{"id":55,"date":"2023-01-15T22:26:43","date_gmt":"2023-01-15T22:26:43","guid":{"rendered":"https:\/\/justatrainingblog.co.uk\/?p=55"},"modified":"2023-01-16T20:30:35","modified_gmt":"2023-01-16T20:30:35","slug":"module-1-2-compare-and-contrast-different-types-of-social-engineering-techniques","status":"publish","type":"post","link":"https:\/\/justatrainingblog.co.uk\/?p=55","title":{"rendered":"Module 1.2 \u2013 Given a scenario, analyse potential indicators to determine the type of attack."},"content":{"rendered":"\n
Malware<\/td>A blanker term for software that is specifically designed to\u00a0disrupt, damage, or gain unauthorized access to a computer system.<\/td><\/tr>
Virus<\/td>Software that can reproduce itself<\/td><\/tr>
Programme Virus<\/td>Virus which is bundled with an application<\/td><\/tr>
Boot Sector Virus<\/td>Virus that installs in the boot sector so it executes with the OS<\/td><\/tr>
Script Virus<\/td>Script based virus which runs as an OS script or a Macros<\/td><\/tr>
Fileless Virus<\/td>Virus which doesn’t install or save as a file and instead operates in the memory<\/td><\/tr>
Worm<\/td>Malware which utilises exploits to self-replicate<\/td><\/tr>
Ransomware<\/td>Malware which holds a system captive until a ransom is paid<\/td><\/tr>
Crypto-Malware<\/td>Ransomware but uses cryptography to encrypt files. The decryption key is provided once the ransom is paid.
<\/td><\/tr>
Trojan Horse<\/td>Software which injects by convincing the user and anti-viruses that its something else<\/td><\/tr>
PUP<\/td>Potentially Unwanted Programme<\/td><\/tr>
RAT<\/td>Remote Administration Tool – provides the attacker administrative rights to the device<\/td><\/tr>
Rootkit<\/td>Malware which modifies kernel<\/td><\/tr>
Adware<\/td>Malware which shows adverts<\/td><\/tr>
Spyware<\/td>Malware which spys on you (e.g. keyloggers, browser monitoring)<\/td><\/tr>
Bot<\/td>Infected host which reports to a C&C for instructions<\/td><\/tr>
Botnet<\/td>Large collection of bots which executes instructions provided by C&C. <\/td><\/tr>
Logic Bomb<\/td>Malware which only executes once a logical condition is met<\/td><\/tr>
Time Bomb<\/td>Type of Logic Bomb which executes once a certain date or time is met<\/td><\/tr>
Tripwire<\/td>Monitoring system which monitors and alters if certain changes are madePlai<\/td><\/tr>
Plaintext Password<\/td>Un-encrypted password (plain text)<\/td><\/tr>
Hashing<\/td>A method of password protection where via an algorithm a password is represented as a fixed-length string of text<\/td><\/tr>
Spraying Attack<\/td>When attacker uses common passwords to attempt password to an account then moves from to avoid account lockout<\/td><\/tr>
Brute Force Attack<\/td>Attack attempting every single password combination until a match is made. <\/td><\/tr>
Online Brute Force<\/td>Brute force to log into a website using every combination<\/td><\/tr>
Offline Brute Force<\/td>Brute force to log in but compares against stolen hashes<\/td><\/tr>
Dictionary Attack<\/td>Access access attack using a dictionary of common words<\/td><\/tr>
Rainbow Table Attack<\/td>Pre-built optimised set of hashes<\/td><\/tr>
Salting<\/td>A bit of random additional data added to a password before hashing. <\/td><\/tr>
Malicious USB Cable<\/td>USB cable with additional electronics that is identified by Windows as a HID. Can perform inputs as a HID. <\/td><\/tr>
Malicious flash drive<\/td>Flash Drive with additional electronics that is identified by Windows as a HID. Can perform inputs as a HID and often holds hidden files which are executed.<\/td><\/tr>
Skimming<\/td>Stealing credit card information during a normal transaction<\/td><\/tr>
Card Cloning<\/td>Cloning a card with magnetic stripe<\/td><\/tr>
Poisoned AI<\/td>Artificial intelligence which has been poisoned with bad input (e.g. twitter training AI)<\/td><\/tr>
