Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
vulnerabilities&atta
vulnerabilities & attacks
| Question | Answer |
|---|---|
| Hardware vulnerabilities | Security flaws or weaknesses, inherent in any devices physical components, or design that can be exploited to compromise the integrity, confidentiality, or availability of the system and its data |
| Firmware | Specialized form of software stored on hardware device like a router or a smart thermostat that provides low level control for the device of specific hardware |
| End of life systems | Referred to hardware or software products that have reached the end of their life cycle |
| Legacy systems | Outdated computing software, hardware, or technologies that have been largely superseded by newer and more efficient alternatives |
| Unsupported systems | Hardware or software products that no longer receive official technical support, security updates, or patches from their respective vendors or developers |
| Unpatched system | Device, application, or piece of software that has not been updated with the latest security patches so that it remains vulnerable to known exploits and attacks |
| Hardware misconfiguration | Occur occurs when a device settings, parameters or options are not optimally set up, and this can cause vulnerabilities to exist, a decrease in performance or unintended behavior of devices or systems |
| hardening | Involves tightening the security of a system |
| patching | Involves the regular updating of the software, firmware, and applications with the latest security patches |
| configuration enforcement | Used to ensure that all devices and systems adhere to a standard secure configuration |
| decommissioning | Means that the system is retired and removed from the network |
| isolation | Used to limit the potential damage that might occur from a potential security breach |
| segmentation | Used to divide the network into segments |
| Bluetooth | Wireless technology standard used for exchanging data between fixed and mobile devices over short distances without the need for an Internet connection |
| insecure device pairing | Occurs when Bluetooth devices establish a connection without proper authentication |
| Device spoofing | Occurs when an attacker impersonates a device to trick a user into connecting |
| on-path attack | Exploits Bluetooth protocol vulnerabilities to intercept and alter communications between devices without either party being aware |
| sideloading | The practice of installing applications on a device from unofficial sources, which actually bypasses the device's default App Store |
| Jailbreaking/rooting | Process that gives users escalated privileges on the devices and allows users to circumvent the built-in security measures provided by the devices |
| Mobile device management (MDM) solution | Used to conduct patching of the devices by pushing any necessary updates to the devices to ensure that they are always equipped with the latest security patches |
| zero day vulnerability | Any vulnerability that's discovered or exploited before the vendor can issue a patch for it |
| Zero day exploit | Any unknown exploit in the wild that exposes a previously unknown vulnerability in the software or hardware |
| unpatched systems | Operating systems that have not been updated with the latest security patches or fixes |
| misconfiguration | Occurs when the system settings are not properly configured, and this leaves the system vulnerable to exploitation |
| Data exfiltration | Unauthorized data transfers from within an organization to an external location |
| Malicious updates | Occurs when an attacker has been able to craft a malicious update to a well-known and trusted program in order to compromise the systems of the programs end users |
| code injection | The insertion of additional information or code through a data input form from a client to an application |
| extensible markup language (XML) | Used by web applications for authentication, authorization, and other types of data exchange |
| XML Bomb (Billion Laughs Attack) | XML encode entities that expand to exponential sizes, consuming memory on the host and potentially crashing it |
| XML external entity (XXE) | An attack that embeds a request for a local resource |
| cross-site scripting (XSS) | Inject a malicious script into a trusted site to compromise the sites visitors |
| Non-persistent XSS | This type of attack only occurs when it's launched and happens once |
| Persistent XSS | Allows an attacker to insert code into the backend database used by that trusted website |
| document object model (DOM) XSS | Exploits the client's web browser using client-side scripts to modify the content and layout of the webpage |
| Session management | Enables web applications to uniquely identify a user across several different actions and requests |
| cookie | Text file used to store information about a User when they visit a site |
| non-persistent | Known as a session cookie, which resides in memory and is used for a very short period of time |
| persistent | Stored in the browser cache until either deleted by User or expired |
| session hijacking | Type of spoofing attack where the attacker disconnects a host and then replaces it with his or her own machine by spoofing the original host IP |
| Session prediction | Type of spoofing attack where the attacker attempts to predict the session token in order to hijack the session |
| cross site request forgery (XSRF) | Malicious script is used to exploit a session started on another site within the same web browser |
| buffer overflow | Occurs when data exceeds are located memory, potentially enabling unauthorized access or code execution |
| buffer | A temporary storage area, where a program stores its data |
| Stack | A memory region where a program stores the return addresses from function calls |
| "Smashing the stack" | Occurs when an attacker can execute their malicious code by overwriting the return address |
| address space layout randomization (ASLR) | Security measure that randomizes memory addresses, making buffer overflow attacks harder for attackers |
| race condition | Software vulnerability where the outcome depends on the timing of events, not matching the developers intended order |
| dereferencing | A fundamental operation in programming, and the vulnerabilities arise from unsafe or concurrent usage, particularly in scenarios involving race conditions |
| dirty COW | Popular 2016 exploit, showcasing a race conditioned exploitation |
| COW | copy on write |
| Time-of-check (TOC) | Type of race condition where an attacker can alter a system resource after an application checks it state but before the operation is performed |
| Time-of-use (TOU) | Type of race condition that occurs when an attacker can change the state of a system resource between the time it is checked and the time it is used |
| Time-of-evolution (TOE) | Type of race condition that involves the manipulation of data or resources during the time window when a system is making a decision or evaluation |
| Mutex | Mutually exclusive flag that act a gatekeeper to a section of code so that only one thread can be processed at a time |
| Deadlock | Occurs when two or more processes are unable to proceed because each is waiting for the other to release a resource |
Created by:
user-2044395