CHAPTER 1 Notes
1. Malware
[Link]:
o Definition: A virus is a small program that replicates and hides itself inside other
programs, usually without the user's knowledge.
o Characteristics:
▪ Self-Replicating: The defining feature of a virus is its ability to replicate itself.
Once it infects a host program, it copies itself to other programs or files on
the computer.
▪ Hidden: Viruses often disguise themselves within legitimate software to
avoid detection.
o Spread:
▪ Email: One of the most common methods for spreading viruses is through
email. The virus uses the victim's email account to send itself to everyone in
the victim's address book.
▪ Removable Media: Viruses can also spread through USB drives, CDs, and
other removable media.
CHAPTER 1 Notes
o Impact:
▪ System Performance: Some viruses don't harm the system directly but cause
significant network slowdowns due to the heavy network traffic caused by
virus replication.
▪ Destructive Viruses: Others can delete files, corrupt programs, or cause
system crashes.
2. Trojan Horses:
o Definition: A Trojan horse is a type of malware that appears to be benign software
but secretly performs malicious activities once installed on a computer.
o Origin: The name comes from the ancient Greek story of the Trojan Horse used to
infiltrate the city of Troy. Similarly, electronic Trojan horses disguise themselves as
useful software but contain hidden harmful functions.
o Mechanism:
▪ Disguise: Trojan horses often masquerade as legitimate applications or files
(e.g., games, software updates, or email attachments).
▪ Malicious Activity: Once the Trojan horse is installed, it can download other
types of malware, steal data, or give unauthorized access to the attacker.
3. Spyware:
o Definition: Spyware is software that monitors and collects information about the
user's activities without their knowledge.
o Types:
▪ Cookies: While not always malicious, cookies can track browsing habits. They
are small text files stored by the browser that can be read by the website or
other websites.
▪ Screen Capture Software: This type of spyware takes periodic screenshots of
the user's activities and sends them to the attacker.
▪ Key Loggers: Key loggers record every keystroke made by the user, capturing
sensitive information such as passwords, credit card numbers, and personal
messages.
o Impact:
▪ Privacy Violation: Spyware compromises user privacy by collecting and
transmitting personal data.
▪ System Performance: Spyware can slow down the computer and increase
network traffic.
4. Logic Bombs:
CHAPTER 1 Notes
o Definition: A logic bomb is a piece of code intentionally inserted into a software
system that will set off a malicious function when specified conditions are met.
o Activation:
▪ Condition-Based: The logic bomb remains dormant until the specific
condition, such as a date and time, is met.
▪ Trigger Actions: Once activated, the logic bomb can delete files, alter system
configurations, or release other types of malware.
o Example:
▪ Malicious Insider: A disgruntled employee might insert a logic bomb into the
company's software to activate after they leave the company.
▪ Delayed Attack: Logic bombs can be used to delay the impact of an attack,
making it harder to trace back to the attacker.
2. Compromising system seCurity
1. Cracking:
o Definition: Intruding into a system without permission, usually with malevolent
intent. This term is more appropriate than "hacking" for malicious activities.
o Techniques:
▪ Password Cracking: Using tools to break passwords.
▪ Exploiting OS Flaws: Taking advantage of vulnerabilities in the operating
system.
▪ Breaching Wi-Fi: Gaining unauthorized access to wireless networks.
2. Social Engineering:
o Definition: Exploiting human nature to breach security rather than using technical
exploits.
o Example:
▪ Kevin Mitnick: A famous hacker known for using social engineering.
o Method:
▪ Preliminary Information: Gather basic information about the target
organization.
▪ Manipulation: Contact employees, impersonate technical support, and use
the gathered information to gain further details or access credentials.
3. War-Dialing:
CHAPTER 1 Notes
o Definition: Setting up a computer to call phone numbers sequentially until another
computer answers.
o Purpose: To gain entry to a system through modem connections.
4. War-Driving:
o Definition: Driving around to locate vulnerable wireless networks.
o Method:
▪ Wireless Signal Range: Exploiting the fact that wireless signals can extend
beyond physical boundaries (e.g., walls).
