NOTES ON

Introduction to
Cyber Security
Text book and Reference books:
Cyber Security Understanding Cyber Crimes, Computer Forensics and Legal Perspectives,
Sumit Belapure and Nina Godbole, Wiley India Pvt. Ltd.

UNIT-I

Introduction to Cyber Security

Cyber Security Introduction - Cyber Security Basics:

Cyber security is the most concerned matter as cyber threats and attacks are overgrowing.
Attackers are now using more sophisticated techniques to target the systems. Individuals,
small-scale businesses or large organization, are all being impacted. So, all these firms
whether IT or non-IT firms have understood the importance of Cyber Security and focusing
on adopting all possible measures to deal with cyber threats.

What is cyber security?

"Cyber security is primarily about people, processes, and technologies working together to
encompass the full range of threat reduction, vulnerability reduction, deterrence, international
engagement, incident response, resiliency, and recovery policies and activities, including
computer network operations, information assurance, law enforcement, etc."
OR
Cyber security is the body of technologies, processes, and practices designed to protect
networks, computers, programs and data from attack, damage or unauthorized access.

​ The term cyber security refers to techniques and practices designed to protect
digital data.

​ The data that is stored, transmitted or used on an information system.

OR
Cyber security is the protection of Internet-connected systems, including hardware, software,
and data from cyber attacks.
It is made up of two words one is cyber and other is security.
 ​ Cyber is related to the technology which contains systems, network and programs
or data.

​ Whereas security related to the protection which includes systems security, network
security and application and information security.

Why is cyber security important?

Listed below are the reasons why cyber security is so important in what’s become a
predominant digital world:

​ Cyber attacks can be extremely expensive for businesses to endure.

​ In addition to financial damage suffered by the business, a data breach can also
inflict untold reputational damage.
​ Cyber-attacks these days are becoming progressively destructive. Cybercriminals
are using more sophisticated ways to initiate cyber attacks.
​ Regulations such as GDPR are forcing organizations into taking better care of the
personal data they hold.

Because of the above reasons, cyber security has become an important part of the
business and the focus now is on developing appropriate response plans that minimize
the damage in the event of a cyber attack.

But, an organization or an individual can develop a proper response plan only when
he has a good grip on cyber security fundamentals.

Cyber security Fundamentals – Confidentiality:

Confidentiality is about preventing the disclosure of data to unauthorized parties.

It also means trying to keep the identity of authorized parties involved in sharing and holding
data private and anonymous.

Often confidentiality is compromised by cracking poorly encrypted data,

Man-in-the-middle (MITM) attacks, disclosing sensitive data.

Standard measures to establish confidentiality include:

​ Data encryption
​ Two-factor authentication
​ Biometric verification
​ Security tokens

Integrity

Integrity refers to protecting information from being modified by unauthorized parties.

Standard measures to guarantee integrity include:

​ Cryptographic checksums
​ Using file permissions
​ Uninterrupted power supplies
​ Data backups

Availability

Availability is making sure that authorized parties are able to access the information when
needed.

Standard measures to guarantee availability include:

​ Backing up data to external drives

​ Implementing firewalls
​ Having backup power supplies
​ Data redundancy
Types of Cyber Attacks

A cyber-attack is an exploitation of computer systems and networks. It uses malicious code to

alter computer code, logic or data and lead to cybercrimes, such as information and identity
theft.

Cyber-attacks can be classified into the following categories:

1)​ Web-based attacks

2)​ System-based

attacks Web-based attacks

These are the attacks which occur on a website or web applications. Some of the important
web-based attacks are as follows-

1.​Injection attacks

It is the attack in which some data will be injected into a web application to manipulate the
application and fetch the required information.

Example- SQL Injection, code Injection, log Injection, XML Injection etc.

2.​DNS Spoofing

DNS Spoofing is a type of computer security hacking. Whereby a data is introduced into a
DNS resolver's cache causing the name server to return an incorrect IP address, diverting
traffic to the attackers computer or any other computer. The DNS spoofing attacks can go on
for a long period of time without being detected and can cause serious security issues.

3.​Session Hijacking

It is a security attack on a user session over a protected network. Web applications create
cookies to store the state and user sessions. By stealing the cookies, an attacker can have
access to all of the user data.

4.​Phishing

Phishing is a type of attack which attempts to steal sensitive information like user login
credentials and credit card number. It occurs when an attacker is masquerading as a
trustworthy entity in electronic communication.

5.​Brute force

It is a type of attack which uses a trial and error method. This attack generates a large number
of guesses and validates them to obtain actual data like user password and personal
identification number. This attack may be used by criminals to crack encrypted data, or by
security, analysts to test an organization's network security.
6.​Denial of Service

It is an attack which meant to make a server or network resource unavailable to the users. It
accomplishes this by flooding the target with traffic or sending it information that triggers a
crash. It uses the single system and single internet connection to attack a server. It can be
classified into the following-

Volume-based attacks- Its goal is to saturate the bandwidth of the attacked site, and is
measured in bit per second.

Protocol attacks- It consumes actual server resources, and is measured in a packet.

Application layer attacks- Its goal is to crash the web server and is measured in request per
second.

7.​Dictionary attacks

This type of attack stored the list of a commonly used password and validated them to get
original password.

8.​URL Interpretation

It is a type of attack where we can change the certain parts of a URL, and one can make a
web server to deliver web pages for which he is not authorized to browse.

9.​File Inclusion attacks

It is a type of attack that allows an attacker to access unauthorized or essential files which is
available on the web server or to execute malicious files on the web server by making use of
the include functionality.

10.​Man in the middle attacks

It is a type of attack that allows an attacker to intercepts the connection between client and
server and acts as a bridge between them. Due to this, an attacker will be able to read, insert
and modify the data in the intercepted connection.

System-based attacks

These are the attacks which are intended to compromise a computer or a computer network.
Some of the important system-based attacks are as follows-

1.​Virus

It is a type of malicious software program that spread throughout the computer files without
the knowledge of a user. It is a self-replicating malicious computer program that replicates by
inserting copies of itself into other computer programs when executed. It can also execute
instructions that cause harm to the system.
2.​Worm

It is a type of malware whose primary function is to replicate itself to spread to uninfected

computers. It works same as the computer virus. Worms often originate from email
attachments that appear to be from trusted senders.

3.​Trojan horse

It is a malicious program that occurs unexpected changes to computer setting and unusual
activity, even when the computer should be idle. It misleads the user of its true intent. It
appears to be a normal application but when opened/executed some malicious code will run
in the background.

4.​Backdoors

It is a method that bypasses the normal authentication process. A developer may create a
backdoor so that an application or operating system can be accessed for troubleshooting or
other purposes.

