Search: firmware — Cyber Encyclopedia

166 terms · 75/46/45

65 rezultata za „firmware" · 6 direktnih · 59 povezanih

Pretnje

4 direktna pogotka

№ 067
IoT Device Compromise … weak or default passwords, rare updates, insecure firmware and open services that should never be reachable from the internet. Once compromised they can serve f …
pretnja · physical / IoT
№ 010
Rootkit … etimes in the boot phase, even in the motherboard firmware. From there it hides itself and everything else the attacker does, so an infected system looks perfec …
pretnja · malware
№ 053
Botnet Attacks … is not harmless if it has a default password, old firmware and access to the internet.
pretnja · availability
№ 060
Supply Chain Attack … s, integrations, tools, update servers, packages, firmware and the people who maintain them.
pretnja · trust

Tehnike

2 direktna pogotka

№ 017
Rootkit Installation Can operate at user-space, kernel, or firmware (UEFI) level.
tehnika · execution
№ 010
Exploitation … ating systems, applications, network services, or firmware.
tehnika · execution

↳ Povezano

59 stavki koje koriste „firmware"

№ 042
API Abuse API abuse arises when an attacker uses a programming interface in a way the application did not anticipate or did not restrict enough. An API is not merely a technical add-on to the application. It is often the main entrance to the data, the users, the orders, the payments and the administration.
pretnja · applications
№ 043
Authentication Bypass An authentication bypass means the attacker reaches a protected part of the system without logging in the ordinary way. They need not know a password. Sometimes a flaw in the logic is enough, or an unprotected endpoint, a predictable token, a misconfigured proxy, or a gap between two steps of the login.
pretnja · applications
№ 027
Automation & Scripting Automation and scripting involves using scripts, tools, and automated procedures to accelerate and scale activities within a compromised environment. Attackers leverage system scripting interpreters, configuration management tools, and custom scripts.
tehnika · discovery
№ 006
Backdoor A backdoor is a hidden way in. Once placed or opened, it lets the attacker return to the machine — with no password, no authorization and no entry in the ordinary records. A backdoor can be opened by malware while it runs, but it can equally be a user account nobody watches, or web shell access left on a server.
pretnja · malware
№ 006
Browser Isolation Executing web content in an isolated environment separate from the local system.
odbrana · endpoints
№ 039
Command & Control Command and control communication involves establishing a persistent channel between the attacker and the compromised system for sending commands and receiving results. The attacker uses this channel to manage malware, launch new attack phases, and retrieve data.
tehnika · C2
№ 023
Container Escape Containers are meant to isolate an application from the host and from other containers. Container escape is when an attacker controlling a process inside a container breaks that isolation and reaches the host (or other containers). From an application-level foothold they get host-level reach.
tehnika · privileges
№ 003
Credential Abuse Credential abuse involves using stolen, leaked, or otherwise obtained login data to gain unauthorized access to systems and services. The attacker impersonates a legitimate user.
tehnika · initial access
№ 041
Cross-Site Request Forgery Cross-site request forgery, or CSRF, exploits the fact that a browser automatically sends existing session cookies to a site where the user is already logged in. The attacker does not need to know the password. It is enough to lead the user down the wrong path.
pretnja · applications
№ 040
Cross-Site Scripting Cross-site scripting, better known as XSS, arises when a web application allows somebody else's script to be displayed and executed in the user's browser. The attacker does not have to break into the web server. It is enough for their code to end up in a page the victim opens as though it were entirely legitimate.
pretnja · applications
№ 013
Cryptominer A cryptominer steals what we rarely think of as a target: our computing power and our electricity. In the background it uses our processors and graphics cards to mine cryptocurrency for the attacker while we pay the bill. It has no interest in our data, only in our resources and how much of them there is.
pretnja · malware
№ 028
DDoS Protection DDoS protection encompasses technologies and services that detect and mitigate distributed denial-of-service attacks before malicious traffic reaches or overwhelms the target infrastructure.
odbrana · resilience
№ 057
DNS Poisoning DNS poisoning is an attack in which a user or a resolver is given a false answer for a domain. The result is that the user types a familiar address into the browser and DNS takes them to the wrong web server. On paper the name is the same. In reality the road leads somewhere else.
pretnja · availability
№ 029
DNS Security DNS security encompasses technologies that protect DNS infrastructure and use DNS traffic as a control point for blocking access to malicious domains and detecting suspicious communications.
odbrana · resilience
№ 050
Denial of Service / DoS DoS is a denial-of-service attack that tries to bring a service down or slow it so far that legitimate users can no longer use it. Unlike DDoS it need not come from a large network of compromised devices. Sometimes one source and a well-chosen vulnerability are enough.
pretnja · availability
№ 040
DevSecOps Integrating security into all phases of the software development lifecycle.
odbrana · people
№ 003