▪ Contests: Events like the war-driving contest at the 2004 DefCon convention
highlight this practice.
5. War-Flying:
o Definition: Using drones equipped with Wi-Fi sniffing and cracking software to locate
and gain access to wireless networks.
o Innovation: This is a modern variation of war-driving, leveraging aerial technology to
access wireless networks from above.
6. Software Exploits:
o Definition: Taking advantage of vulnerabilities in software to gain unauthorized
access to a system.
3. Denial of serviCe (Dos) attaCks
• Goal: Prevent legitimate users from accessing a system or service.
• Method: Overload the system with an excessive number of requests.
• Tools:
o Low Orbit Ion Cannon (LOIC): A popular tool used to perform DoS attacks. It's easy
to use and available for free on the internet.
• Variations:
o Distributed DoS (DDoS): Involves multiple computers (often part of a botnet)
flooding the target with traffic, making it much more difficult to mitigate.
o Example: A single machine may not generate enough traffic to take down a large
website, but a botnet of thousands of machines can.
• Impact: Disrupts services, potentially leading to loss of revenue and reputation.
4. Web attaCks
CHAPTER 1 Notes
Web attacks exploit vulnerabilities in websites to gain unauthorized access, manipulate data, or
disrupt services. Here are a few common types:
1. SQL Injection (SQLi)
o Description: An attacker inserts malicious SQL code into input fields (like login forms)
to manipulate the database.
o How It Works:
▪ Web applications use SQL to interact with databases. If input fields are not
properly sanitized, attackers can insert SQL code to manipulate the database.
▪ Example: Entering ' OR '1' = '1 into a username field can create a query that
always returns true, bypassing authentication.
▪ Original SQL: SELECT * FROM tblUsers WHERE USERNAME = 'jdoe'
AND PASSWORD = 'password'
▪ Malicious Input: SELECT * FROM tblUsers WHERE USERNAME = '' OR
'1' = '1' AND PASSWORD = '' OR '1' = '1'
▪ Impact: Can lead to unauthorized access, data theft, or data manipulation.
o Prevention:
▪ Validate and sanitize all user inputs.
▪ Use prepared statements and parameterized queries.
▪ Implement input filtering and escaping.
Cross-Site Scripting (XSS)
• Description: An attacker injects malicious scripts into web pages that other users view.
• How It Works:
o The attacker finds an input field that does not properly filter or sanitize input.
o They inject a script that will execute in the context of another user’s browser.
o Example: Entering <script>[Link] = "[Link] into a
comment field on a blog. When another user views the comment, they are
redirected to the fake site.
• Impact: Can lead to session hijacking, data theft, and redirection to malicious sites.
• Prevention:
o Filter and sanitize user input.
o Use Content Security Policy (CSP) to restrict the execution of scripts.
o Encode output to prevent script execution.
CHAPTER 1 Notes
[Link] HijaCking
o Description: An attacker takes over an active session between a client and server.
o How It Works:
▪ The attacker intercepts or predicts session tokens.
▪ Once they obtain the session token, they can impersonate the legitimate
user.
▪ Example: An attacker on the same network captures session cookies using
packet sniffing tools like Wireshark.
o Impact: Unauthorized access to user accounts and sensitive data.
o Prevention:
▪ Use secure, random session tokens.
▪ Implement HTTPS to encrypt data in transit.
▪ Regularly regenerate session tokens.
[Link] tHreats
• Description: Security breaches caused by individuals within the organization.
• How It Works:
o Insiders misuse their access to sensitive information or systems.
o Examples:
▪ Edward Snowden: Used his position as a contractor to access and leak
classified NSA documents.
▪ Common Scenarios:
▪ A hospital employee accesses patient records for identity theft.
▪ A salesperson takes a client list when leaving the company.
• Impact: Theft of sensitive information, financial loss, and damage to reputation.
• Prevention:
o Implement strict access controls and monitor access to sensitive data.
o Enforce strong authentication and password policies.
o Conduct regular audits and employee training on security policies.
[Link] poisoning
CHAPTER 1 Notes
• Description: Compromising the Domain Name System (DNS) to redirect traffic to malicious
sites.