5.​Bots

A bot (short for "robot") is an automated process that interacts with other network services.
Some bots program run automatically, while others only execute commands when they
receive specific input. Common examples of bots program are the crawler, chatroom bots,
and malicious bots.
The 7 layers of cyber security should centre on the mission critical assets you are seeking to
protect.

1: Mission Critical Assets – This is the data you need to protect

2: Data Security – Data security controls protect the storage and transfer of data.
3: Application Security – Applications security controls protect access to an application, an
application’s access to your mission critical assets, and the internal security of the
application.
4: Endpoint Security – Endpoint security controls protect the connection between devices and
the network.
5: Network Security – Network security controls protect an organization’s network and
prevent unauthorized access of the network.
6: Perimeter Security – Perimeter security controls include both the physical and digital
security methodologies that protect the business overall.
7: The Human Layer – Humans are the weakest link in any cyber security posture. Human
security controls include phishing simulations and access management controls that protect
mission critical assets from a wide variety of human threats, including cyber criminals,
malicious insiders, and negligent users.

Vulnerability, threat, Harmful acts

As the recent epidemic of data breaches illustrates, no system is immune to attacks. Any
company that manages, transmits, stores, or otherwise handles data has to institute and
enforce mechanisms to monitor their cyber environment, identify vulnerabilities, and close up
security holes as quickly as possible.
Before identifying specific dangers to modern data systems, it is crucial to understand the
distinction between cyber threats and vulnerabilities.

Cyber threats are security incidents or circumstances with the potential to have a negative
outcome for your network or other data management systems.
Examples of common types of security threats include phishing attacks that result in the
installation of malware that infects your data, failure of a staff member to follow data
protection protocols that cause a data breach, or even a tornado that takes down your
company’s data headquarters, disrupting access.

Vulnerabilities are the gaps or weaknesses in a system that make threats possible and tempt
threat actors to exploit them.

Types of vulnerabilities in network security include but are not limited to SQL injections,
server misconfigurations, cross-site scripting, and transmitting sensitive data in a non-
encrypted plain text format.
When threat probability is multiplied by the potential loss that may result, cyber security
experts, refer to this as a risk.
SECURITY VULNERABILITIES, THREATS AND ATTACKS –
Categories of vulnerabilities
●​ Corrupted (Loss of integrity)
●​ Leaky (Loss of confidentiality)
●​ Unavailable or very slow (Loss of availability)
– Threats represent potential security harm to an asset when vulnerabilities are exploited
-​Attacks are threats that have been carried out
●​ Passive – Make use of information from the system without affecting system
resources
●​ Active – Alter system resources or affect operation
●​ Insider – Initiated by an entity inside the organization
●​ Outsider – Initiated from outside the perimeter

Computer criminals
Computer criminals have access to enormous amounts of hardware, software, and data; they
have the potential to cripple much of effective business and government throughout the
world. In a sense, the purpose of computer security is to prevent these criminals from doing
damage.
We say computer crime is any crime involving a computer or aided by the use of one.
Although this definition is admittedly broad, it allows us to consider ways to protect
ourselves, our businesses, and our communities against those who use computers maliciously.
One approach to prevention or moderation is to understand who commits these crimes and
why. Many studies have attempted to determine the characteristics of computer criminals. By
studying those who have already used computers to commit crimes, we may be able in the
future to spot likely criminals and prevent the crimes from occurring.
CIA Triad
The CIA Triad is actually a security model that has been developed to help people think
about various parts of IT security.
CIA triad broken down:

Confidentiality

It's crucial in today's world for people to protect their sensitive, private information from
unauthorized access.

Protecting confidentiality is dependent on being able to define and enforce certain access
levels for information.
In some cases, doing this involves separating information into various collections that are
organized by who needs access to the information and how sensitive that information actually
is - i.e. the amount of damage suffered if the confidentiality was breached.

Some of the most common means used to manage confidentiality include access control lists,
volume and file encryption, and Unix file permissions.

Integrity

Data integrity is what the "I" in CIA Triad stands for.

This is an essential component of the CIA Triad and designed to protect data from deletion or
modification from any unauthorized party, and it ensures that when an authorized person
makes a change that should not have been made the damage can be reversed.

Availability

This is the final component of the CIA Triad and refers to the actual availability of your data.
Authentication mechanisms, access channels and systems all have to work properly for the
information they protect and ensure it's available when it is needed.

Understanding the CIA triad

The CIA Triad is all about information. While this is considered the core factor of the
majority of IT security, it promotes a limited view of the security that ignores other important
factors.

For example, even though availability may serve to make sure you don't lose access to
resources needed to provide information when it is needed, thinking about information
security in itself doesn't guarantee that someone else hasn't used your hardware resources
without authorization.

It's important to understand what the CIA Triad is, how it is used to plan and also to
implement a quality security policy while understanding the various principles behind it. It's
also important to understand the limitations it presents. When you are informed, you can
utilize the CIA Triad for what it has to offer and avoid the consequences that may come along
by not understanding it.

Assets and Threat

What is an Asset: An asset is any data, device or other component of an organization’s

systems that is valuable – often because it contains sensitive data or can be used to access
such information.

For example: An employee’s desktop computer, laptop or company phone would be

considered an asset, as would applications on those devices. Likewise, critical infrastructure,
such as servers and support systems, are assets. An organization’s most common assets are
information assets. These are things such as databases and physical files – i.e. the sensitive
data that you store
What is a threat: A threat is any incident that could negatively affect an asset – for
example, if it’s lost, knocked offline or accessed by an unauthorized party.

Threats can be categorized as circumstances that compromise the confidentiality, integrity or

availability of an asset, and can either be intentional or accidental.

Intentional threats include things such as criminal hacking or a malicious insider stealing
information, whereas accidental threats generally involve employee error, a technical
malfunction or an event that causes physical damage, such as a fire or natural disaster.

Motive of Attackers

The categories of cyber-attackers enable us to better understand the attackers' motivations and
the actions they take. As shown in Figure, operational cyber security risks arise from three
types of actions: i) inadvertent actions (generally by insiders) that are taken without malicious
or harmful intent; ii) deliberate actions (by insiders or outsiders) that are taken intentionally
and are meant to do harm; and iii) inaction (generally by insiders), such as a failure to act in a
given situation, either because of a lack of appropriate skills, knowledge, guidance, or
availability of the correct person to take action Of primary concern here are deliberate
actions, of which there are three categories of motivation.

1.​ ​ Political motivations: examples include destroying, disrupting, or taking control

of targets; espionage; and making political statements, protests, or retaliatory
actions.
2.​ ​ Economic motivations: examples include theft of intellectual property or other
economically valuable assets (e.g., funds, credit card information); fraud;
industrial espionage and sabotage; and blackmail.
3.​ ​ Socio-cultural motivations: examples include attacks with philosophical,
theological, political, and even humanitarian goals. Socio-cultural motivations also
include fun, curiosity, and a desire for publicity or ego gratification.

