Information Security FULL WORK

1st Part
1. Zero-day vulnerability
  1. The Term Zero-day refers to a newly discovered flaw or error, to the manufacturer
    1. As in has been 0 days since it was discovered
  2. Why is it bad?
    1. Any flaw or error, could open a way to make the software vulnerable, most times it will get patched right away or a solution will be started as soon as the flaw is detected
  3. Exploits occur when a vulnerability is found and taken advantage by users
    1. These exploits sometimes appear in what appears to be inoffensive environments, but due to connectivity, can reach crucial parts of the system
2. Zero-Knowledge Proofs
  1. Is a probabilistic-based verification method. The verifier asks the prover based on certain randomness.
  2. It states that if the person providing the answer can provide the exact answer that the one asking the question has stored, and can be repeated several times, then his credibility is authentified
  3. Here is an example, when you create a bank account, they ask various personal question, date of birth, mothers name, name of the 1st place you attended school, city you were born, childhood best friend, last digits on X document
    1. If you communicate with them after your card is stolen the only thing that granted you access, then if you answer all the information you previously filled. Then it has to be you the same person that created the account
3. Hijacking Internet Traffic
  1. Imagine Internet Traffic as car traffic, now imagine taking one of the cars you now have whatever was inside the car, that information. Now imagine taking 100 cars, you know have what's inside those cars, But there is evidence you broke in and thus you can be charged or found guilty
  2. The car example, imagine the cars being stuck because the road is blocked, and imagine a NEW car is about to enter, but he knows that road is closed, he asking for directions, he says his destination, now you know WHERE all the others where going and you have gained that information in a indirect way, hard to be tracked
  3. Finally, imagine you don't like a place, following the example you close the roads that go to that place, since all roads are full that place can't handle the traffic and crashes down
    1. This happened in Pakistan, they didn't want the citizens to have access to ONE VIDEO located on youtube, so they blocked all traffic incoming and outgoing from that IP address, the result, youtube couldn't handle all the traffic attempting to reconnect with multiple request youtube CRASHED GLOBALLY for 2 hours
4. backdoors
  1. Is a way to access that information that was implemented, but not designed to be used by the common users
  2. There are backdoors that are part of a system, implemented by the manufacturer in order to maintain a secret way to restore sensitive data
    1. For example WhatsApp has backdoor method implemented and as part of their terms of agreement, they use it in case the user request that his chat log is destroyed, if his account is compromised.
  3. There are backdoors that are created while the services are inoperative, via virus, code injection, etc...
    1. These backdoors are created to steal, install or modify existent information without the user and database acknowledgement, and poses a great security threat
5. DDoS attacks
  1. For example, no one knew that a web-page linked with a database could be used to access sensitive information, that is until the first DDOS attacked occurred, using an exploit to generate requests, in order to make the web page unresponsive and using that down time between the web page and the server to inject malicious code and granting access to anonymous users
  2. hackers have attempted to make a website or computer unavailable by flooding or crashing the website with too much traffic.
  3. overwhelm them with more traffic than the server or network can accommodate. The goal is to render the website or service inoperable.
  4. Rendering the service inoperable is just a way to buy time, to inject malicious data or to steal sensitive data
2nd Part
1. Ransomware
  1. Examples
    1. NotPetya
    2. Locky
    3. WannaCry
    4. SimpleLocker
    5. TeslaCryp
    6. CryptoLocker
  2. How to avoid?
    1. Avoid browsing unsafe pages or with unverified content.
    2. Don't open emails or files with unknown senders
    3. Have a good antivirus installed
    4. Keep our operating system updated
  3. How does it work?
    1. For the rescue, ask for a payment in Bitcoins
    2. Blocks access and encrypts device information
    3. It takes over the computer
  4. Is a form of malicious software (MALWARE
2. Hacktivism
  1. Examples
    1. WikiLeaks
    2. LulzSec
    3. Anonymous
  2. Types
    1. Mirroring sites
    2. Bombardment of e-mail
    3. Web Sit-ins
    4. Destruction of web pages
    5. Doxing
    6. Geobombing
  3. Breaks websites securities to spread their messages
  4. Is the legal or illegal use of digital tools for political and protest purposes.
3. Consumer Device Targeting Attacks
  1. They are DDoS attacks aimed at IoT devices
  2. Take advantage of vulnerabilities in Supply Chain Devices
  3. How to protect yourself?
    1. Eliminate non-unique default passwords
    2. Adopt a vulnerability disclosure policy (Technical Drivers)
    3. Make secure software updates available for an explicitly stated length of time.
4. AI-Powered Automated Hacking
  1. Use of artificial intelligence for criminal purposes
  2. Drones and autonomous vehicles could be hacked using AI and turned into weapons
  3. Traditional cybersecurity methods won’t know how to cope with new attacks carried out by smart machines.
  4. Example
    1. DeepLocker
5. Biometric Malware
  1. The data stored in a biometric database may be more vulnerable than any other kind of data
  2. Any collection of data could eventually get hacked
  3. Some pieces of your physical identity can be duplicated
  4. Biometric
    1. t makes authentication much faster, easier and more secure
    2. Types
      1. Face recognition
      2. Iris recognition
      3. Fingerprints
      4. Fingerprint scanner
      5. Voice recognition
      6. Hand geometry
      7. Behavior characteristics

Siguiente

Information Security FULL WORK

Descripción

Resumen del Recurso

Similar

	Creado por Luis Mauricio Falla Guiulfo hace más de 5 años