Evasion attack<\/td>Evading AI by knowing and therefore predicting it’s behaviours<\/td><\/tr>
Supply Chain Attack<\/td>Attack which originates from the supply chain<\/td><\/tr>
Cryptographic Attack<\/td>Decrypting encrypted data <\/td><\/tr>
Birthday Attack<\/td>Allows Brute Force if hash collision is found<\/td><\/tr>
Hash Collision<\/td>When two different plaintext passwords equal the same hash<\/td><\/tr>
<\/td><\/td><\/tr>
Downgrade Attack<\/td>– Most computers agree an encryption method when communicating
– Downgrade attack happens when the victim system is forced to downgrade security<\/td><\/tr><\/tbody><\/table>
Module Questions<\/figcaption><\/figure>\n\n\n\n
What are the 9 types of Malware?<\/td>1. Virus
2. Crypto-Malware
3. Ransomware<\/td><\/tr>
Difference between Virus and Worm<\/td>Viruses use a programme to execute where a Virus exploits vulnerabilities<\/td><\/tr>
What’s a key characteristic of a Worm?<\/td>Spreads very fast<\/td><\/tr>
What are the two common types of Data?<\/td>1. Personal Data
2. Organisational Data<\/td><\/tr>
How do you protect against ransomware? (4)<\/td>1. Backups
2. Keep OS up to date
3. Keep Anti-virus up to date
4. Keep apps up to date<\/td><\/tr>
What type of malware is installed via Trojan Horse?<\/td>1. Potentially Unwanted Programme (PUP)
2. Backdoor
3. RAT<\/td><\/tr>
What can a RAT do?<\/td>As it has administrative privileges pretty much anything<\/td><\/tr>
What is the key advantage of a rootkit?<\/td>Very difficult to detect<\/td><\/tr>
How can you prevent and remove rootkits?<\/td>1. Look for unusual anti-malware results
2. Remover tool specific for rootkits
3. Secure boot with UEFI to secure BIOS<\/td><\/tr>
What are the two common ways adware is installed?<\/td>1. Packaged with other downloads
2. Funnily enough with adware removers<\/td><\/tr>
How do you protect against adware\/spyware?<\/td>1. Maintain anti-virus definitions
2. Backups
3. Always know what your installing
4. Anti-malware removal tools<\/td><\/tr>
What can botnets do?<\/td>1. DDoS
2. Replay Spam
3. Proxy Traffic<\/td><\/tr>
Why are Logic bombs difficult to deal with?<\/td>1. Difficult to identify pre-activation
2. Difficult to recover from once activated<\/td><\/tr>
Who is usually responsible for deploying a logic bomb?<\/td>Disgruntled employee<\/td><\/tr>
What usually happens to a logic bomb post activation?<\/td>It deletes itself<\/td><\/tr>
How can you secure passwords?<\/td>Hashing<\/td><\/tr>
What is the key advantage of hashing?<\/td>Cannot be reversed<\/td><\/tr>
Why do you salt passwords?<\/td>To protect against has comparison attacks (e.g. rainbow table)<\/td><\/tr>
How can you protect against supplier attacks?<\/td>1. Use reputable companies
2. Maintain small supplier base
3. Strict controls over policies\/procedures<\/td><\/tr><\/tbody><\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"

Malware A blanker term for software that is specifically designed to\u00a0disrupt, damage, or gain unauthorized access to a computer system….<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[2,4],"tags":[],"class_list":["post-55","post","type-post","status-publish","format-standard","hentry","category-learning","category-security"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/55","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=55"}],"version-history":[{"count":2,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/55\/revisions"}],"predecessor-version":[{"id":59,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/55\/revisions\/59"}],"wp:attachment":[{"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=55"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=55"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/justatrainingblog.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=55"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}