Cybersecurity Threats, Vulnerabilities, and Attacks Syllabus

What does a keylogger do?

A keylogger records (logs) the keystrokes a user types — capturing passwords, messages, and other sensitive input — and can be software-based or a physical hardware device inserted between keyboard and computer.

How does adware differ from spyware?

Adware automatically displays or downloads unwanted advertisements (pop-ups, redirects) to generate revenue, often bundled with free software. Spyware focuses on covertly stealing information. Adware may include spyware components but is primarily ad-driven.

What is fileless malware and why is it hard to detect?

Fileless malware operates in memory (RAM) and leverages legitimate, trusted system tools (e.g., PowerShell, WMI — 'living off the land') rather than writing malicious files to disk. It evades traditional signature-based, file-scanning antivirus because there is no file to scan.

Define a logic bomb.

A logic bomb is malicious code inserted into a system that lies dormant until triggered by a specific condition — a date/time, a particular event, or a user action (e.g., an employee's account being deleted) — at which point it executes its payload.

What is phishing?

Phishing is a social engineering attack, usually via mass email, that impersonates a trusted entity to trick recipients into revealing credentials, clicking malicious links, or opening malicious attachments.

How does spear phishing differ from ordinary phishing?

Spear phishing is targeted at a specific individual or organization and is personalized using researched details about the victim, making it more convincing than broad, generic mass phishing.

What is whaling?

Whaling is a form of spear phishing that specifically targets high-value, senior executives or important individuals (the 'big fish' — CEO, CFO), often to authorize fraudulent wire transfers or disclose sensitive data.

Define pretexting in social engineering.

Pretexting is creating a fabricated scenario or invented backstory (a pretext) to establish false legitimacy and manipulate a victim into divulging information or performing an action — e.g., posing as IT support or a bank investigator.

What is baiting as a social engineering technique?

Baiting lures victims using the promise of something enticing — such as leaving malware-infected USB drives in public places, or offering free downloads/media — so the victim's curiosity or greed leads them to compromise their own system.

What is vishing?

Vishing (voice phishing) is social engineering conducted over voice calls (telephone or VoIP), where the attacker impersonates a trusted party to extract sensitive information or prompt an action.

What is smishing?

Smishing (SMS phishing) is phishing carried out via SMS text messages, typically containing malicious links or urgent requests designed to trick the recipient into revealing information or installing malware.

Name Cialdini's principles of influence commonly exploited in social engineering.

Authority, Intimidation, (Social) Consensus/Proof, Scarcity, Urgency, Familiarity/Liking, and Trust. Attackers exploit these psychological triggers to bypass rational judgment.

How do 'scarcity' and 'urgency' principles manipulate a victim?

Scarcity implies a limited supply or fleeting opportunity ('only 3 left'), and urgency imposes a tight deadline ('act now or lose access'). Both pressure the victim into acting quickly without careful verification.

What is an injection attack, in general terms?

An injection attack occurs when an attacker supplies untrusted input that is interpreted as part of a command or query by an application, causing unintended execution — arising from a lack of input validation/sanitization.

What is SQL injection (SQLi) and its primary root cause?

SQL injection inserts malicious SQL statements into an application's input fields to manipulate the backend database (read, modify, or delete data, or bypass authentication). Root cause: unsanitized user input concatenated directly into SQL queries; mitigated by parameterized queries/prepared statements.

Give a classic SQL injection payload that bypasses login authentication and explain it.

Entering ' OR '1'='1 into a login field. It turns the WHERE clause into a condition that is always true (1=1), so the query returns a valid row and authentication is bypassed.

What is Cross-Site Scripting (XSS)?

XSS is an injection attack that injects malicious client-side scripts (typically JavaScript) into web pages viewed by other users. When their browsers execute the script, it can steal session cookies, hijack sessions, or deface content.

Compare stored, reflected, and DOM-based XSS.