Types of cyber-attacker actions and their motivations when deliberate

Active attacks: An active attack is a network exploit in which a hacker attempts to make
changes to data on the target or data en route to the target.

Types of Active attacks:

Masquerade: in this attack, the intruder pretends to be a particular user of a system to gain
access or to gain greater privileges than they are authorized for. A masquerade may be
attempted through the use of stolen login IDs and passwords, through finding security gaps
in programs or through bypassing the authentication mechanism.

Session replay: In this type of attack, a hacker steals an authorized user’s log in information
by stealing the session ID. The intruder gains access and the ability to do anything the
authorized user can do on the website.

Message modification: In this attack, an intruder alters packet header addresses to direct a
message to a different destination or modify the data on a target machine.

In a denial of service (DoS) attack, users are deprived of access to a network or web
resource. This is generally accomplished by overwhelming the target with more traffic than it
can handle.

In a distributed denial-of-service (DDoS) exploit, large numbers of compromised systems

(sometimes called a botnet or zombie army) attack a single target.

Passive Attacks:Passive attacks are relatively scarce from a classification perspective, but
can be carried out with relative ease, particularly if the traffic is not encrypted.

Types of Passive attacks:

Eavesdropping (tapping): the attacker simply listens to messages exchanged by two entities.
For the attack to be useful, the traffic must not be encrypted. Any unencrypted information,
such as a password sent in response to an HTTP request, may be retrieved by the attacker.

Traffic analysis: the attacker looks at the metadata transmitted in traffic in order to deduce
information relating to the exchange and the participating entities, e.g. the form of the
exchanged traffic (rate, duration, etc.). In the cases where encrypted data are used, traffic
analysis can also lead to attacks by cryptanalysis, whereby the attacker may obtain
information or succeed in unencrypting the traffic.

Software Attacks: Malicious code (sometimes called malware) is a type of software

designed to take over or damage a computer user's operating system, without the user's
knowledge or approval. It can be very difficult to remove and very damaging. Common
malware examples are listed in the following table:
Attack Characteristics
Virus A virus is a program that attempts to damage a computer system and replicate
itself to other computer systems. A virus:

●​ Requires a host to replicate and usually attaches itself to a host file or

a hard drive sector.
●​ Replicates each time the host is used.
●​ Often focuses on destruction or corruption of data.
●​ Usually attaches to files with execution capabilities such as .doc, .exe, and
.bat extensions.
●​ Often distributes via e-mail. Many viruses can e-mail themselves to
everyone in your address book.
●​ Examples: Stoned, Michelangelo, Melissa, I Love You.

Worm A worm is a self-replicating program that can be designed to do any number of

things, such as delete files or send documents via e-mail. A worm can negatively
impact network traffic just in the process of replicating itself. A worm:

●​ Can install a backdoor in the infected computer.

●​ Is usually introduced into the system through a vulnerability.
●​ Infects one system and spreads to other systems on the network.
●​ Example: Code Red.

Trojan A Trojan horse is a malicious program that is disguised as legitimate software.

horse Discretionary environments are often more vulnerable and susceptible to Trojan
horse attacks because security is user focused and user directed. Thus the
compromise of a user account could lead to the compromise of the entire
environment. A Trojan horse:

●​ Cannot replicate itself.

●​ Often contains spying functions (such as a packet sniffer) or backdoor
functions that allow a computer to be remotely controlled from the
network.
●​ Often is hidden in useful software such as screen savers or games.
●​ Example: Back Orifice, Net Bus, Whack-a-Mole.

Logic A Logic Bomb is malware that lies dormant until triggered. A logic bomb is a
Bomb specific example of an asynchronous attack.

●​ A trigger activity may be a specific date and time, the launching of

a specific program, or the processing of a specific type of activity.
●​ Logic bombs do not self-replicate.
Hardware Attacks:
Common hardware attacks include:

●​ Manufacturing backdoors, for malware or other penetrative purposes;

backdoors aren’t limited to software and hardware, but they also affect
embedded radio- frequency identification (RFID) chips and memory
●​ Eavesdropping by gaining access to protected memory without opening
other hardware
●​ Inducing faults, causing the interruption of normal behaviour

●​ Hardware modification tampering with invasive operations

●​ Backdoor creation; the presence of hidden methods for bypassing normal
computer authentication systems
●​ Counterfeiting product assets that can produce extraordinary operations and
those made to gain malicious access to systems.
Cyber Threats-Cyber Warfare:Cyber warfare refers to the use of digital attacks -- like
computer viruses and hacking -- by one country to disrupt the vital computer systems of
another, with the aim of creating damage, death and destruction. Future wars will see
hackers using computer code to attack an enemy's infrastructure, fighting alongside
troops using conventional weapons like guns and missiles.
Cyber warfare involves the actions by a nation-state or international organization to attack
and attempt to damage another nation's computers or information networks through, for
example, computer viruses or denial-of-service attacks.
Cyber Crime:
Cybercrime is criminal activity that either targets or uses a computer, a computer network
or a networked [Link] is committed by cybercriminals or hackers who want
to make money. Cybercrime is carried out by individuals or organizations.
Some cybercriminals are organized, use advanced techniques and are highly technically
skilled. Others are novice hackers.
Cyber Terrorism:
Cyber terrorism is the convergence of cyberspace and terrorism. It refers to unlawful
attacks and threats of attacks against computers, networks and the information stored
therein when done to intimidate or coerce a government or its people in furtherance of
political or social objectives.
Examples are hacking into computer systems, introducing viruses to vulnerable
networks, web site defacing, Denial-of-service attacks, or terroristic threats made via
electronic communication.
Cyber Espionage:
Cyber spying, or cyber espionage, is the act or practice of obtaining secrets and
information without the permission and knowledge of the holder of the information from
 individuals, competitors, rivals, groups, governments and enemies for personal, economic,
political or military advantage using methods on the Internet.

Security Policies:

Security policies are a formal set of rules which is issued by an organization to ensure that the
user who are authorized to access company technology and information assets comply with
rules and guidelines related to the security of information.

A security policy also considered to be a "living document" which means that the document
is never finished, but it is continuously updated as requirements of the technology and
employee changes.

We use security policies to manage our network security. Most types of security policies are
automatically created during the installation. We can also customize policies to suit our
specific environment.

Need of Security policies-

1)​It increases efficiency.

2)​It upholds discipline and accountability

3)​It can make or break a business deal

4)​It helps to educate employees on security literacy

There are some important cyber security policies recommendations describe
below-

Virus and Spyware Protection policy:

●​ It helps to detect threads in files, to detect applications that exhibits

suspicious behavior.
●​ Removes, and repairs the side effects of viruses and security risks by
using signatures.