EDR EDR (Endpoint Detection and Response) is a technology that continuously monitors endpoint activity, records events, and enables detection, investigation, and response to threats that bypassed preventive controls.
odbrana · endpoints
№ 042
Encrypted C2 Channels Using HTTPS, DNS-over-HTTPS, or other encrypted protocols for C2.
tehnika · C2
№ 001
Endpoint Protection Endpoint protection encompasses software solutions that protect computers, servers, and mobile devices from malicious software and unauthorized activities. It combines classic signature-based malware detection with heuristic analysis and behavior-based detection.
odbrana · endpoints
№ 041
Fast-Flux DNS Rapid rotation of IP addresses associated with a C2 domain.
tehnika · C2
№ 035
Firewall A firewall is a control placed at the boundary between networks that permits or blocks traffic according to predefined rules — deciding who may talk to whom, on which ports and protocols.
odbrana · resilience
№ 022
IDS/IPS IDS/IPS are systems that monitor network traffic (or host activity) for patterns indicating an attack. An IDS (Intrusion Detection System) only reports suspicious activity; an IPS (Intrusion Prevention System) sits inline and can block it immediately.
odbrana · monitoring / response
№ 012
Impair Defenses Defense evasion encompasses techniques by which an attacker conceals their activity from security tools, analysts, and automated detection systems. The goal is to remain undetected for as long as possible in the compromised environment.
tehnika · execution
№ 020
Incident Response A planned process of identifying, containing, eradicating, and recovering from cyber incidents.
odbrana · monitoring / response
№ 046
Indicator Removal A set of techniques for hindering or preventing digital forensics.
tehnika · evasion
№ 046
Insecure Deserialization Deserialization is the return of a packed object into a form the application can use. The problem arises when an application accepts an object from an untrusted source and handles it as though it were safe. At that point the attacker is not sending mere data but a specially prepared structure that can change the flow of execution.
pretnja · applications
№ 016
Logging & Monitoring Logging and monitoring involves the systematic recording of activities and events on systems, networks, and applications, along with regular analysis of those records to detect anomalies and security incidents.
odbrana · monitoring / response
№ 017
MDR MDR (Managed Detection and Response) is a service where an external security team provides continuous monitoring, threat detection, and incident response on behalf of an organization. It combines technology with human expertise.
odbrana · monitoring / response
№ 032
Malvertising Malvertising uses ad networks as a delivery channel for attacks. The user does not have to be on a dubious site; a malicious advert can appear on a legitimate portal too, because ad space often arrives through several intermediaries.
pretnja · social eng.
№ 038
Malware Delivery Malware delivery encompasses the methods by which malicious software is transferred to a target system. This includes infected attachments, compromised websites, malicious ads, removable media, and compromised software updates.
tehnika · C2
№ 025
Network Segmentation Network segmentation is the practice of dividing network infrastructure into smaller, isolated segments with controlled communication between them. The goal is to limit an attacker's ability to move through the network after compromising a single system.
odbrana · resilience
№ 023
Patch Management Patch management is the process of identifying, testing, and applying software updates that fix known vulnerabilities. The goal is to reduce the time window in which an attacker can exploit a known weakness.
odbrana · resilience
№ 047
Path Traversal Path traversal is an attack in which the attacker tries to step out of the permitted directory and reach files the application should never display. The best-known pattern is a sequence such as `../`, which walks the path back up the file system level by level.
pretnja · applications
№ 045
Penetration Testing Simulation of real attacks to identify vulnerabilities that automated tools miss.
odbrana · governance
№ 011
Persistence Persistence encompasses techniques by which an attacker ensures their access or malicious code survives system reboots, password changes, or other interruptions. The goal is to maintain a foothold in the environment over an extended period.
tehnika · execution
№ 018
Privilege Escalation Privilege escalation is a technique by which an attacker with limited access gains a higher level of authorization. Vertical escalation means reaching administrator or root level, while horizontal escalation means accessing another user's resources at the same privilege level.
tehnika · privileges
№ 020
Privilege Escalation Privilege escalation is the attempt by an attacker who already holds some level of access to widen their rights in order to move through the network. Escalation is rarely the first stage — it comes after entry through, say, an ordinary user account or a compromised service. It takes the attacker from the crack they slipped through to control of the whole system. There are two directions: vertical escalation, from an ordinary user to domain administrator, and horizontal, moving from one account to another user's resources at the same level of rights.
pretnja · identity
№ 001
Ransomware Ransomware locks a company's data and demands payment to release it. The ransom is asked in cryptocurrency because it makes the money harder to follow — which is exactly why attackers use it.
pretnja · malware
№ 038
