Security+ Guide to Network Security Fundamentals Chapter 2 - Malware and Social Engineering Attacks

Virus

Malicious computer code that reproduces itself on the same computer.

Malware

Software that enters a computer system without the user’s knowledge or consent and then performs an unwanted and usually harmful action.

Worm

A malicious program that uses a computer network to replicate.

Remote Access Trojan (RAT)

A Trojan that also gives the threat agent unauthorized remote access to the victim’s computer by using specially configured communication protocols.

Trojan

An executable program that is advertised as performing one activity, but which also performs a malicious activity.

Ransomware

Malware that prevents a user’s device from properly and fully functioning until a fee is paid.

Keylogger

Spyware that silently captures and stores each keystroke that a user types on the computer’s keyboard.

Crypto-Malware

Malware that encrypts all the files on the device so that they cannot be opened and mines cryptocurrencies using the device.

Rootkit

Malware that hides its presence or the presence of other malware.

Spyware

Tracking software that is deployed without the consent or control of the user.

Adware

A software program that delivers advertising content in a manner that is unexpected and unwanted by the user.

Bot

An infected computer that is under the remote control of an attacker for the purpose of launching attacks, also known as a zombie.

Social Engineering

A means of gathering information for an attack by relying on the weaknesses of individuals.

Logic Bomb

Computer code that lies dormant until it is triggered by a specific logical event..

Backdoor

Software code that gives access to a computer, program or a service that circumvents any normal security protections.

Authority

A social engineering effectiveness principle in which an attack is directed by someone impersonating an authority figure or falsely citing their authority.

Intimidation

A social engineering effectiveness principle in which the victim is frightened and coerced by threat.

Consensus

A social engineering effectiveness principle in which the victim is influenced by what others do.

Scarcity

A social engineering effectiveness principle in which the victim is influenced by the idea that something is in short supply.

Familiarity

A social engineering effectiveness principle in which the victim is influenced by the claim that the victim is well-known and well-received.

Urgency

A social engineering effectiveness principle in which the victim is influenced by the claim that immediate action is needed.

Phishing

Sending an email or displaying a web announcement that falsely claims to be from a legitimate enterprise in an attempt to trick the user into surrendering private information.

Impersonation

A social engineering attack that involves masquerading as a real or fictitious character and then playing out the role of that person on a victim.

Trust

A social engineering effectiveness principle in which the victim is influenced by confidence.

Spear Phishing

A phishing attack that targets only specific users.

Hoax

A false warning.

Whaling

A phishing attack that targets only wealthy individuals.

Vishing

A phishing attack that uses telephone calls instead of emails.

Watering Hole Attack

A malicious attack that is directed toward a smaller group of specific individuals by embedding malware in a website frequented by these individuals.

Dumpster Diving

The act of digging through trash receptacles to find information that can be useful in an attack.

Tailgating

When an unauthorized individual enters a restricted-access building by following an authorized user.

Shoulder Surfing

Watching a user enter secret information.