Firewall Policy:

●​ It blocks the unauthorized users from accessing the systems and

networks that connect to the Internet.
●​ It detects the attacks by cybercriminals and removes the unwanted
sources of network traffic.

Intrusion Prevention policy:

●​ This policy automatically detects and blocks the network attacks and
browser attacks.
●​ It also protects applications from vulnerabilities and checks the contents
of one or more data packages and detects malware which is coming
through legal ways.

Application and Device Control:

●​ This policy protects a system's resources from applications and

manages the peripheral devices that can attach to a system.
●​ The device control policy applies to both Windows and Mac computers
whereas application control policy can be applied only to Windows
clients.
 What is Cyberspace: Its Role in the Modern World

The term “cyberspace” was introduced in the early 1980s by William Gibson,
an American science fiction novelist in his work Neuromancer. It refers to the
virtual environment created by interlocking networks of computers and
electronic systems. That is, cyberspace is that realm in which online
communication, data exchange, and digital interactions take place.

In today’s interrelated world, cyberspace plays a very significant role in almost

all aspects of life. It is that one platform that allows global communication,
drives economic transactions, supports critical infrastructures, and powers
technological innovation. Without cyberspace, the modern world as we know it
would come to an effective close.

Cyberspace in the Context of Cybersecurity

While cyberspace is an enabler of progress, it also presents significant

cyberspace security challenges. Cyberspace can be described, for the sake of
cybersecurity, as the digital environment vulnerable to a host of several other
threats like cyberattacks, data breaches, and digital espionage. Cybersecurity
involves protecting the information and systems from malignant activities in
this virtual environment, which may result in compromise to integrity,
availability, and confidentiality.

Understanding cyberspace from a cybersecurity point of view is very important

for the protection of sensitive information and ensuring reliability in digital
services, thereby retaining users’ trust. Cyberspace security carries great
importance in the government, business, and citizens’ agendas as more facets of
everyday life go digital.

What Are the Critical Infrastructures in Cyberspace?

Critical infrastructures in cyberspace are those systems and assets whose

destruction or incapacitation would have a debilitating impact on the proper
functioning of society and the economy. Critical infrastructures include:
 1.​ Communication Networks: These include the internet,
telecommunications, satellite systems, etc., which allow countries across
the world to communicate and share data.
2.​ Financial Systems: These are banking and financial services operating
on digital networks. These infrastructures include online banking, stock
exchanges, and other payment-processing systems.
3.​ Energy Grids: There are several power generation and distribution
networks that rely on digital systems. It is very important that these
systems are free from cyberattacks to ensure an uninterrupted electricity
supply.

Such infrastructures serve very important functions. The result of a cyberattack

on one of these could be disastrous, from purely financial to loss of life.

Understanding the Types of Cyberspace

The many forms of cyberspace can be distinguished according to the nature of

the digital setting and how it is used. Knowing these types informs where
different cyberspace security measures are to be applied.

1.​ Public Cyberspace: It includes the Internet and all the other publicly
accessible digital spaces. This is where most of the online interactions go
on, from social media to e-commerce and public information exchange.
2.​ Private Cyberspace: These are private networks and systems that can
only be accessed by authorized people or organizations. Examples
include corporate networks, personal devices, and encrypted
communication channels.
3.​ Social Cyberspace: This can be subcategorized under public cyberspace
and is used to refer to digital spaces wherein social interactions occur.
Examples include social media platforms, forums, online communities,
and so on.
4.​ Commercial Cyberspace: This refers to online marketplaces and digital
financial systems in general, including areas where business transactions
take place.
5.​ Military Cyberspace: A very secure, self-contained digital environment
used for communications, intelligence, and operational planning by the
military and defense communities.
 Key Components of Cyberspace

The important components of cyberspace include the following:

1.​ Networks: These are the backbone of cyberspace and involve many
different interconnected networks of computers, servers, and
communication systems helping in data transmission.
2.​ Hardware: This basically represents the real devices physically existing,
such as computers, routers, and servers, making up the physical
infrastructure of cyberspace. They serve a very important purpose.
3.​ Software: Software pertains to the applications, operating systems, and
platforms that run on hardware to enable communication, data
processing, etc.
4.​ Data: Data refers to information stored, transmitted, and processed
within cyberspace. These range from personal data to corporate records
and government databases.
5.​ Protocols: Protocols refer to a set of rules and standards that define how
data is transmitted and received across the network. These ensure that
different systems can communicate with each other.
6.​ Users: Users can consist of human beings and organizations that
approach cyberspace for any of the purposes: communication, business,
entertainment, and so on.

Understanding the Threats to Cyberspace

Cyberspace has several threats, which are always hanging over the heads of the
stakeholders. The threats belong to ill-meaning actors who would like to exploit
the vulnerabilities for financial benefits, political motives, or personal
satisfaction. Some common threats include:

1.​ Malware: It is a term used to refer to malicious software whose aim is to

disrupt, damage, or gain unauthorized access to computer systems. It
includes viruses, worms, Trojans, and ransomware.
 2.​ Phishing: This is a method by which users are lured into giving sensitive
information such as passwords or credit card numbers by pretending to be
an interested party.
3.​ Denial of Service (DoS) Attacks: This is an attack that floods the
network or system with enormous traffic, thereby making it unavailable
for the end-user.
4.​ Data Breaches: An incident where somebody gets access to confidential
data; usually, personal info, financial data, or corporate secrets are
exposed.
5.​ Insider Threats: These are threats from within the organization because
people have access to systems and data, which might be misused for ill
purposes.

Challenges in Securing Cyberspace

For several reasons, securing cyberspace is an ongoing challenge and thus an

eternal battle of sorts. Some of the challenges in securing cyberspace include:

1.​ Rapid Technological Change: The fast pace of technological innovation

makes it hard for cyberspace security measures to catch up with the
different vulnerabilities and attack methods that have been invented.
2.​ Global Nature of Cyberspace: Cyberspace has no national boundaries,
and hence laws and regulations have limitations in implementation across
different jurisdictions.
3.​ Resource Limitations: Very few organizations have adequate resources
to implement proper cyberspace security measures, especially small
businesses.
4.​ Human Error: Human error is another significant cause of
cybersecurity incidents. Some of the simple human errors include weak
passwords, falling prey to phishing attacks, or misconfiguration of the
system.
5.​ Sophistication of Attacks: With the enhanced use of technology, the
various cybercrimes that are carried out are getting sophisticated. They
are making use of advanced techniques like machine learning and
artificial intelligence as part of their attacks.
6.​ Lack of Awareness: Most users and organizations are partially unaware
of the threats that cyberspace poses.
These challenges require multi-faceted approaches to cyberspace security in
technology, education, policy, and collaboration.