• How It Works:
o The attacker corrupts the DNS cache with incorrect mappings.
o Example:
▪ The attacker sets up a fake DNS server and creates records pointing to a
malicious site.
▪ They then send a DNS request to the target’s DNS server, which does not
have a record for the requested domain.
▪ The target DNS server forwards the request up the chain, and the attacker
responds with the malicious DNS server, which also provides a fake record
for a legitimate site (e.g., a bank).
▪ Users trying to visit the legitimate site are redirected to the attacker’s fake
site.
• Impact: Phishing, data theft, and malware distribution.
• Prevention:
• Configure DNS servers to only perform zone transfers with authenticated servers.
• Use DNSSEC (DNS Security Extensions) to ensure the integrity of DNS responses.
• Regularly update and patch DNS server software.
[Link] attaCks
• Doxing
• Description: Finding and broadcasting personal information about individuals, often online.
• How It Works:
• The attacker gathers personal information from various sources (social media, public records,
etc.).
• They then publicly share this information, often to harass or intimidate the victim.
• Example: Publishing the home address and contact information of a public figure.
• Impact: Privacy invasion, harassment, and potential physical danger.
• Prevention:
• Limit the amount of personal information shared online.
• Use privacy settings on social media.
CHAPTER 1 Notes
• Monitor for unauthorized disclosure of personal information.
• Hacking of Medical Devices
• Description: Exploiting vulnerabilities in medical devices to cause harm.
• How It Works:
• Medical devices may have insecure firmware or wireless communication protocols.
• Example:
• An attacker exploits a vulnerability in an insulin pump to deliver a fatal dose.
• Security researcher Barnaby Jack demonstrated the ability to hack an insulin pump in this
manner.
• Impact: Physical harm or death to patients.
• Prevention:
• Manufacturers should implement strong security measures in medical devices.
• Regularly update and patch device firmware.
• Use encryption for wireless communications.
HaCker slang anD terminology
Types of Hackers
1. White Hat Hacker
o Definition: Ethical hackers who seek to improve security by identifying vulnerabilities
in systems and reporting them to vendors.
o Activities:
▪ Conduct penetration testing.
▪ Help organizations improve their security.
▪ Obtain certifications like Certified Ethical Hacker (CEH).
o Example: A white hat hacker discovers a vulnerability in Red Hat Linux and reports it
to the company, helping them fix the issue before malicious hackers can exploit it.
2. Black Hat Hacker
o Definition: Hackers with malicious intent who exploit system vulnerabilities to cause
harm.
o Activities:
CHAPTER 1 Notes
▪ Steal data.
▪ Erase files.
▪ Deface websites.
o Media Depiction: Often portrayed as the stereotypical "bad guys" in movies and
news reports.
o Example: A black hat hacker might breach a company's database to steal customer
information for identity theft.
3. Gray Hat Hacker
o Definition: Hackers who fall between ethical (white hat) and malicious (black hat).
They may sometimes engage in illegal activities but do not have purely malicious
intent.
o Activities:
▪ Occasionally test system vulnerabilities without permission.
▪ Sometimes report discovered vulnerabilities to vendors or use them for
personal gain.
o Example: A gray hat hacker might find a vulnerability and exploit it to demonstrate
their skills but then inform the company to fix the flaw.
Script Kiddies
• Definition: Individuals who use pre-made hacking tools and scripts without understanding
the underlying systems or techniques.
• Characteristics:
o Lack of deep technical knowledge.
o Rely on readily available tools with graphical user interfaces.
• Common Tools:
o Low Earth Orbit Ion Cannon (LOIC) for executing Distributed Denial of Service (DDoS)
attacks.
• Example: A script kiddy uses a downloaded tool to launch a DDoS attack on a website but
lacks the skills to create or understand the tool.
Ethical Hacking and Penetration Testers
• Penetration Testers (Pen Testers): Professionals hired to simulate attacks on a system to
identify and fix security weaknesses.
• Qualifications:
o Technical proficiency in various hacking techniques.
CHAPTER 1 Notes
o Strong ethical standards and a clean criminal background.
o Often certified (e.g., CEH, Offensive Security Certified Professional (OSCP)).
