CompTIA Sec+ SY0-701 Cyber Attacks

Ransomware:
Description: Ransomware encrypts files or locks users out of their systems, demanding payment (usually in cryptocurrency) for decryption or access restoration. Scenario: A user downloads a file from an email attachment that appears to be a legitimate invoice. Unbeknownst to them, the attachment contains ransomware, which quickly encrypts files across their system, demanding payment for decryption keys.

Trojan Horse:
Description: Trojans masquerade as legitimate software or files to deceive users into executing them, allowing attackers to gain unauthorized access, steal data, or install additional malware. Scenario: A user downloads a seemingly innocuous software update from a third-party website, unaware that it contains a Trojan horse designed to steal sensitive login credentials stored on their system.

Spyware:
Description: Spyware secretly monitors users' activities, collects personal information, and relays it to third parties without consent, compromising privacy and security. Scenario: A user unknowingly installs a free software application bundled with spyware onto their device. The spyware tracks their web browsing habits, captures login credentials, and sends the data to a remote server controlled by attackers.

Worms:
Description: Worms are self-replicating malware that spread across networks by exploiting vulnerabilities, consuming system resources, and often carrying payloads for further malicious activities. Scenario: A vulnerable server connected to a corporate network is infected with a worm that exploits a known software vulnerability. The worm rapidly propagates across the network, disrupting services and

Adware:
Description: Adware displays unwanted advertisements, pop-ups, or redirects on users' devices, often disrupting user experience and compromising system performance. Scenario: A user downloads a free game application from an unofficial app store. Unbeknownst to them, the application contains adware that bombards the device with intrusive advertisements, slowing down system performance.

Rootkits:
Description: Rootkits are stealthy malware that conceals malicious processes or files within the operating system, enabling unauthorized access, data theft, and system manipulation. Scenario: An attacker exploits a known vulnerability to install a rootkit on a server hosting critical business applications. The rootkit conceals its presence, allowing the attacker to maintain persistent access and exfiltrate sensitive data without detection.

Botnets:
Description: Botnets are networks of compromised devices, or "bots," controlled by attackers to carry out malicious activities such as distributed denial-of-service (DDoS) attacks, spam email campaigns, and information theft. Scenario: A group of internet-connected IoT devices, including smart cameras and routers, is infected with botnet malware. The devices are remotely controlled by attackers to launch a coordinated DDoS attack against a targeted website, causing service disruption.

Cryptojacking:
Description: Cryptojacking involves using malware to hijack computing resources, such as CPU and GPU cycles, to mine cryptocurrency without the user's consent or knowledge. Scenario: A user visits a compromised website that secretly runs JavaScript code in the background, exploiting the device's processing power to mine cryptocurrency without the user's permission, causing system slowdowns.

Fileless Malware:
Description: Fileless malware resides in memory or uses legitimate system processes to execute malicious commands, making it difficult to detect using traditional antivirus solutions and bypassing file-based security measures. Scenario: An unsuspecting user clicks on a malicious link in a phishing email, triggering the execution of fileless malware that exploits a vulnerability in the web browser. The malware executes in memory, evading detection by traditional antivirus software and stealing sensitive information.

Mobile Malware:
Description: Mobile malware targets smartphones and tablets, compromising device security, stealing sensitive information, and performing unauthorized activities such as premium SMS fraud or banking credential theft. Scenario: A user downloads a seemingly harmless mobile game from a third-party app store. Unbeknownst to them, the game contains malware that exploits device vulnerabilities to steal personal information and send premium-rate SMS messages.

Scareware:
Description: Scareware is malicious software that masquerades as legitimate security software, often displaying alarming messages or pop-ups to trick users into purchasing fake security solutions or providing personal information. Scenario: A user encounters a pop-up message claiming their computer is infected with viruses and prompts them to download a fake antivirus program. Believing the message to be genuine, the user installs the scareware, which further compromises their system.

Backdoors:
Description: Backdoors are hidden entry points in software or systems that allow unauthorized access to the system, bypassing normal authentication mechanisms. They are often used by attackers to maintain persistent access to compromised systems. Scenario: An attacker exploits a known vulnerability in a web server to install a backdoor that allows remote access to the system. The backdoor enables the attacker to upload and execute malicious code, steal sensitive data, and manipulate system settings.

