CompTIA Security+ Study Guide (SY0-401) Chapter 9: Malware, Vulnerabilities, and Threats

Chapter 9: Malware, Vulnerabilities, and Threats Explain types of malware Summarize various types of attacks Explain types of application attacks Given a scenario, use appropriate tools and techniques to discover security threats and vulnerabilities Explain the importance of application security controls and techniques

Understanding Malware Spyware Adware Rootkits Trojan Horses Logic Bombs Backdoors Botnets Ransomware

Malicious Code – refers to a broad category of software threats to your network and systems, including viruses, Trojan horses, logic bombs, and worms. Viruses – a piece of software designed to infect a computer system. – a virus, in most cases, tries to accomplish one of two things: render your system inoperable or spread to other systems.

Classifications of Viruses P olymorphic—those that change form in order to avoid detection Stealth—those that attempt to avoid detection by masking themselves from applications Retroviruses—attacks or bypasses the antivirus software installed on a computer Multipartite—attacks your system in multiple ways Armored—one that is designed to make itself difficult to detect or analyze Companion—attaches itself to legitimate programs and then creates a program with a different filename extension Phage—one that modifies and alters other programs and databases Macro viruses—those that exploit the enhancements made to many application programs, which are used by programmers to expand the capability of applications

Chapter 9: Malware, Vulnerabilities, and Threats Spam – defined as any unwanted, unsolicited , and not only can the sheer volume of it be irritating, but it can also often open the door to larger problems. Antivirus Software: Antivirus software is an application that is installed on a system to protect it and to scan for viruses as well as worms and Trojan horses.

Common Attacks DoS and DDoS Attacks Spoofing Attacks Pharming Attacks Phishing, Spear Phishing, and Vishing Attacks Xmas Attacks Man-in-the-Middle Attacks Replay Attacks Smurf Attacks

Password Attacks Brute-Force Dictionary Hybrid Birthday Rainbow Table

Other Types of Attacks Malicious Insider Threats Transitive Access Client-Side Attacks Typo Squatting and URL Hijacking Watering Hole Attack

Application Attacks Cross-Site Scripting and Forgery SQL Injection LDAP Injection XML Injection Directory Traversal/Command Injection Buffer Overflow Integer Overflow Zero-Day Exploits

Application Attacks (cont.) Cookies and Attachments Locally Shared Objects/Flash Cookies Malicious Add-ons Session Hijacking Header Manipulation Arbitrary code and Remote Code Execution

Five Tasks for Finding Threats Passively testing security controls Interpreting results Identifying vulnerability Identifying lack of security controls Identifying common misconfigurations

Security Tools Vulnerability Scanners Honeypots and Honeynets Port Scanner Banner Grabbing

Risk Calculations/Assessment Types Baseline Reporting Code Review Determine Attack Surface Architecture Design Review