Strategies to Build a Secure Cyberspace

Construction of safe cyberspace means following a combination of strategies at

both technical and human levels. Some of the strategies to build a secure
cyberspace include:

1.​ Implement Strong Authentication: This would mean strong

authentication, like multifactor authentication, which can help much in
avoiding possible cases of unauthorized access.
2.​ Regular Software Updates: Regular Software Updates makes one aware
of the changes that will address vulnerabilities that presently exist, thus
minimizing the risks of attacks.
3.​ Education and Training: Periodic training regarding information
cyberspace security for staff and users could significantly reduce the risk
of a human factor associated with errors and increase awareness
regarding malware.
4.​ Incident Response Planning: Clearly defined incident response planning
helps organizations to respond promptly to any cyber incident, and
manage it efficiently.
5.​ Encryption: Data has to be encrypted when it is in transit and also when
at rest. This guarantees that in case it is hijacked, it will not be easily
readable to unauthorized parties.
6.​ Network Segmentation: It involves breaking down a network into
smaller, isolated segments. Isolated segments can reduce the spread of
attack if one network segment is compromised.
7.​ Collaboration: Governments, businesses, and cybersecurity
professionals have to work together in terms of sharing threat information
and best practices.

By designing the above strategies, more secure cyberspace can be achieved for
the protection of users and their data.

What Are the Benefits of Cyberspace?

There are several advantages of cyberspace that have changed people’s ways of
life, working, and communicating. These include:
 1.​ Global Connectivity: Several people across the world can communicate
and collaborate in real-time due to the availability of cyberspace, hence
the removal of geographical limitations.
2.​ Economic Growth: The essence of cyberspace to create a digital
economy has fostered new industries in other areas, created jobs, and
opened up new opportunities that lead to innovation.
3.​ Access to Information: One of the distinguishing features of cyberspace
is the provision of access to information that has enabled education,
research, and informed decision-making on a very wide scale.
4.​ Convenience: The internet has made available banking, shopping, and
entertainment facilities that are literally right at everyone’s fingertips.
5.​ Enhanced Communication: social media, email, messaging, etc. have
changed the concepts of communication for the current generation and
keep them in touch with their friends, family, and colleagues around the
globe.
6.​ Innovation: Cyberspace is a ground that helps to foster tech innovations,
and its background continues to drive some more in the form of artificial
intelligence, cloud computing, and the Internet of Things.

What Are the Limitations of Cyberspace?

Some of the limitations of Cyberspace that need to be addressed include:

1.​ Cyberspace Security Risks: The beneficial features of cyberspace

transform it into a dangerous one with the potential for cyber-attacks, data
breaches, and cyberspace security threats.
2.​ Privacy Concerns: Privacy issues derive from the vast personal
information shared over the net and the misuse of such information by
businesses, government, or hackers.
3.​ Digital Divide: Not every person has access to cyberspace in the same
way, and the gap between those who are on the internet and those who
lack access is what is increasing the “digital divide.”
4.​ Overreliance on Technology: Over-reliance on digital systems makes
any society prone to several mishaps that can disrupt systems through
cyberattacks, failure in systems, or internet outages, among other things.
 5.​ Ethical Challenges: The anonymous and global perspective of
cyberspace is likely to encourage more cyberbullying, misguiding of
information, and spreading of undesirable content.
6.​ Regulatory Challenges: The very fact that cyberspace is global and
decentralized means that it will never be effectively regulated, with the
enforcement of laws and protective measures for the needful being a very
tough job.

The Role of Security Solutions in Securing Cyberspace

Security solutions play a very significant role in securing cyberspace from

various threats. Some of the necessary measures for security are:

1.​ Firewalls: Firewalls basically act as barriers between trusted and

untrusted networks. They screen and control the incoming and outgoing
traffic to block unauthorized access.
2.​ Antivirus Software: The antivirus programs detect and remove malware
from the computer system, hence protecting it from viruses, worms, and
other malware attacks.
3.​ Intrusion Detection Systems (IDS): IDSs are intrusion detection
systems that monitor network traffic and alert the administration in case
of any suspicious activity that may compromise security.
4.​ Encryption Tools: These tools ensure data is protected by changing it
into a format that is unreadable to unauthorized parties.
5.​ Security Information and Event Management (SIEM)
Systems: SIEM systems are designed to collect and analyze cyberspace
 security-related data flows from an organization in real time and help
with threat detection and incident response.
6.​ Cloud Security Solutions: As more and more organizations move their
data to the cloud, specialized cyberspace security tools are needed to
protect data and applications in the cloud environment.

These cyberspace security solutions can ensure the safety of cyberspace and
guarantee that users can indeed trust the digital space.

What Is the Difference Between Cyberspace vs. Physical Space?

Cyberspace and physical space are two different but connected realms:

1.​ Nature: Physical space is the real world, while cyberspace is a virtual
world of interlinked networks.
2.​ Interactions: In the physical world, interactions take place face-to-face
and involve physical objects. In cyberspace, interactions are completely
digital and happen through computers, mobile phones, and other devices.
3.​ Security: Safety in physical space deals with securing buildings, and
infrastructures, and in cyberspace, it is about securing digital assets, data,
or networks.
4.​ Regulation: Physical space is regulated under local, national, and
international law, while cyberspace is a global environment with tricky
regulative questions.
5.​ Vulnerabilities: Physical space is vulnerable to traditional threats like
theft or natural disasters, and cyberspace is vulnerable to cyber threats
like hacking, data breaches, and malware.

Exploring Examples of Cyberspace

Cyberspace is represented in the following instances within the different sectors

as follows:

1.​ Social Media: Facebook, Twitter, Instagram, and other apps that people
use to connect, share information, and discuss.
2.​ E-Commerce: This includes Amazon, eBay, Alibaba, etc. These are of
the commercial cyberspace where the buying and selling of goods and
services take place.
3.​ Cloud Computing: Google Drive, Microsoft Azure, and AWS are
examples of cyberspace that store, process, and access data remotely.
4.​ Online Banking: PayPal, Venmo, and even normal bank apps are
examples of financial cyberspace that enables a user to make secure
financial transactions.
5.​ Government Services: E-government portals, like tax filing websites
and online voter registration systems, are cases of using cyberspace in the
delivery of public services.
Module 2

Types of Hackers
Hackers can be classified into three different categories:

1.​ Black Hat Hacker

2.​ White Hat Hacker
3.​ Grey Hat Hacker

Black Hat Hacker

Black-hat Hackers are also known as an Unethical Hacker or a Security Cracker. These
people hack the system illegally to steal money or to achieve their own illegal goals. They
find banks or other companies with weak security and steal money or credit card information.
They can also modify or destroy the data as well. Black hat hacking is illegal.

