Domain 1.0 Threat/Attacks

Phishing

A fraudulent practice where an attacker sends a message to trick a person into revealing sensitive information or deploying malicious software.

Spear Phishing

Targeted phishing attack on a group of people or specific individual.

Vishing

Social engineering over the telephone to extort information.

SMiShing

Phishing attack using SMS text messages.

Whaling

Attack targeting a CEO or high-level executive.

Credential Harvesting

Phishing attack to gather usernames & passwords.

Pretexting

Social engineering attack involving creating a scenario to trick victims into giving private information.

Elicit Information

Attacker tries to get information by making false statements or using flattery.

Tailgating

Following someone through a secure door to gain unauthorized access.

Dumpster Diving

Searching trash for Personally Identifiable Information to commit fraud.

Shoulder surfing

Viewing sensitive information by standing behind someone using a computer.

Hoax

Spreading false information like fake virus alerts or chain letters.

Pharming

DNS redirecting attack to manipulate website traffic.

Spam

Unsolicited bulk messages sent through digital communication tools.

Impersonation

Pretending to be someone else to gain information.

Invoice Scams

Criminals changing bank details on genuine invoices for payment.

Reconnaissance

Preliminary survey to gain information, passive or active.

Reconnaissance

A preliminary survey to gain information, including exploratory military surveys of enemy territory.

Passive Reconnaissance

Attacker researches a company and collects information for later use.

Active Reconnaissance

Attackers interact with the user or their desktop, attempting actions like password resets or altering registries.

Water Hole attack

Attackers infect websites frequented by a specific industry to spread malware and target individuals.

Credential Harvesting

An attack, often through phishing, where victims are tricked into providing their account details on fake web pages.

Influence Campaigns

Large-scale campaigns using disinformation to influence public opinion, often carried out by groups with high capabilities.

Social Media

Part of Influence Campaigns, used worldwide to influence voters, especially on platforms like Facebook and Twitter.

Hybrid Warfare

A mix of conventional and unconventional methods used in Influence Campaigns by state actors to achieve political objectives.

Typosquatting

URL hijacking where websites are intentionally misspelled to deceive users.

Prepending

Adding something to the beginning of a URL, often used by attackers to redirect users.

Authority (Principles

reason for effectiveness):Emails from higher authorities like CEOs to manipulate individuals into complying.

Intimidation (Principles

reason for effectiveness):Pretending to be a figure of authority to threaten individuals into compliance.

Consensus (Principles

reason for effectiveness):Manipulating individuals by stating others have already provided information, creating social pressure.

Scarcity (Principles

reason for effectiveness):Creating urgency by making victims believe there is limited time or availability.

Familiarity & Trust (Principles

reason for effectiveness):Hackers build trust with victims to gain access to restricted areas within a company.

Urgency (Principles

reason for effectiveness):Creating a sense of urgency to manipulate individuals into providing access quickly.

Urgency

The principle of creating a sense of immediate need or emergency to manipulate individuals into providing access or information quickly.

Identity Fraud

Occurs when someone steals Personally Identifiable Information (PII) to commit fraud or take control of accounts, often through methods like pretexting and phishing.

Physical Attacks in Cyber Security

Include malicious USB cables, flash drives, card cloning (skimming), and other methods to compromise systems physically.

Ransomware

Involves encrypting files on a user's computer and demanding money for decryption, often disguised as legitimate software or programs.

Trojans

Malware that disguises itself as legitimate software, downloads onto a computer, and can exploit system vulnerabilities to carry out malicious actions.

Worms

Self-replicating malware that spreads to infect other computers, exploiting security weaknesses in networking protocols.

Potentially Unwanted Programs (PUPs)

Programs downloaded with other software that consume resources and slow down computers, often detected by security tools like Malwarebytes.

Fileless Virus

A virus that operates in memory, making detection difficult by piggybacking on legitimate programs or applications.

Command and Control Malware

Malware that takes complete control of a computer, allowing attackers to steal data, shut down systems, or launch attacks.

Bots

Malware that infects and controls computers remotely, carrying out commands under the attacker's control.

Botnet

A collection of bots used for malicious purposes, often to conduct Distributed Denial of Service (DDoS) attacks.

Crypto-Malware

Ransomware that encrypts data and remains undetected for extended periods, demanding ransom for decryption.

Logic Bombs

Malicious code triggered by specific actions or dates, designed to execute harmful functions.

Spyware

Malware that monitors and tracks user activity, collecting sensitive information to send to third parties.

Rootkit

Malicious tools that provide attackers remote access and control over systems, often remaining hidden and active.

Keylogger

Malware that tracks and logs keystrokes, sending the data to attackers for unauthorized access.

RAT

Remote Access Trojan, a malware program that sends login details to attackers for full control over a computer.

Malware

Any harmful software or program intentionally designed to damage computers, networks, or servers.

Backdoor

Undocumented access to a system created for legitimate purposes but exploited by attackers for unauthorized access.

Dictionary Attack

Method of breaking into password-protected systems by systematically trying every word in a dictionary as a password.

Brute Force Attack

Hacking method using trial and error to guess passwords by testing all possible combinations, often effective but time-consuming.

Spraying Attacks

A type of brute force attack where common passwords are tried against a list of usernames to gain unauthorized access.