Exploit Kits:
Description: Exploit kits are prepackaged bundles of malicious code designed to automate the exploitation of vulnerabilities in software, web browsers, and plugins. They are often distributed through compromised websites or malicious links. Scenario: A user visits a compromised website hosting an exploit kit. The kit scans the user's system for known vulnerabilities and delivers a payload tailored to exploit the detected weaknesses, leading to the installation of malware or remote access tools.

Email Phishing Attacks:
Description: Email phishing involves sending fraudulent emails that appear to be from legitimate sources, such as banks, social media platforms, or government agencies, with the intention of tricking recipients into revealing sensitive information or clicking on malicious links. Scenario: An employee receives an email purportedly from their company's IT department, requesting them to reset their account password by clicking on a link provided in the email. The link leads to a phishing website designed to steal the user's login credentials.

Spear Phishing Attacks:
Description: Spear phishing attacks are targeted phishing campaigns that tailor messages to specific individuals or organizations, often using personal information obtained from social media or other sources to increase credibility. Scenario: A senior executive receives an email purportedly from a trusted business partner, requesting urgent payment for an invoice. The email contains accurate details about the company's ongoing projects, making it appear legitimate. However, the request is fraudulent, and the payment would go to the attacker's account.

Vishing (Voice Phishing) Attacks:
Description: Vishing attacks involve using voice communication, such as phone calls or voicemail messages, to trick individuals into divulging sensitive information or performing specific actions. Scenario: A user receives a phone call from someone claiming to be from their bank's fraud department, informing them of suspicious activity on their account. The caller asks the user to verify their account details, including their account number and PIN, to resolve the issue. Unaware of the scam, the user provides the requested information, which the attacker then uses to access their bank account.

Smishing (SMS Phishing):
Description: Smishing involves sending deceptive text messages to individuals, typically containing links to malicious websites or instructions to call a fraudulent phone number. Scenario: A user receives a text message claiming to be from a delivery service, notifying them of a package delivery failure and instructing them to click on a link to reschedule delivery. The link leads to a phishing website designed to steal the user's personal information.

Whaling Attacks:
Description: Whaling attacks target high-profile individuals within organizations, such as executives or senior managers, with the goal of obtaining sensitive information or gaining unauthorized access to corporate systems. Scenario: The CEO of a company receives an email purportedly from the company's legal department, requesting urgent access to confidential financial documents for a pending lawsuit. The email contains a malicious attachment that, when opened, installs malware on the CEO's computer.

Email Spoofing:
Description: Email spoofing involves forging the sender's email address to impersonate a legitimate user or organization, often used in phishing and malware distribution campaigns. Scenario: An attacker sends an email to employees posing as the CEO, requesting urgent wire transfers to a fraudulent account. The email appears legitimate, causing employees to unknowingly transfer funds to the attacker.

DNS Spoofing (DNS Cache Poisoning):
Description: DNS spoofing involves corrupting or poisoning the DNS cache to redirect users to malicious websites or servers controlled by the attacker. Scenario: An attacker manipulates DNS records to redirect users attempting to access a legitimate banking website to a fake site controlled by the attacker, harvesting login credentials and financial information.

ARP Spoofing (Man-in-the-Middle):
Description: ARP spoofing involves manipulating Address Resolution Protocol (ARP) messages to associate the attacker's MAC address with the IP address of a legitimate device on the network, enabling interception and modification of network traffic. Scenario: An attacker performs ARP spoofing to intercept and eavesdrop on communications between a client device and a web server, capturing sensitive information such as login credentials and financial data.

GPS Spoofing:
Description: GPS spoofing involves manipulating GPS signals to deceive GPS receivers and devices, leading to inaccurate location information or navigation instructions. Scenario: An attacker broadcasts spoofed GPS signals near a shipping port, causing GPS-guided cargo ships to deviate from their intended routes and potentially leading to collisions or cargo theft.

IP Spoofing:
Description: IP spoofing involves forging the source IP address of packets to hide the identity of the sender or to impersonate another system. Scenario: An attacker spoofs the IP address of a trusted server to launch a distributed denial-of-service (DDoS) attack against a target, flooding it with a high volume of malicious traffic.

Credential Stuffing:
Description: Credential stuffing attacks involve using stolen username and password combinations obtained from previous data breaches to gain unauthorized access to other accounts. Scenario: An attacker obtains a list of username and password pairs from a data breach at one online service and attempts to use the same credentials to gain access to users' accounts on other platforms.