• Importance: Ensuring that the person assessing vulnerabilities does not pose a risk to the
organization.
• Example: A company hires a penetration tester to evaluate the security of its network and
identify potential vulnerabilities that could be exploited by malicious hackers.
Phreaking
• Definition: A type of hacking focused on breaking into telephone systems to make free calls
or manipulate phone services.
• Skills Needed:
o In-depth knowledge of telecommunications systems.
o Familiarity with specific technology required to exploit phone systems.
• Example: A phreaker manipulates a phone system to make long-distance calls without being
billed.
Security Devices
1. Firewall
o Definition: A device or software that filters incoming and outgoing network traffic
based on predefined security rules.
o Types:
▪ Hardware firewalls: Standalone devices that protect entire networks.
▪ Software firewalls: Programs installed on individual machines.
o Function: Blocks unauthorized access while permitting authorized communication.
o Example: A firewall blocks an attempt by a malicious user to access a company's
internal network from the internet.
2. Proxy Server
o Definition: A server that acts as an intermediary between a user's computer and the
internet.
o Functions:
▪ Hides the internal network’s IP addresses.
▪ Presents a single IP address to the outside world.
o Example: A proxy server masks the IP addresses of employees' computers,
enhancing privacy and security when they browse the internet.
CHAPTER 1 Notes
3. Intrusion Detection System (IDS)
o Definition: A system that monitors network traffic for suspicious activity and alerts
administrators of potential intrusions.
o Types:
▪ Network-based IDS (NIDS): Monitors entire network segments.
▪ Host-based IDS (HIDS): Monitors individual devices.
o Example: An IDS detects an unusual spike in network traffic that may indicate a DDoS
attack and alerts the network administrator.
Security Activities
1. Authentication
o Definition: The process of verifying the identity of a user or system.
o Methods:
▪ Username and password.
▪ Two-factor authentication (2FA).
▪ Biometric verification.
o Example: A user logs in to their email account by entering their username and
password, which the system checks against its records to authenticate the user.
2. Auditing
o Definition: The process of reviewing and evaluating logs, records, and procedures to
ensure compliance with security policies and standards.
o Importance: Helps identify security weaknesses and ensures that security measures
are effective.
o Example: An auditor reviews access logs to ensure that only authorized personnel
have accessed sensitive data.
Security Concepts
1. CIA Triangle
o Confidentiality: Ensuring that information is accessible only to those authorized to
access it.
▪ Example: Encrypting sensitive data to prevent unauthorized access.
o Integrity: Ensuring that information is accurate and has not been tampered with.
▪ Example: Using checksums or digital signatures to verify data integrity.
CHAPTER 1 Notes
o Availability: Ensuring that authorized users have access to information and resources
when needed.
▪ Example: Implementing redundant systems to ensure continuous availability
of a critical application.
2. Least Privileges
o Definition: Granting users the minimum level of access necessary to perform their
job functions.
o Importance: Reduces the risk of unauthorized access or accidental damage.
o Example: A financial analyst is given access only to financial data, not to other
sensitive areas like HR records.
seCurity approaCHes
1. Perimeter Security
o Definition: Focuses on securing the network's boundary to prevent unauthorized
access.
o Methods:
▪ Firewalls.
▪ Proxy servers.
▪ Strong password policies.
o Example: A small business uses a firewall to block unauthorized access to its internal
network from the internet.
2. Layered Security
o Definition: Involves securing individual systems and network segments within the
overall network.
o Methods:
▪ Securing each server, workstation, and network device.
▪ Segmenting the network and securing each segment separately.
o Example: A large corporation secures its network by implementing firewalls, IDS, and
strict access controls on all its devices and network segments.
3. Proactive vs. Reactive Security
o Proactive Security: Implementing measures to prevent attacks before they occur.
▪ Example: Using an IDS to detect and alert administrators about potential
intrusions.
CHAPTER 1 Notes
o Reactive Security: Responding to attacks after they have occurred.
▪ Example: Investigating and mitigating the effects of a data breach after it has
been detected.