-: Identity exploits.
So we're gonna do a quick review from security process
of common identity exploits and some terms that you may
see again on the CSA Plus exam.
First one is impersonation attacks.
This is when an attacker takes on the identity
of a legitimate user.
This can be done by stealing their username and password
or by stealing their ID if they're going to do some sort of
a social engineering closeup attack.
Inside the CSA Plus exam you're often gonna see this
talked about inside credential theft
or open redirects using OAuth.
Session hijacking.
When we talk about session hijacking, this is when
the attacker takes over an existing session by acquiring
or guessing your session key.
So for example, if I'm the victim and I'm talking
to a web server, we have a session ID and we're talking
in plain text.
Now, if the attacker can guess that session key,
they can take over my session and then continue
to do business as me.
How do you prevent this?
Well, by encrypting sessions, and the most common way
to do that nowadays is by using TLS or transport layer
security as the way to encrypt your sessions.
The next one we're going to talk about here
is man-in-the-middle attacks and I know you know this
from earlier on, but a man-in-the-middle is when
the attacker tries to access the information flow
and that way they can be between you and the system
you want to talk to.
So the most common example of this, we talk about Alice
and Bob being two people who want to communicate
and Mallory gets right in-between and so as Alice
is shouting across the room to Bob, Mallory hears it,
changes the subject, and then passes it onto Bob.
She's in the middle; she becomes the man-in-the-middle.
This can be prevented by using session
or link encryption tunnels.
So again, using TLS connections that secure
from endpoint to endpoint communication.
The next one we wanna talk about is privilege escalation.
We've mentioned the term as we've gone through
these identity lessons recently, but I wanna make sure
you understand what it really is.
Privilege escalation is when the attacker can elevate
their permissions from one level to a higher level, right?
They're gonna escalate their privileges.
That makes sense, and this usually follows an attack
on normal account credentials.
So if I can get onto a user account using something
like a phishing email or a key logger
or stealing their password and I log in as normal user
John Smith, then I can use other exploits to try to get me
from that user to an admin and from that admin
to a domain admin and just keep getting bigger and bigger
privileges until I can control the whole network.
Now in the case of Linux systems, we'll go from user
to admin to root to kernel, right?
And once we're at the system or kernel level,
we own the entire server and we can do whatever we want.
That's the goal inside privilege escalation as an attacker.
The last one we're going to talk about is rootkits
and again, going back to your security plus studies,
a rootkit is a type of malware that's used to give
an attacker continued access on the server or client
while hiding their own presence.
So this actually places itself between the user
and the operating system and oftentimes
between the operating system and the antivirus software.
So it's even antivirus software a lot of times can't detect
a rootkit if it was already installed before the antivirus
was put on.