Study notes covering Threats Vulnerabilities and Mitigations.
{.is-info}
Reconnaissance – The process of gathering as much information about a target as possible.
-
Reconnaissance looks for valuable information such as:
- Hardware – Preferred or commonly used hardware.
- Network – IP ranges, open ports, services, and topology.
- Users – Employees, roles, and potential weak points.
-
Social Engineering techniques used during recon:
- Dumpster Diving – Searching through discarded items for sensitive information.
- Intimidation – Pressuring a target through authority or fear.
- Sympathy – Extracting information by appealing to emotions.
-
Technical Exploits are active methods for gathering deeper information:
- Port Scanning – Identifying open ports on a network.
- Vulnerability Scanning – Detecting known software and system weaknesses.
- Ping Sweep – Identifying live hosts on a network.
General Defense Strategy
Defense in Depth – Multiple layers of defense designed to make it more difficult for attackers to reach critical assets.
- Data – The most valuable asset, focus of protection.
- Applications – Secure coding, patching, and monitoring apps.
- Hosts – Ensure operating systems are updated and hardened.
- Internal Network – Segmentation and monitoring to limit lateral movement.
- Perimeter – Firewalls, DMZs, intrusion prevention systems; isolate public-facing servers.
- Physical Security – Locks, bollards, cameras, guards.
- Policies, Procedures, and Awareness – Clear guidelines and employee training.
Principle of Least Privilege – Users should only have the minimum access required to perform their jobs.
Early password policy standards originated from Bill Burr (NIST), who introduced periodic password change requirements.
Attack Surface Overview
- Client-based attacks – Targeting end-user devices.
- Agentless attacks – Exploiting services without installed agents.
- Default Credentials – Using factory-set or unchanged login details.
- Open Ports – Entry points for attackers if exposed.
- Broad Exposure (BROD) – Weak security configurations expanding attack risk.
- Randomness – Weak randomization in crypto or authentication.
- Personal Habits – User behaviors that introduce vulnerabilities.
- Password Change Intervals – Too frequent changes may reduce security.
- Obscure Information – Security through obscurity is not reliable.
The Art of Social Engineering
| Term | Definition |
|---|---|
| Social Engineering | Manipulating people to gain unauthorized information or access. |
| Impersonation | Pretending to be someone with authority or trust. |
| Pretexting | Creating a fabricated scenario to extract information. |
| Phishing | Fraudulent emails or messages tricking users into revealing data. |
| Vishing | Voice phishing via phone calls. |
| Smishing | Phishing via SMS/text messages. |
| Pharming | Redirecting users to malicious websites without their knowledge. |
| Typosquatting | Using misspelled domain names to capture traffic. |
| Business Email Compromise (BEC) | Impersonating executives to defraud organizations. |
| Watering Hole Attack | Compromising websites frequently visited by targets. |
| OSINT | Open Source Intelligence – gathering information from public sources. |
- Resource: osintframework.com
Why it works:
- Hard to detect, hard to track, hard to prove.
- Education and awareness are the strongest defenses.
Motivations used:
- Manipulation and persuasion
- Moral obligation
- Trust
- Threats
- Greed
- Ignorance
Process:
- Research
- Development
- Exploitation
What is Malware?
| Term | Definition |
|---|---|
| Malware | Malicious software designed to disrupt, damage, or gain unauthorized access. |
| Trojan | Malicious program disguised as legitimate software. |
| PUPs | Potentially Unwanted Programs, often bundled with downloads. |
| Virus | Code that attaches to files/programs and spreads when executed. |
| Malicious Process | Any unauthorized or harmful running process. |
| Worm | Self-replicating malware that spreads without user action. |
| Shellcode | Exploit payload providing control of a system. |
| APT | Advanced Persistent Threat – prolonged, targeted attack. |
| Adware | Software that automatically delivers ads. |
| Spyware | Software that secretly monitors user activity. |
| Keylogger | Records keystrokes to capture sensitive data. |
| Backdoor | Hidden entry point bypassing normal authentication. |
| RAT | Remote Access Trojan – allows remote control of systems. |
| Botnet | Network of compromised devices controlled by attackers. |
| C2C (C2) | Command and Control server used to manage malware. |
| Covert Channel | Hidden communication path to exfiltrate data. |
| IRC | Internet Relay Chat – sometimes used for botnet control. |
| Rootkit | Stealthy malware that hides its presence and activities. |
| Ransomware | Encrypts data and demands payment for release. |
| Crypto-Miner | Malware hijacking system resources to mine cryptocurrency. |
| Logic Bomb | Malicious code triggered by specific conditions. |
Prevention and Recovery:
- Regular patching
- Antivirus/EDR solutions
- Popup blockers
- Anti-rootkit tools
- Firewalls (hardware & software)
- Regular scans
- Updated applications
Review Questions
- What motivates threat actors to attack?
- What protections can you implement against insider threats?
- Which three types of threat actors are most likely to have high levels of funding?
- Why are nation-state actors especially dangerous?
- What attack surfaces are inherent within a supply chain?
- What is the difference between a virus and a worm?
Practice Resource: trycyber.us/challenges