Remote Code Execution Remote code execution is one of the most dangerous classes of vulnerability, because it lets an attacker run their own code on a vulnerable system from somewhere else entirely. If the application runs on a server, the attacker is no longer merely a user on the outside; they gain a way to influence what the server executes.
pretnja · applications
№ 032
Resource Exhaustion Resource exhaustion as a technique involves deliberately overloading target systems to make them unavailable to legitimate users. The attacker targets CPU, memory, network bandwidth, disk, or connection limits.
tehnika · exfiltration / impact
№ 052
Resource Exhaustion Resource exhaustion targets what a system cannot work without: processor, memory, disk, network connections, threads, the database or processing queues. The aim is not necessarily to send enormous traffic but to make the system spend what it has.
pretnja · availability
№ 041
Risk Assessment Systematic process of identifying, analyzing, and prioritizing cyber risks.
odbrana · governance
№ 070
SCADA/OT Attack An attack on SCADA and OT systems targets industrial processes, not only data. These are the systems that run manufacturing, energy, water, transport, buildings, sensors, PLC controllers and HMI stations. When such a system stops or starts working wrongly, the consequences can be fatal.
pretnja · physical / IoT
№ 039
SQL Injection SQL injection usually arises when a web application passes user input blindly to the database on the web server. Instead of ordinary text, the attacker can put part of an SQL command into a login, search or filter field. If the application does not stop it, the database can execute something the designer never had in mind, and certainly never intended.
pretnja · applications
№ 045
SSRF SSRF is a vulnerability in which the attacker gets a web server to send a request to an address of the attacker's choosing. The distinction matters: the request is not sent by the user's browser but by the server. That opens the door to internal services which from the outside ought to remain invisible.
pretnja · applications
№ 026
Secure Configuration Secure configuration involves applying established security baselines to all systems, services, and applications in an organization. The goal is to reduce the attack surface by eliminating unnecessary functions, default passwords, and insecure settings.
odbrana · resilience
№ 033
Service Abuse Service abuse as a technique involves using legitimate system functionalities in unintended ways to cause damage, gain unauthorized access, or achieve financial gain.
tehnika · exfiltration / impact
№ 019
Session Hijacking When you log in, the service opens a session — a state that remembers you are you, together with everything that goes with it, such as your preferences and settings. The main benefit is that you do not have to type a password every few minutes as you move through the features. That session is marked by an identifier, usually held in a browser cookie. Session hijacking is the taking over of a session that is already open. The attacker does not attack the login; they slip into a session that has already passed authentication and carry on operating the service in your name.
pretnja · identity
№ 006
Supply Chain Compromise Technique of injecting malicious code into the software supply chain.
tehnika · initial access
№ 019
Threat Intelligence Collecting, analyzing, and applying data about current cyber threats.
odbrana · monitoring / response
№ 044
Timestomping Changing file timestamps to hide when they were created or modified.
tehnika · evasion
№ 036
Virtual Private Network A VPN (virtual private network) creates an encrypted tunnel between a device and the network it connects to. For an organization this primarily means controlled remote access to internal resources — from home, on the road, in the field. Traffic inside the tunnel cannot be read in transit, even on hotel Wi-Fi.
odbrana · resilience
№ 044
Vulnerability Management Continuous process of discovering, classifying, prioritizing, and remediating vulnerabilities.
odbrana · governance
№ 027
WAF WAF (Web Application Firewall) is a firewall that filters, monitors, and blocks HTTP/HTTPS traffic to web applications. It sits between users and the web server, analyzing each request against defined rules.
odbrana · resilience
№ 036
Watering Hole Attack A watering hole attack does not chase the victim directly. The attacker first finds a site the target group visits regularly, then compromises that site or the content loaded through it. The victim then comes to the place of the attack on their own, doing what they normally do.
pretnja · social eng.
№ 008
Worm A worm spreads on its own. Unlike a virus it needs no host file and no click from the user — once it is on one machine it immediately looks for the next, and the next, and thousands of devices can be infected within minutes. Replication is its purpose, speed is its weapon, and whatever it carries is the real threat.
pretnja · malware
№ 004
XDR XDR (Extended Detection and Response) unifies data from endpoints, network, email, and cloud.
odbrana · endpoints
№ 011
Zero Trust Zero Trust is a security concept that assumes no user, device, or network segment should be automatically trusted, regardless of whether it is inside or outside the corporate network. Every access request is verified before approval.
odbrana · identity / access
№ 044
Zero-Day Exploitation Zero-day exploitation uses a vulnerability for which the vendor has no patch yet, or does not know exists. The name says how much time the defense had to prepare: zero days. In practice a victim can be doing everything right, keeping systems and applications up to date, and still be exposed.
pretnja · applications