Cyberstudy
PDF p.360 In progress

Application Attacks

Open PDF at p.360 15 flashcards

Summary

PDF p.360

Application attacks exploit vulnerabilities in operating systems or application software. These attacks can compromise network hosts or web applications, leading to unauthorized access, data theft, or further network penetration.

Detailed explanation

PDF p.360
  • Types of Application Attacks
    • Compromising OS or Third-Party Apps
      • Methods: Exploiting Trojans, malicious attachments, browser vulnerabilities.
      • Objective: Obtain a foothold on a local network.
    • Compromising Web Applications
      • Methods: Exploiting vulnerabilities in websites or web applications.
      • Objective: Gain control of a web host, steal data, or penetrate further into the network.
  • Indicators of Application Attacks
    • Application Crashes and Errors: Increased numbers may indicate exploitation attempts.
    • System Logs: Errors recorded in system or application-specific logs.
    • Resource Utilization: Anomalous CPU, memory, storage, or network usage.
  • Privilege Escalation
    • Arbitrary Code Execution: Running unauthorized code on the system.
    • Types
      • Vertical Privilege Escalation: Accessing higher privileges (e.g., SYSTEM privileges).
      • Horizontal Privilege Escalation: Accessing another user's functionality or data.
    • Detection: Process logging, audit logs, incident response, and endpoint protection alerts.
  • Buffer Overflow
    • Definition: Exploiting a buffer to overwrite data and execute arbitrary code.
    • Common Vulnerability: Stack overflow, changing the return address.
    • Mitigations: Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP).
    • Indicators: Frequent process crashes and anomalies.

Important terms

taken from the text above
Application Crashes and Errors
Increased numbers may indicate exploitation attempts.
System Logs
Errors recorded in system or application-specific logs.
Resource Utilization
Anomalous CPU, memory, storage, or network usage.
Arbitrary Code Execution
Running unauthorized code on the system.
Vertical Privilege Escalation
Accessing higher privileges (e.g., SYSTEM privileges).
Horizontal Privilege Escalation
Accessing another user's functionality or data.
Buffer Overflow
Exploiting a buffer to overwrite data and execute arbitrary code.
Common Vulnerability
Stack overflow, changing the return address.
ASLR Address Space Layout Randomization DEP Data Execution Prevention

What I should remember

Key Points PDF p.360
  • Types of Application Attacks
    • OS/Third-Party Apps: Trojans, malicious attachments, browser vulnerabilities.
    • Web Applications: Exploiting web vulnerabilities.
  • Indicators
    • Crashes/Errors: Increased numbers.
    • Logs: System or application-specific.
    • Resource Utilization: Anomalous usage.
  • Privilege Escalation
    • Arbitrary Code Execution: Unauthorized code.
    • Vertical: Higher privileges.
    • Horizontal: Another user's data.
    • Detection: Logs, alerts.
  • Buffer Overflow
    • Exploitation: Overwriting data.
    • Common Vulnerability: Stack overflow.
    • Mitigations: ASLR, DEP.
    • Indicators: Process crashes.