research: Narrative commentary describing examples of attacks and TTPs gathered through primary research sources. Reputational threat intelligence: Lists of IP addresses and domains associated with malicious behavior, plus signatures of known file-based malware. Threat data: Computer data that can correlate events observed on a customer's own networks and logs with known TTP and threat actor indicators.

Answer 3

Tactics, Techniques, and Procedures.

Answer 4

Footprinting: Allows a threat actor to discover the topology and general configuration of the network and security systems. Fingerprinting: Allows a threat actor to identify device and OS types and versions. Both are enumeration or information gathering attacks.

Answer 5

Covers a wide range of attacks but generally it is a attack technique where the threat actor disguises his or her identity or impersonates another user or resource. ex. phishing and pharming

Answer 6

They secretly redirect users from legit websites, to fake attacker controlled websites.

Answer 7

Distributed reflection DoS In this attack, the adversary spoofs the victim's IP address and attempts to open connections with multiple servers. Those servers direct their SYN/ACK responses to the victim server. This rapidly consumes the victim's available bandwidth.

Answer 8

A group of hosts or devices that has been infected by a control program called a bot, which enables attackers to exploit the hosts to mount attacks. Also referred to as a zombie. A threat actor will first compromise one or two machines to use as handlers or herders. The handlers are used to compromise hundreds, thousands, or even millions of zombie hosts and install DDoS tools on them.

Answer 9

command and control (C2 or C&C) network.

Answer 10

Potentially unwanted programs and Potentially unwanted applications. Software installed alongside a package selected by the user or perhaps bundled with a new computer system. It is not automatically regarded as malicious. It may have been installed without active consent or consent from a purposefully confusing license agreement. Sometimes described as grayware.

Answer 11

An action performed by the malware other than simply replicating or persisting on a host. ex. Spyware, rootkit, remote access Trojan (RAT) or backdoor, and ransomware.

Answer 12

Fileless is not a definitive classification, but it describes a collection of common behaviors and techniques: -It doesn't not write its code to disk. The malware uses memory-resident techniques to run in its own process, within a host process or dynamic link library (DLL), or within a scripting host. -Uses lightweight shellcode to achieve a backdoor mechanism on the host. The shellcode is easy to recompile in an obfuscated form to evade detection by scanners. -May use "live off the land" techniques rather than compiled executables to evade detection. Meaning the malware code uses legitimate system scripting tools, notably PowerShell and Windows Management Instrumentation (WMI), to execute payload actions. Can be classified as a APT, AVT or a low-observable characteristics (LOC) attack.

Answer 13

advanced persistent threat and advanced volatile threat. Is an attacker's ability to obtain, maintain, and diversify access to network systems using exploits and malware Can be used to describe this general class of modern fileless/live off the land malware.

Answer 14

A specific type of spoofing attack where a threat actor compromises the connection between two hosts and transparently intercepts and relays all communications between them. The threat actor might also have the opportunity to modify the traffic before relaying it.

Answer 15

ARP spoofing: Is the act of sending out false ARP messages (unsolicited ARP replies) to a local network. These messages are designed to associate the attacker's MAC address with the IP address of another host, such as the default gateway. ARP Poisoning: Is the result of ARP spoofing. It describes the corrupted state of the ARP cache, where devices on the network have been tricked into sending data to the wrong MAC address. These attacks are directed at hosts.

Answer 16

A variation of an ARP poisoning attack where a switch's cache table is inundated (overwhelmed) with frames from random source MAC addresses. The intention of the attack is to exhaust the memory used to store the switches MAC address table. Once the table is overwhelmed it can cause the switch to flood unicast traffic (goes into fail open mode.) out of all ports (like a hub), making sniffing network traffic easier for the threat actor.

Answer 17

An attack designed to send traffic to a VLAN other than the one the host system is in. This exploits the default VLAN feature of 802.1Q Such an attack can only send packets one way but could be used to perform a DoS attack against a host on a different VLAN. A VLAN hopping attack can also be launched by attaching a device that spoofs the operation of a switch to the network and negotiating the creation of a trunk port. As a trunk port, the attacker's device will receive all inter-VLAN traffic.

Answer 18

The attacker inserts their switch into the tree and manipulates it to appoint their switch as the root bridge. By doing this, they can use a sniffer to collect data traversing the network.

Answer 19

Involves changing the Media Access Control (MAC) address of a device's network interface to a different value. This can be done for various reasons, including impersonating another device on the network.

Answer 20

A device or service on your network that isn't under the administrative control of the network staff is called rouge. Rogue devices and services are often completely malicious. Most network hardware and services can be exploited through rouges. Rogue devices and services could include wireless access point, DHCP servers, DNS servers etc. They exist for the sole purpose of stealing sensitive information such as credit card numbers and passwords.

Answer 21

Where users purchase or introduce computer hardware or software to the workplace without the sanction of the IT department and without going through a procurement and security analysis process.

Answer 22

A standards-based approach to technologies that allows hosts to obtain a usable network configuration and discover services automatically and without the use of DHCP or DNS server infrastructure.

Answer 23

Can be deployed accidentally (forgetting to disable a DHCP server in an access point or router, for instance) or on purpose to be used by a malicious threat actor to subvert the network. Clients could end up with an incorrect IP configuration because they have obtained a lease from a rogue server. This is a means of using DHCP to facilitate an on-path attack.

Answer 24

An attack that uses bogus requests to use up leases in a legitimate DHCP server's address pool. An exhausted DHCP scope means legitimate hosts cannot obtain a lease so legitimate hosts are forced to obtain a lease from a rouge DHCP server. NOTE: A DHCP starvation attack might be a denial of service (DoS) mechanism.

Answer 25

If an attacker is able to place a false name:IP address mapping in the HOSTS file and effectively poison the DNS cache, they will be able to redirect traffic.

Answer 26

Name resolution using a text file named HOSTS, was used before DNS was developed. Even though most name resolution now functions through DNS, the HOSTS file is still present and most operating systems check the HOSTS file before using DNS Requires administrator access to modify. In UNIX and Linux systems it is stored as /etc/hosts In Windows it is placed in: %SystemRoot%\System32\Drivers\etc\hosts

Answer 27

Aims to corrupt the records held by the DNS server itself. An attack method for DNS Server Cache Poisoning is gettign the victim name server to respond to a recurisve query from the attacking host. A recursive query compels the DNS server to query the authoritative server for the answer on behalf of the client. The attacker's DNS, masquerades as the authoritative name server, responds with the answer to the query, but also includes a lot of false domain:IP mappings for other domains that the victim DNS accepts as genuine. Use the nslookup or dig tool to query the name records and cached records held by a server to discover whether any false records have been inserted.

Answer 28

The presence of unexpected or malicious entries in the HOSTS file can indicate that a machine has been compromised, especially in the context of DNS attacks. These entries can redirect traffic to unintended or malicious sites, bypassing normal DNS resolution processes.

Answer 29

When used without switches, Nmap's default behavior is to ping and send a TCP ACK packet to ports 80 and 443 to determine whether a host is present, which is a basic method for host discovery.

Explaining Network security concepts Flashcards

(53 cards)