Month 2: Black Friday under attack

Virus and worm

A virus attaches to a file or program and needs a user to run it to spread (program, boot sector, script and macro viruses; fileless viruses live only in memory and use built-in tools like PowerShell). A worm spreads by itself across the network by exploiting vulnerabilities, with no user action, so it can infect thousands of machines fast.

Exam tip Key difference: virus needs a user to run something; worm self-replicates over the network.

Spyware, keylogger, bloatware

Spyware secretly watches the user (browsing, screenshots, location) and sends the data out. A keylogger records keystrokes to steal passwords and messages; it can be software or a small hardware plug. Bloatware is unnecessary software preinstalled by the maker; it wastes resources and widens the attack surface with apps nobody patches.

Exam tip Bloatware usually isn't malicious by design; the risk is extra unpatched code. Remove what you don't need.

Logic bomb and rootkit

A logic bomb is code that waits for a trigger (a date, or an event like an employee being removed from payroll) and then does damage. Hard to spot because it does nothing until triggered; often planted by insiders. A rootkit hides deep in the system, often in the kernel, to conceal itself and other malware from the OS and security tools, so normal scans look clean.

Exam tip Clue for rootkit: "scans are clean but the machine still beacons" or "hidden processes". Fix: rebuild from known-good media.

Brute force, RFID cloning, environmental

A physical brute force attack forces entry: breaking a window, prying a door, ramming a gate with a vehicle (which bollards stop). Radio frequency identification (RFID) cloning copies the data from an access badge with a hidden reader, sometimes just by standing close, then writes it to a blank card. Environmental attacks target the facility's supports: power, HVAC cooling, fire suppression, so systems overheat or fail.

Exam tip Defense for RFID cloning: badges with encryption and challenge-response, plus MFA (badge + PIN) at sensitive doors.

DDoS: reflected and amplified

A distributed denial-of-service (DDoS) attack floods a target from many sources, often a botnet, to hurt availability. Reflected: the attacker sends requests to third-party servers with the victim's spoofed IP, so the replies hit the victim. Amplified: the attacker picks requests whose replies are far larger than the request (DNS, NTP, memcached), multiplying the flood. Most big floods are both.

Exam tip Reflected = bounced off someone else with a spoofed source. Amplified = small request, huge reply.

DNS attacks and wireless attacks

DNS attacks include DNS poisoning (false records cached, sending users to the attacker's IP), domain hijacking (taking control of the domain registration) and URL hijacking (lookalike domains). Wireless attacks include deauthentication floods that kick users off Wi-Fi (802.11w management frame protection helps), jamming of the radio frequencies, and evil twin or rogue access points that capture traffic.

Exam tip Users typing the right name but landing on the wrong site = DNS poisoning (or a hijacked domain).

Injection, buffer overflow, replay

Injection attacks put attacker data into something that gets executed or interpreted: SQL, HTML/script (XSS), LDAP, XML, OS commands, DLLs. A buffer overflow attack sends more input than a buffer holds to crash the app or run code. A replay attack captures valid traffic, such as a session cookie or token, and sends it again to impersonate the user; that is how session hijacking works.

Exam tip Replay works without cracking anything: the attacker reuses what was already valid. Short-lived, single-use tokens break it.

Privilege escalation, forgery, directory traversal

Privilege escalation gains more rights than intended: vertical (user to admin) or horizontal (one user to another user's data). Forgery makes a server or browser send requests the user didn't intend: cross-site request forgery (CSRF) abuses a logged-in user's browser; server-side request forgery (SSRF) makes a server fetch internal resources. Directory traversal uses ../ sequences to read files outside the web root.

GET /img?file=../../../../etc/passwd
  <- directory traversal
GET /fetch?url=http://169.254.169.254/
  <- SSRF

Exam tip Clue: ../ or %2e%2e%2f in a URL = directory traversal.

Downgrade, collision, birthday

A downgrade attack forces two sides to use an older, weaker protocol or cipher (for example pushing a TLS 1.3 client back to an old, broken protocol version) so the attacker can break it. A collision is two different inputs that produce the same hash, which lets a forged file pass a hash check (MD5 and SHA-1 are vulnerable). A birthday attack uses the birthday paradox: finding any two inputs with matching hashes takes far fewer tries than matching one specific hash.

Exam tip Fix downgrades by disabling old protocols and ciphers on servers. Fix collisions by using SHA-256 or better.

Password spraying and brute force

Spraying tries one or a few common passwords against many accounts, staying under each account's lockout limit. Brute force tries many passwords against one account: online against the live login (lockouts stop it) or offline against stolen hashes at full speed (lockouts don't help; salting and key stretching do). A dictionary attack is brute force with a word list.

Exam tip Many accounts, few failures each = spraying. One account, many failures = brute force.