CompTIA Security+ 501 CompTIA Security+ SY0-501 Instructor: Ron Woerner, CISSP, CISM CompTIA Security+ Domain 1 – Threats, Attacks and Vulnerabilities (21%) Cybrary Instructor: Ron Woerner 1 CompTIA Security+ 501 CompTIA Security+ Domain 1 – Threats, Attacks and Vulnerabilities 1.1 Given a scenario, analyze indicators of compromise and determine the type of malware 1.1 Analyze IOC and Type of Malware ● Viruses ● Adware ● Spyware ● Crypto-malware ● Bots ● Ransomware ● RAT ● Worm ● Logic bomb ● Trojan ● Backdoor ● Rootkit ● Keylogger Cybrary Instructor: Ron Woerner 2 CompTIA Security+ 501 Risk & Threat Definitions NIST Information Security Glossary | Cybrary Glossary ● Risk: NIST | Cybrary ● Threat: NIST | Cybrary ● Impact: NIST | Cybrary ● Vulnerability: NIST | Cybrary ● Exploit: NIST | Cybrary ● Risk Assessment: NIST | Cybrary ● Risk Management: NIST | Cybrary Malware attacks ● Delivery – How it gets to the target ● Propagation – How malware spreads ● Payload – What malware does once it’s there ● Indicators of Compromise (IoC) – An artifact observed on a network or in an operating system that with high confidence indicates a computer intrusion. Cybrary Instructor: Ron Woerner 3 CompTIA Security+ 501 Types of Malware ● Viruses ● Adware ● Crypto-malware ● Spyware ● Ransomware ● Bots ● Worm ● RAT ● Trojan ● Logic bomb ● Rootkit ● Backdoor ● Keylogger Viruses Definition: A program intended to damage a computer system. Types: ● Armored Virus: A virus that is protected in a way that makes disassembling it difficult. The difficulty makes it “armored” against antivirus programs that have trouble getting to, and understanding, its code. ● Companion virus: A virus that creates a new program that runs in the place of an expected program of the same name. ● Macro virus: A software exploitation virus that works by using the macro feature included in many applications, such as Microsoft Office. ● Multipartite virus: A virus that attacks a system in more than one way. Cybrary Instructor: Ron Woerner 4 CompTIA Security+ 501 Viruses Definition: A program intended to damage a computer system. Types: ● Phage virus: A virus that modifies and alters other programs and databases. ● Polymorphic virus: Viruses the changes form or mutates in order to avoid detection. ● Retrovirus: A virus that attacks or bypasses the antivirus software installed on a computer. ● Stealth virus: A virus that attempts to avoid detection by anti-virus software and from the operating system by remaining in memory. Crypto-malware & Ransomware ● Malware that uses cryptography as part of the attack ● Prevents users from accessing their system or personal files through encryption and demands ransom payment in order to regain access. ● Ransomware authors order that payment be sent via cryptocurrency, online payment systems, or credit card. ● Examples: CryptoLocker, WannaCry, Locky, zCrypt, NotPetya Cybrary Instructor: Ron Woerner 5 CompTIA Security+ 501 Rootkit ● A clandestine computer program designed to provide continued privileged access to a computer while actively hiding its presence. ● Software program that has the ability to obtain administrator or root-level access and hide from the operating system. ● Examples: NTRootkit, Zeus, Stuxnet, Knark, Adore Trojan / Trojan Horse ● A harmful piece of software that looks legitimate or is included with legitimate applications. ● Any application that masquerades as one thing in order to get past scrutiny and then does something malicious. ○ One of the major differences between Trojan horses and viruses is that Trojan horses tend not to replicate themselves ● Examples: BackOrifice, Stuxnet, Zeus Cybrary Instructor: Ron Woerner 6 CompTIA Security+ 501 Worms ● Use the network to replicate copies of themselves to systems or devices automatically and without user intervention. ● To spread, worms either exploit a vulnerability on the target system or use social engineering to trick users into executing. ● A worm takes advantage of file-transport or information- transport features on the system, allowing it to travel unaided. Examples: ILoveYou, MyDoom, StormWorm, Anna Kournikova, Slammer Logic or Time bomb ● Any code that is hidden within an application and causes something unexpected to happen based on some criteria being met. For example: ○ A programmer could create a program that always makes sure her name appears on the payroll roster; if it doesn’t, then key files begin to be erased. ○ Backdoor is created during certain times Cybrary Instructor: Ron Woerner 7 CompTIA Security+ 501 Keylogger / Keystroke Loggers ● Software programs or hardware devices that track the activities from input devices ○ Keys pressed of a keyboard ○ Mouse clicks ○ Screen recorders or scrapers ● Keyloggers are a form of spyware where users are unaware their actions are being tracked ● Keylogger software typically stores your keystrokes in a small file, which is either accessed later or automatically emailed to the person monitoring your actions Bots / Botnets ● Bot : An automated software program (network robot) that collects information on the web. In its malicious form, a bot is a compromised computer being controlled remotely ● Bots are also known as “zombie computers” due to their ability to operate under remote direction without their owners’ knowledge. ● Botnet : A network of compromised computers under the control of a malicious actor. ● The attackers that control botnets are referred to as “bot herders” or “bot masters.” Cybrary Instructor: Ron Woerner 8 CompTIA Security+ 501 Backdoor ● An undocumented way of accessing a system, bypassing the normal authentication mechanisms. ● An opening left in a program application (usually by the developer) that allows additional access to systems or data. These should be closed when the system is moved to production. RATs (Remote Access Trojans or Remote Administration Tools) ● Software that remotely gives a person full control a tech device. ● Programs that provide the capability to allow covert surveillance or the ability to gain unauthorized access to a victim PC. ● Provide the capability for an attacker to gain unauthorized remote access to the victim machine via specially configured communication protocols or backdoors created upon infection ○ Often mimic similar behaviors of keylogger applications by allowing the automated collection of input data ● Examples: SubSeven, Back Orifice, ProRat, Turkojan, and Poison-Ivy Cybrary Instructor: Ron Woerner 9 CompTIA Security+ 501 Spyware / Adware ● Applications that covertly monitors online behavior without the user’s knowledge or permission. ● Collected data is relayed to outside parties, often for use in advertising ● Otherwise, does not harm the infected computer, user or data. ● There is a line between illegal spyware and legitimate data collection. Advanced Persistent Threat (APT) ● A set of stealthy and continuous computer hacking processes, often orchestrated by a person or persons targeting a specific entity. ● Usually targets either private organizations, states, or both for business or political motives. ● APT processes require a high degree of covertness over a long period of time. ○ The "advanced" process signifies sophisticated techniques using malware to exploit vulnerabilities in systems. ○ The "persistent" process suggests that an external command and control system is continuously monitoring and extracting data from a specific target. ○ The "threat" process indicates human involvement in orchestrating the attack Cybrary Instructor: Ron Woerner 10 CompTIA Security+ 501 Exam Preparation In your role as a security administrator, a user contacts you suspecting that his computer is infected. Yesterday he loaded a freeware program to help him perform a valid job function. What type of malicious software is most likely the cause of the infection? A. Rootkit B. Ransomware C. Trojan D. Worm Exam Preparation What type of malicious software is deliberately installed by an authorized user and sits dormant until some event invokes its malicious payload? A. Logic bomb B. Spyware C. Trojan horse D. Armored virus Cybrary Instructor: Ron Woerner 11 CompTIA Security+ 501 CompTIA Security+ Domain 1 – Threats, Attacks and Vulnerabilities 1.1 Given a scenario, analyze indicators of compromise and determine the type of malware Cybrary Instructor: Ron Woerner 12.