White Hat Hacker

White hat Hackers are also known as Ethical Hackers or a Penetration Tester. White hat
hackers are the good guys of the hacker world.

These people use the same technique used by the black hat hackers. They also hack the
system, but they can only hack the system that they have permission to hack in order to test
the security of the system. They focus on security and protecting IT system. White hat
hacking is legal.

Gray Hat Hacker

Gray hat Hackers are Hybrid between Black hat Hackers and White hat hackers. They can
hack any system even if they don't have permission to test the security of the system but they
will never steal money or damage the system.

In most cases, they tell the administrator of that system. But they are also illegal because they
test the security of the system that they do not have permission to test. Grey hat hacking is
sometimes acted legally and sometimes not.

Sniffing and Spoofing

Kali Linux is an operating system that is built for penetration testers that comes with a vast
set of built-in tools. One of the tool categories within the Kali Linux operating system is
focused on sniffing and spoofing network traffic.

Sniffing is the process in which all the data packets passing in the network are monitored.
Network administrators typically use sniffers to monitor and troubleshoot network traffic.
Attackers use sniffers to monitor and collect data packets in order to acquire sensitive data
such as passwords and user accounts. Sniffers can be installed as hardware or software on
the system.

Spoofing is the process in which an intruder creates fake traffic and pretends to be someone
else (legitimate entity or legal source). Spoofing is accomplished by transmitting packers
over the network with an erroneous source address. Using a digital signature is a great
technique to deal with and tackle spoofing.

Kali Linux Top 5 Tools for Sniffing and Spoofing

Kali Linux has several tools for sniffing and spoofing network traffic. The following are the
top 5 tools for sniffing and spoofing:

1. Wireshark
One of the best and widely used tools for sniffing and spoofing is Wireshark. Wireshark is a
network traffic analysis tool with a plethora of capabilities. Wireshark's extensive library of
protocol dissectors is one of its most distinguishing features. These allow the tool to analyze a
wide range of protocols, break out the several fields in every packet and display them within
an accessible graphical user interface (GUI). Users with even basic network understanding
will be able to understand what they are looking for. In addition, Wireshark has a number of
traffic analysis tools, such as statistical analysis and the capability to follow network sessions
or decrypt SSL/TLS traffic.

Wireshark is a useful sniffing tool since it gives us a lot of information about network traffic,
either from a capture file or a live capture. This can help with understanding the network
layout, capturing leaked credentials, and another task.
2. Mitmproxy
The attacker interjects oneself into communication between a client and a server in
a man-in-the-middle (MitM) attack. All traffic passing across that connection is intercepted
by the attacker, giving them the ability to listen in on traffic and change data passing through
the network.

With the help of the mitmproxy in Kali Linux, we can easily perform the MitM attacks on
web traffic. It enables the on-the-fly capture and modification of HTTP traffic, supports
client and server traffic replay, and comprises the capability to automate attacks
using Python. Mitmproxy may also support the interception of HTTPs traffic
with SSL certificates generated on-the-fly.

3. Burp Suite
Burp Suite is a collection of various penetration tools. Its main focus is on web application
security analysis. Burp Proxy is the main tool in Burp Suite which is helpful in Sniffing and
Spoofing. Burp Proxy permits us to intercept and modify HTTP connections, as well as
provides supports for intercept HTTPs connection.

It works on a freemium model. Although the basic tools are free, attacks must be carried out
manually without the ability to save work. Paying for a license grants us access to a larger
tool (including a web vulnerability scanner) as well as automation support.
4. dnschef
The dnschef tool is a DNS proxy that may be used to analyze malware and penetration
testing. A highly configurable DNS proxy, dnschef, is used for analyzing network traffic.
This DNS proxy can generate fake requests and utilize these requests to be sent to a local
machine rather than a real server. This tool works on multiple platforms and can generate
phony requests and responses depending on domain lists. Different DNS record types are also
supported by the dnschef tool.

When it is impossible to force an application to use another proxy server, a DNS proxy must
be used instead. If a mobile application disregards the HTTP proxy setting, dnschef can
deceive it by faking requests and answers to a specified target.

5. Zaproxy
On Kali Linux, the executable named Zaproxy is OWASP's Zed Attack Proxy (ZAP). Like
Burp Suite, ZAP is a penetration testing tool that aids in detecting and exploiting
vulnerabilities within web applications.

Because of its ability to intercept and modify HTTP(S) traffic, ZAP is a handy tool for
sniffing and spoofing. ZAP has a lot of functionality and is a completely free tool for carrying
out these attacks.

Gaining Access
Gaining access attack is the second part of the network penetration testing. In this section, we
will connect to the network. This will allow us to launch more powerful attacks and get more
accurate information. If a network doesn't use encryption, we can just connect to it and sniff
out unencrypted data. If a network is wired, we can use a cable and connect to it, perhaps
through changing our MAC address. The only problem is when the target use encryption like
WEP, WPA, WPA2. If we do encounter encrypted data, we need to know the key to decrypt
it, that's the main purpose of this chapter.

If the network uses encryption, we can't get anywhere unless we decrypt it. In this section, we
will discuss that how to break that encryption and how to gain access to the networks whether
they use WEP/WPA/WPA2.

Executing Applications
Intruder executes malicious applications after gaining administrative privileges so they can
run malicious programs remotely, to capture all sensitive data, crack passwords, capture
screenshots or to install a backdoor.
Tool: RemoteExec, PDQ Deploy, DameWare NT Utilities

Keylogger
keystroke loggers are programs or hardware devices that monitor each keystroke a user types
on a keyboard, logs onto a file, or transmits them to a remote location.
keyloggers are placed between the keyboard hardware and the OS
A key logger can
Record each keystroke
capture screenshots at regular intervals of time showing user activity such as when he or she
types a character or click a mouse button
Track the activities of users by logging window titles, names of launched applications and
other information
monitor online activity of users by recording addresses of the websites that they have visited
and with the keywords entered by them
record all the login names, bank and credit card numbers and passwords including hidden
passwords or data that are in asterisk or blank spaces
record online chat conversion
Types of Keylogger
Hardware Keylogger
Software Keylogger
Spyware
Spyware is stealthy computer monitoring software that allows you to secretly record all
activities of a computer user.