Plain Text / Unencrypted

Passwords stored in plain text that are vulnerable to being cracked by brute force attacks.

Rainbow Table

A database used to crack password hashes by matching plaintext passwords to their hash values.

Malicious USB (Universal Serial Bus) Cable

Cables with built-in WiFi chips used to run malicious commands on devices when connected.

Malicious Flash Drive (USB Drive)

USB drives containing malicious code that, when inserted into a computer, can give attackers control over the system.

Card Cloning (Skimming)

Unauthorized copying of credit card information through devices like card cloning machines, often found in ATMs or restaurants.

Tainted Training Data for Machine Learning

Manipulating machine learning models by training them to ignore certain attacks, compromising security.

Security of Machine Learning Algorithms

Using machine learning to identify patterns and detect attacks in encrypted data without decrypting it.

Supply Chain Attacks

Targeting the suppliers of large companies to compromise their systems, emphasizing the importance of securing the entire supply chain.

Cloud vs On-Premise Defense against attacks

Cloud environments use a "Zero-Trust" model requiring user/device identification, while on-premise companies rely on physical security measures like perimeter fencing and security guards.

Birthday Attack

A cryptographic attack exploiting hash collisions, based on the Birthday Paradox in Probability Theory, where two different inputs produce the same hash value.

Collision Attack

An attack on a cryptographic hash function finding two different inputs producing the same hash value, undermining the security provided by the hash.

Downgrade Attack

A cyber attack forcing a switch from a higher to a lower level of security, like redirecting from HTTPS to HTTP, often used in man-in-the-middle attacks.

SmiShing

Using SMS text messages for attacks.

Privilege Escalation Attack

An attack granting unauthorized higher permissions, either vertically (to higher privilege accounts) or horizontally (to similar privilege accounts).

XSS

Cross-Site Scripting attacks involve injecting malicious scripts into web applications, exploiting lack of validation and encoding, allowing various attacks.

SQL Injection Attack

Unauthorized access to a database through unexpected input to a web application, exploiting vulnerabilities in SQL commands.

How to prevent SQL injections

Prevention methods include input validation, prepared statements, and limiting account privileges, with stored procedures being an effective countermeasure.

What can the strcpy() command do? The strcpy() function copies a string to a buffer, potentially causing buffer overflow due to its inability to limit characters.

DLL Injection Attack

Forcing a process to load a DLL to run code within another process, altering its behavior.

API Attacks

Attempts to manipulate APIs for additional resources, data access, or service interruption, including MITM, DDoS, and API injection attacks.

LDAP Injection Attack

Inserting data into LDAP statements to bypass authentication, elevate privileges, disclose resources, or conduct blind attacks.

How to prevent LDAP injection attacks

Input validation is crucial to prevent LDAP injection attacks.

XML Injection Attack

Manipulating XML scripts to carry out attacks, similar to XSS, by exploiting XPath queries.

How an XSS attack can be conducted

XSS attacks can be conducted using script attributes, encoded URI schemes, and code encoding to execute malicious scripts.

How to prevent XML injection attacks

Prevent XML injection attacks by using input validation.

Buffer overflow attack

Writing excessive data into an application's memory, causing data spillage into other memory areas due to lack of input validation.

Input Validation

Ensures only properly formatted data enters a software system, preventing various attacks like SQL injections, XML injections, and buffer overflow attacks.

Integer Overflow

A condition where the result of an arithmetic operation exceeds the maximum size of the integer type used to store it.

Pass the Hash Attack

Technique where an attacker captures a password hash for authentication and lateral access to other systems without decrypting it.

Resource Exhaustion

An attack consuming all available memory and CPU cores, leading to application or system crashes.

SSL Stripping Attacks

Downgrading a secure HTTPS connection to HTTP, making communications unencrypted and vulnerable to MITM attacks.

Memory Leak

When an application consumes memory without releasing it, leading to system crashes due to resource exhaustion.

Pointer/Object Dereference

Attacker causes an application's memory reference to point to a null part, often leading to crashes or DOS attacks.

Directory Traversal Attack

Exploiting a website vulnerability to access restricted directories and execute commands outside the root directory.

Race Conditions (TOCTOU) Attack

Exploiting the time gap between checking and using data to carry out unauthorized actions in software.

Error Handling

Procedures to respond to error conditions in software applications, crucial for good coding practice and security.

Improper Input Handling

Failure to validate input properly, leaving applications vulnerable to malicious data injection.

Replay Attack (Session Replays)

Intercepting and resending network information to misdirect receivers into unauthorized actions.

Driver Manipulation

Manipulating device drivers to compromise system security, using techniques like shimming and refactoring.

Shimming

Intercepting API calls to change arguments, handle operations, or redirect requests, often used in malware to bypass security.

Refactoring

Changing application code to avoid detection by antivirus software while retaining attack functionality, a technique used in malware.

Injections

Adding data to an application's data stream to alter the meaning of commands sent to an interpreter.

Types of Wireless Attacks

Evil Twin, Rogue Access Point, and Disassociation attacks targeting wireless networks for unauthorized access or disruption.

Bluejacking

Sending unsolicited messages via Bluetooth to annoy or potentially threaten device users within a certain radius.

Bluesnarfing

Illegally accessing and stealing information from wireless devices through Bluetooth connections, posing a high-security risk.