Answer to Question #273639 in Computer Networks for Jennifer

Question

Using the stages of an attack below , give two examples of what an attacker would do if the attacker is to achieve the attack

Stages to focus on

a. Reconnaissance

b. Weaponisation

c. Delivery

d. Exploitation

e. Installation

Answer 1

a.

A reconnaissance attack is the efforts of an threat actors to gain as much information about the network as possible before launching other more serious types of attacks.

Examples:

Passive reconnaissance: a hacker looks for information not related to victim domain. He just knows the registered domain to the target system so he can use commands (eg. Telephone directory) to fish information about the target

Active reconnaissance: a hacker uses system information to gain unauthorized access to protected digital or electronic materials, and may go around routers or even firewalls to get it.

b.

Hackers used hundreds of thousands of internet-connected devices that had previously been infected with a malicious code – known as a “botnet” – to force an especially potent distributed denial of service (DDoS) attack.

Examples:

Botnet A network of computers forced to work together on the command of an unauthorized remote user. This network of robot computers is used to attack other systems.

DDOS Distributed Denial of Service attacks is where a computer system or network is flooded with data traffic, so much that the system can’t handle the volume of requests and the system or network shuts down.

c.

Attacker sends malicious payload to the victim by means such as email, which is only one of the numerous intrusion methods the attacker can use.

Examples:

Adversary-controlled delivery, which involves direct hacking into an open port

Adversary-released delivery, which conveys the malware to the target through phishing

d.

Once attackers have identified a vulnerability in your system, they exploit the weakness and carry out their attack. During the exploitation phase of the attack, the host machine is compromised by the attacker.

Examples:

Install malware (a dropper) allowing attacker command execution.

Install malware (a downloader) and download additional malware from the Internet, allowing attacker command execution

e)

Installation of either a web shell on a compromised web server or a backdoor implant on a compromised computer system enables adversaries to bypass security controls and maintain access in the victim’s environment. 

Examples:

ransomware, ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable

remote-access Trojans