Covering tracks — Hiding files on Windows/Linux/MacOS

Introduction to hiding files
After gaining access to a system, a hacker commonly needs to cover their tracks in order to
avoid detection. Many antiviruses operate by searching through the list of files stored on a
computer’s filesystem and comparing them to signatures of known malware variants. If a
hacker can conceal the existence of their files from an AV or other security tools, their
probability of detection dramatically decreases.
 Hiding files
When trying to hide files on a computer, there are a variety of different options. In general,
there is a tradeoff between the effectiveness of the hiding techniques and the level of
privileges necessary to accomplish them. While some methods may be extremely difficult for
a user to detect, they also require elevated privileges on the system. More accessible methods,
on the other hand, are much easier to detect.

Different means of hiding files may be specific to different operating systems, but many are
generally applicable. Some of the options for hiding files on a system include:

●​ Hidden files and folders

●​ Unexpected locations
●​ Alternate data streams
●​ Function modification
●​ Function hooking

In this section, we provide a brief introduction to each of these techniques and an overview of
some of their pros and cons.

Hidden files and folders

One of the simplest and most well-known methods of hiding files is using the hidden files
attribute. This functionality is built into most operating systems and is intended to ensure that
users do not mess with files that they shouldn’t.

On Windows, files can be marked as hidden through the use of [Link] or through File
Explorer. On Linux, any file whose filename begins with a period is marked as hidden by
default.

While this technique is probably the easiest means of hiding files, it’s also the easiest to
detect. The technique is well known, and it is easy to set Windows File Explorer or ls on *nix
to show even hidden files.

Unexpected locations
Another simple means of hiding files from a user is by placing them in unexpected locations.
While the user can easily see these files if they are looking for them, they’re unlikely to do
so.

One example of this is placing a malicious file in the Recycle Bin on Windows. Most users
ignore the Recycle Bin and may believe that anything there has already been dealt with by an
antivirus. However, files located there can still execute and cause damage.

Another example of an unusual location is the System32 folder on Windows. Since this folder
contains files vital to the functionality of the operating system, most users won’t look there,
let alone terminate or delete a potentially suspicious file that is located there.

Alternate data streams

Alternate data streams (ADS) are a feature of the NTFS file system. They allow additional
data or even files to be attached to a file. These data streams are not by default, making them
a good place to hide malicious files or executables.
However, ADS can be easily detected if a user or tool knows what they are doing. Windows’
Streams tool is one option for detecting them, and PowerShell has built-in functionality to do
so. As a result, ADS are best used for hiding files from casual detection.

Function modification
On both Windows and *nix systems, there are certain applications designed to provide lists of
files located on the filesystem. For example, Linux uses the ls command to provide this list.

These applications can be modified to hide the presence of certain files on the system. A
modified version of ls could be configured to specifically ignore certain attacker-owned files.

This technique is effective as long as the user does not detect the fact that ls has been
modified. Modifications can easily be detected by comparing the hash of the binary to a
known-good hash, and many security tools are designed to perform this comparison and
generate alerts if a discrepancy is discovered.

Function hooking
For those wanting to hide their files from more than just the casual user, the use of function
hooks is a good option. Function hooking is the technique used by rootkits to hide malware
on a system.

When an application wants a list of the files stored on a computer, the processes running and
so on, it calls a low-level function of the operating system. This function runs, generates the
list, and then sends it back to the calling application.

With function hooking, a rootkit intercepts all calls and responses between applications and
these low-level functions. This allows the program to ensure that the lists of files provided do
not include any files that the rootkit wants to remain hidden.

Function hooking is made possible due to the fact that many of these low-level functions
operate in the operating system’s kernel, while applications run in user mode. In Windows,
applications call kernel functions through interrupts or model specific registers (MSRs). Both
of these can be hooked by a rootkit, ensuring that the rootkit controls all kernel calls.

Alternatively, the System Service Descriptor Table (SSDT) is a table in the kernel containing
pointers to all kernel functions. If a rootkit modifies this table to point certain functions to
code under its control, the rootkit ensures that it controls any attempts to read lists of files on
the operating system.

Regardless of the specific method used, function hooking is one of the most effective means
of hiding files on a system. However, it often also requires elevated levels of access, since
kernel-level data structures must be modified.

Conclusion: Covering your tracks

Hiding files on a compromised machine is a common step in covering tracks after gaining
access. The methods described here each have their pros and cons, but they provide the
capability to hide a hacker’s files from anyone from the clueless user to a sophisticated
antivirus.
Privilege escalation is a step in the cyber attack chain. In this step, threat actors use their
unauthorized access to an organization’s systems and resources to give themselves deeper
access by increasing their access higher privileges. With this access, they can carry out more
significant attacks, like stealing confidential data or installing malware and ransomware.

Privilege Escalation Definition

Privilege escalation is when a threat actor gains elevated access and administrative rights to a
system by exploiting security vulnerabilities. By modifying identity permissions to grant
themselves increased rights and admin capabilities, attackers can conduct malicious activities,
potentially resulting in significant damages.

Systems have different levels of privileges, which range from basic users with limited
permissions to administrators with complete control. A successful privilege escalation
incident means that an attacker has managed to escalate their own privilege level, thereby
gaining increased control.

Cyber attackers use privilege escalation to open up new attack vectors on a target system.
This enables them to evolve attacks from simple malware infections to catastrophic data
breaches and network intrusions.

Primary Types of Privilege Escalation Attacks

There are two primary types of privilege escalation attacks that threat actors use: vertical and
horizontal. While both types involve attackers attempting to gain unauthorized access to
resources or perform malicious actions, how the attack is carried out can involve different
approaches.

Vertical Privilege Escalation

An attacker can use vertical privilege escalation to gain access from a standard user account
to higher-level privileges, such as superuser or administrator, thereby granting them
unrestricted control over the entire system. Oftentimes, this gives them full control over the
system, allowing them to modify configurations, install software, create new user accounts
with escalated privileges or even delete essential data.

Horizontal Privilege Escalation

Horizontal privilege escalation occurs when an attacker gains access at the same permission
level but under different user identities. For example, when an attacker uses an employee's
stolen credentials, this is horizontal privilege escalation. The goal here isn't necessarily to
gain root privileges. Instead, the goal is to access sensitive information that belongs to other
users within the same privilege level.

The key difference between these two types of attack lies in the kind of access the attacker
seeks. With vertical escalation, an attacker takes advantage of vulnerabilities for elevated
permissions. In contrast, with horizontal escalation the attacker exploits weak security
practices among peers at similar permission levels.

Detecting both types of privilege escalation requires vigilance and robust cybersecurity
measures. These measures include using security monitoring systems that detect unusual
activity and implementing robust authentication methods. Organizations must be aware of the
mechanisms behind these assaults and how they’re carried out to ensure they are adequately
shielded from potential threats.

How Does Privilege Escalation Work?