Stored (persistent) XSS: the malicious script is permanently saved on the server (e.g., in a comment) and served to every visitor. Reflected XSS: the script is embedded in a request (e.g., a crafted URL) and immediately echoed back in the response to that single victim. DOM-based XSS: the vulnerability is in client-side JavaScript that manipulates the DOM using untrusted data, never reaching the server.

What is Cross-Site Request Forgery (CSRF/XSRF)?

CSRF tricks an authenticated user's browser into unknowingly sending a forged, unwanted request to a web application in which they are logged in, causing state-changing actions (e.g., transferring funds, changing email) using the victim's active session/credentials.

What is the primary defense against CSRF attacks?

Anti-CSRF tokens: unique, unpredictable per-session/per-request tokens the server validates. Additional defenses include SameSite cookie attributes, checking the Origin/Referer header, and requiring re-authentication for sensitive actions.

Contrast XSS and CSRF at a high level.

XSS exploits the trust a user's browser has in a website (injecting scripts that run in the victim's session). CSRF exploits the trust a website has in the user's browser (forcing the browser to submit authenticated requests). XSS can be used to defeat CSRF protections.

What is a buffer overflow?

A buffer overflow occurs when a program writes more data to a fixed-length memory buffer than it can hold, overwriting adjacent memory. This can corrupt data, crash the program, or allow attackers to overwrite the return address and execute arbitrary injected code.

Distinguish a stack overflow from a heap overflow.

A stack-based buffer overflow overflows a buffer on the call stack, often overwriting the saved return address to redirect execution. A heap-based overflow overflows a buffer in dynamically allocated (heap) memory, typically corrupting heap metadata or adjacent object pointers.

Name common defenses against buffer overflow / memory attacks.

Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP/NX bit), stack canaries, bounds checking, and using memory-safe languages or safe library functions (e.g., strncpy instead of strcpy).

What distinguishes vulnerability scanning from penetration testing?

Vulnerability scanning is typically automated and passive/non-intrusive — it identifies and reports known weaknesses without exploiting them. Penetration testing actively exploits vulnerabilities to demonstrate real-world impact and is largely manual and goal-driven.

Differentiate credentialed (authenticated) from non-credentialed vulnerability scans.

A credentialed scan uses valid login credentials to examine a system from the inside (installed software, patch levels, configs), yielding deeper, more accurate results. A non-credentialed scan probes from the outside without login, seeing only what an unauthenticated attacker would.

What is a false positive versus a false negative in vulnerability scanning?

A false positive is a reported vulnerability that does not actually exist (wasting analyst time). A false negative is a real vulnerability the scanner failed to detect (a dangerous blind spot).

What is a CVE?

CVE (Common Vulnerabilities and Exposures) is a standardized dictionary of publicly disclosed, unique identifiers for specific known security vulnerabilities, maintained by MITRE. Each entry has an ID like CVE-2021-44228, allowing consistent reference across tools and vendors.

What is CVSS and what score range does it use?

CVSS (Common Vulnerability Scoring System) provides a standardized numerical severity score for a vulnerability, ranging from $0.0$ to $10.0$. Typical severity bands: None $0.0$, Low $0.1$–$3.9$, Medium $4.0$–$6.9$, High $7.0$–$8.9$, Critical $9.0$–$10.0$.

What are the three metric groups that make up a CVSS score?

Base metrics (intrinsic characteristics constant over time — exploitability and impact), Temporal metrics (characteristics that change over time, e.g., exploit availability, remediation level), and Environmental metrics (characteristics specific to a user's environment). The Base group produces the core $0.0$–$10.0$ score.

How does CWE differ from CVE?

CWE (Common Weakness Enumeration) is a categorized list of software/hardware weakness types — the general classes of flaws (e.g., CWE-89 SQL Injection, CWE-79 XSS). CVE identifies specific instances of vulnerabilities in particular products. In short: CWE is the type of flaw; CVE is a concrete occurrence of it.