Man-in-the-Browser (MitB) Attacks:

Description: MitB attacks involve malware installed on a user's browser that intercepts and manipulates communication between the user and websites, allowing attackers to steal sensitive information such as login credentials or financial data.

Scenario: A user unknowingly installs a malicious browser extension that captures their online banking credentials and sends them to an attacker-controlled server, allowing the attacker to access their bank account and make unauthorized transactions.

Brute Force Attacks:

Description: Brute force attacks involve systematically trying every possible combination of usernames and passwords until the correct one is found, allowing the attacker to gain unauthorized access.

Scenario: An attacker uses automated tools to repeatedly attempt to log in to an online banking portal using various combinations of usernames and passwords until they successfully guess a user's credentials.

Pass-the-Hash Attacks:

Description: Pass-the-hash attacks involve capturing hashed passwords from compromised systems and using them to authenticate to other systems within the same network.

Scenario: An attacker gains access to a system administrator's account on a compromised server and extracts the hashed password. They then use this hash to authenticate to other servers within the same network without needing to know the plaintext password.

Password Spraying Attacks:

Description: Password spraying attacks involve attempting a few commonly used passwords against a large number of user accounts, aiming to evade account lockout mechanisms and gain unauthorized access.

Scenario: An attacker uses a list of commonly used passwords to attempt login across multiple user accounts in an organization, aiming to find accounts with weak passwords that can be exploited for unauthorized access.

Keylogging Attacks:

Description: Keylogging attacks involve malware installed on a user's device that records keystrokes, allowing attackers to capture sensitive information such as usernames, passwords, and credit card numbers.

Scenario: An attacker infects a user's computer with keylogging malware through a malicious email attachment. The malware silently records the user's keystrokes, allowing the attacker to capture their login credentials and other sensitive information.

Man-in-the-Cloud (MitC) Attacks:

Description: Man-in-the-Cloud attacks involve compromising cloud storage accounts (e.g., Dropbox, Google Drive) by stealing authentication tokens or session cookies, allowing attackers to access and manipulate files stored in the cloud.

Scenario: An attacker gains access to a user's cloud storage account by stealing their session cookie through a compromised session. The attacker then downloads sensitive documents and manipulates files stored in the cloud without the user's knowledge.

Directory Traversal Attacks:

Description: Directory traversal attacks involve exploiting vulnerabilities in web applications to gain unauthorized access to files and directories stored on the server.

Scenario: An attacker manipulates a URL parameter in a web application to traverse directories and access sensitive configuration files containing database credentials and other confidential information.

Kerberoasting:

Description:
Kerberoasting is a method used by attackers to exploit weak or poorly configured service accounts in Active Directory environments. It involves extracting encrypted Kerberos tickets for service accounts with weak passwords and offline brute-forcing to crack the passwords and gain unauthorized access to sensitive resources.

Scenario:
An attacker gains access to a compromised workstation within an organization's network. Using various reconnaissance techniques, they identify service accounts with weak or poorly configured passwords. The attacker then extracts Kerberos tickets associated with these service accounts using tools like Rubeus or Mimikatz. With the stolen tickets, they proceed to perform offline brute-force attacks to crack the passwords. Once successful, the attacker can use the compromised service accounts to access sensitive resources and escalate privileges within the network.

Man-in-the-Middle (MitM) Attack:

Description:
A Man-in-the-Middle (MitM) attack is a form of cyber attack where an attacker intercepts and potentially alters communication between two parties who believe they are communicating directly with each other. In a MitM attack, the attacker secretly relays and possibly modifies the communication between the two parties, allowing them to eavesdrop on sensitive information, steal data, or inject malicious content.

Scenario:
Bob is trying to log in to his online banking account using his laptop at a coffee shop with free Wi-Fi. An attacker, Eve, is also connected to the same Wi-Fi network and secretly intercepts the communication between Bob's laptop and the bank's server. When Bob enters his login credentials, Eve captures the information before it reaches the bank's server. Eve can now use Bob's credentials to log in to his bank account and perform unauthorized transactions.

Silver Ticket Attack:

In a Silver Ticket attack, the attacker obtains the service account's NTLM hash (usually from memory or a compromised system) and uses it to generate a forged Ticket Granting Ticket (TGT) for a specific service, granting unauthorized access to that service without needing the account's actual password.

The attacker crafts the TGT with the service's Service Principal Name (SPN) and the forged NTLM hash, allowing them to authenticate to the service using the compromised ticket.