Attackers often gain access to a system by finding weak points in an organization's cybersecurity
framework. Once the initial infiltration is successful, threat actors use specific vertical or horizontal
privilege escalation strategies:
●​ Vertical. Attackers exploit vulnerabilities within the system or software applications to
escalate their privileges from a basic user account up to privileged user levels, such as those
held by system administrators. In these attacks, threat actors may also use social engineering
techniques like phishing emails to trick users into granting access inadvertently or revealing
sensitive information.
●​ Horizontal. In these attacks, threat actors focus on lateral movement across peer-level
accounts. Oftentimes, they involve tactics like credential theft and session hijacking.
Attackers may even inject a malicious payload into software applications that users with
similar permission levels frequently use.
Whether conducted vertically or horizontally, privilege escalation commonly works by exploiting
misconfiguration in networks and systems. This includes tapping into vulnerabilities like failure to
configure authentication for sensitive systems, administrative mistakes in firewall configuration, or
specific design flaws or oversights in operating systems or web applications.
Privilege escalation attacks can be carried out locally or remotely. Local privilege escalation attacks
begin on-premises, typically by someone inside the organization. Remote escalation, which is
increasingly more pervasive, can start from almost anywhere.
Preventing Privilege Escalation Attacks
In cybersecurity, effective cyber attack prevention is always better than having a sound disaster
recovery plan. Here are some of the most fundamental measures used to prevent privilege escalation
attacks:
●​ Regular system patching. It’s important to have a patch management strategy. Maintaining
systems with the most current patches can reduce the chance of threat actors using known
security flaws in software programs or operating systems for their attacks.
●​ Strong authentication methods. Implement two-factor authentication (2FA) or multifactor
authentication (MFA) to deter credential theft and make it harder for malicious actors to gain
unauthorized access.
●​ User activity monitoring. Monitor user activity for suspicious behavior that could indicate a
privileged account has been compromised. Detecting privilege escalation involves watching
for sudden changes in user behavior patterns or unusual system administrator activities.
●​ Strong password security policies. Make sure to have password policies that require users to
create secure, complex passwords that are updated regularly. This is especially useful in large
organizations.
●​ The least privilege principle. Apply the principle of least privilege by limiting users'
permissions to only what is necessary for their role. This reduces potential damage if an
attacker compromises a user’s account.
●​ Sudo access control. In Linux environments, controlling sudo access can help prevent Linux
privilege escalation incidents. Proper administration of sudo rights, including regularly
reviewing who has them and what commands they're allowed to execute with elevated
permissions, helps keep this threat at bay.
Privilege escalation attacks can be better prevented using a strategic combination of sound
cybersecurity practices and tools. Organizations should ensure that their security measures are robust
and regularly updated to prevent these types of cyberattacks.
How to Detect Privilege Escalation Attacks
Preventing unauthorized access and maintaining system security hinges on effective detection
capabilities. There are several ways organizations can detect privilege escalation attacks, including:
●​ Audit system logs. Review system logs regularly to spot unusual patterns or suspicious
activity, such as repeatedly failed login attempts or abnormal command usage.
●​ Anomaly detection tools. Identify deviations from normal behavior within your network
using anomaly detection tools. For instance, sudden changes in user roles could indicate an
ongoing privilege escalation incident.
●​ User and entity behavior analytics (UEBA). UEBA can identify potential privilege
escalation attempts using machine learning algorithms to understand typical user behavior
patterns. It can then send an alert when there's a deviation from the norm.
●​ Password monitoring. Implement password monitoring to alert you when passwords are
changed without authorization, which can indicate an attacker is trying to maintain their
escalated privileges over time.
●​ Intrusion detection systems (IDS). IDC can scan for known signatures of common privilege
escalation techniques like buffer overflow exploits or SQL injection attacks. As a result, they
can detect incidents early before significant damage occurs.
Remember, no single method will catch every possible attack vector. Organizations need to have
robust defenses and proactive detection measures in place that use a combination of strategies.
Common Examples of Privilege Escalation Attack Vectors
Privilege escalation is a technique where a cyber attacker compromises a system to gain unauthorized
access. This malicious activity can occur through various attack vectors, such as stolen credentials,
misconfigurations, malware or social engineering.
Malware
Attackers often use malware payloads to attempt privilege elevation on targeted systems. This type of
attack typically starts with gaining basic level access before deploying the malicious payload that
escalates their authority within the system.
Credential Exploitation
An attacker often attempts privilege escalation by taking advantage of weak user accounts or stealing
credentials. Once they have credentials in hand, they can perform malicious actions under the guise of
a privileged user.
Vulnerabilities and Exploits
A common method used in Linux and Windows privilege escalation involves exploiting software
vulnerabilities. For instance, if an application doesn't adhere to the principle of least privilege, it may
allow for vertical privilege escalation where an attacker gains root or administrator privileges.
Misconfigurations
Sometimes system administrators inadvertently create opportunities for horizontal privilege escalation
due to misconfiguration errors. These could include granting sudo access unnecessarily or not
properly securing privileged account information.
Social Engineering
This method relies heavily on human interaction rather than technical flaws. A typical scenario might
involve tricking employees into revealing their login details, allowing attackers easy entry into secure
networks. Detecting social engineering attacks requires human-centric vigilance. Luckily, tools are
also available that can specifically detect incidents which may involve escalated privileges.
Privilege Escalation Attacks by Operating Systems
Privilege escalation attacks can also be specific to operating systems, specifically Linux and
Windows.
Linux Privilege Escalation
The open-source nature of Linux makes it susceptible to certain types of privilege escalation attacks,
including:
●​ Kernel exploitation. A common method in which attackers take advantage of vulnerabilities
in the Linux kernel to gain root privileges. By exploiting these weaknesses, they can execute
malicious payloads that enable them to escalate privileges.
●​ Enumeration. Threat actors gather information about the system, such as user accounts or
network resources, that could be exploited for further attacks.
●​ SUDO right exploitation. Attackers often take advantage of poorly configured sudo rights. If
a privileged user has been careless with their sudo access permissions, an attacker may be
able to use this oversight for their own ends.

Windows Privilege Escalation

Windows faces its share of privilege escalation incidents primarily because so many enterprises rely
on it for business operations. Here are some commonly used methods:
●​ Access token manipulation. This technique involves manipulating tokens associated with
privileged accounts to trick the system into granting higher-level access than intended.
●​ Bypass user account control (UAC). An attacker might try bypassing UAC warnings
designed to prevent unauthorized changes by using stealthy processes that don't trigger these
alerts.
●​ Sticky keys. This attack replaces sethc(.exe) (the application responsible for sticky keys) with
cmd(.exe) (command prompt). This allows anyone pressing the “shift” key five times at the
login screen to gain administrator privileges without needing credentials.
 Detecting privilege escalation requires sophisticated security measures. While the prevention and
detection solutions above provide a baseline, organizations often need additional support to keep their
systems fully protected.