preview

Unit 9 Assignment 1: List Phases Of A Computer Attack

Decent Essays

Unit 9 Assignment 1: List Phases of a Computer Attack
Reconnaissance and Probing
This deals with doing your homework. Researching your target is the most important part of an attack. Once your target has been pick out, probing for possible vulnerabilities within their network is performed. With the use of common tools found on the internet like DNS and ICMP, Standard and customized SNMP tools, Port scanners and port mappers, and Security probes to exploit a potential target.

Gaining Access
Get in the front door or even the back is the one of the main goals if not the goal. But once in, determining what is important to you as an attacker is what you would go for. Things like: financial records, social security numbers, secret recipes, anything …show more content…

This particular program is a Windows Trojan but what makes it unique is that it does not rely on the presence of a Windows binary file (an executable file on disk) to maintain its infection of a computer (Information on malware known as Poweliks, 2014).
A common method of infection of a Windows computer is for a 'dropper' program to be run on a computer that then downloads a 'payload' file which actually does the malicious work. The initial dropper file is usually programmed to delete itself to avoid detection. The payload file would then remain active on the computer and is programmed to carry out certain tasks (e.g., pop-up adverts, warnings that you are infected and need to buy protection (scareware), encrypt personal files and demand a ransom for unlocking them (ransomware), contacting a command and control server to await 'orders' for exactly what to do, etc.) In this more common scenario, because the payload file has to remain active so Sophos AV can easily acquire a sample of the file and see if prevention from infection is already covered (e.g., in Sopho's existing library of file detection, or through our intelligent heuristic detection methods). If required an update can be published and Sophos users who enable Sophos Live Protection are immediately protected - those who disable Live Protection with receive the update (along with Live Protection users)

Get Access