Scenario: An attacker gains access to a domain controller using a combination of social engineering and malware. Once inside, the attacker extracts the NTLM hash of a service account used for accessing a critical database server. With the extracted hash, the attacker crafts a forged Ticket Granting Ticket (TGT) for the database service and inserts it into the domain controller's memory.

The attacker then uses the forged TGT to authenticate to the database server, bypassing normal authentication mechanisms. From there, they can access sensitive data stored in the database, manipulate records, or carry out other malicious activities without needing the actual password of the service account.

Gold Ticket Attack:

Description: A Gold Ticket attack is a type of Kerberos authentication attack where an attacker creates a forged Ticket Granting Ticket (TGT) using the Key Distribution Center's (KDC) long-term encryption key. This forged TGT grants the attacker unrestricted access to any service in the domain.

Scenario: An attacker gains access to a domain controller and extracts the KDC's long-term encryption key. Using this key, the attacker forges a TGT granting them unrestricted access to all services within the domain.

Credential Harvesting:

Description: Credential harvesting involves the systematic gathering of usernames, passwords, or other authentication credentials through various means such as phishing emails, fake login pages, or malware.

Scenario: An attacker sends phishing emails to employees, directing them to a fake login page that mimics the company's email portal. Unsuspecting users enter their credentials, which are captured by the attacker for unauthorized access.

Credential Stuffing:

Description: Credential stuffing is a type of cyber attack where attackers use lists of username and password combinations obtained from previous data breaches to gain unauthorized access to user accounts on other platforms or services.

Scenario: An attacker obtains a list of username and password combinations leaked from a previous data breach and systematically attempts to log in to various online accounts using automated tools.

Password Spraying:

Description: Password spraying is a type of brute force attack where attackers attempt to gain unauthorized access to multiple accounts by trying a few commonly used passwords against a large number of usernames.

Scenario: An attacker attempts to gain access to a company's network by trying common passwords such as "password123" or "123456" against a list of employee usernames.

Downgrade Attacks:

Description: Downgrade attacks exploit vulnerabilities in cryptographic protocols or security mechanisms to force communication between systems to use less secure versions, allowing attackers to intercept or manipulate data.

Scenario: An attacker intercepts communication between a client and a server and downgrades the TLS protocol version from TLS 1.2 to SSL 3.0, which is vulnerable to known cryptographic attacks, allowing the attacker to eavesdrop on sensitive information transmitted between the client and server.

Domain Spoofing:

Description: In domain spoofing attacks, attackers typically manipulate the "From" field in email headers to display an address that resembles that of a reputable organization, such as a bank, government agency, or well-known company. By impersonating a trusted sender, attackers attempt to deceive recipients into believing that the email is legitimate and thus increase the likelihood of successful phishing.

Scenario:
Imagine a scenario in which employees at a financial institution receive emails purportedly originating from the organization's IT department. The emails claim that due to a recent security breach, employees must reset their account passwords immediately by clicking on a provided link. The sender's email address appears legitimate, resembling that of the organization's IT department.
However, upon closer inspection, the emails exhibit several signs of domain spoofing, including inconsistencies in the sender's domain name and irregularities in the email headers. Unaware of the phishing attempt, some employees proceed to click on the provided link and unwittingly divulge their account credentials to the attackers.

Denial of Service (DoS) Attacks:

Distributed Denial of Service (DDoS) Attacks:

Description: DDoS attacks involve multiple compromised systems, often distributed across the internet, coordinating to flood a target system or network with an overwhelming volume of traffic, rendering it inaccessible to legitimate users.

Scenario: An online retailer's website becomes the target of a DDoS attack during a major holiday sale. The attackers flood the website with a massive volume of traffic, causing it to become unresponsive and preventing legitimate customers from accessing the site to make purchases.

Command Injection:

Description: Command injection involves injecting malicious commands into input fields or parameters of an application, which are then executed by the underlying operating system.

Scenario: An attacker submits a specially crafted command containing system commands (e.g., shell commands) into a form field of a web application. The application fails to properly validate and sanitize the input, allowing the attacker to execute arbitrary commands on the underlying server.

Cross-Site Scripting (XSS):

Description: Cross-Site Scripting involves injecting malicious scripts, typically JavaScript, into web pages viewed by other users. This can lead to session hijacking, data theft, or unauthorized actions.

Scenario: An attacker embeds a malicious script into a comment field on a website. When other users view the comment, the script executes in their browsers, allowing the attacker to steal their session cookies and hijack their sessions.