Are you familiar with various types of application attacks? If you're planning to take the Security+ exam, you should have a basic understanding of several common types of attacks launched against systems and networks.
Q. An attacker recently attacked a web server hosted by your company. After investigation, security professionals determined that the attacker used a previously unknown application exploit. Which of the following BEST identifies this attack?
When a user logs on to a web site, the web site often returns a cookie with a session ID. In many cases, this cookie is stored on the user's system and remains active until the user logs off. If the user closes the session and returns to the web site, the web site reads the cookie and automatically logs the user on. This is convenient for the user, but can be exploited by an attacker.
In a session hijacking attack, the attacker learns the user's session ID and uses it to impersonate the user. The web server doesn't know the difference between the original user and the attacker because it is only identifying the user based on the session ID.
Attackers can read cookies installed on systems through several methods, including cross-site scripting attacks and Flash cookies (described in the next section). Once they have the session ID, they can use header manipulation to hijack the session.
A Flash cookie is one created by Adobe Flash Player and is different from a traditional text cookie. They are also known as local shared objects (LSOs) or locally shared objects. As one example, Flash cookies are stored in multiple locations by default, and traditional methods of deleting cookies through a web browser do not delete Flash cookies. Some Flash cookies store the session ID from traditional cookies. If a user deletes the traditional cookies, the Flash cookies re-create them.
Many sites use Flash cookies to track users' online activity without their knowledge or consent. For example, when a user goes to a web site using a Flash cookie, then goes to web site B, the Flash cookie records their activity on web site B. This continues for the entire session as the Flash cookie tracks and records all of the user's activity. Their usage has prompted many class-action lawsuits against sites using Flash cookies.
Arbitrary code execution refers to the ability of an attacker to execute commands or run programs on a target system. Remote code execution refers to the ability of an attacker to execute the code from a remote system. Neither of these is desirable because it allows attackers to install and run malware on vulnerable systems.
As an example, imagine an application such as a web browser has a vulnerability that allows execution of code using one of these methods. An unsuspecting user can visit a malicious web site with specially crafted code to exploit this vulnerability. This code can use elevated privileges to cause the system to download a malicious file and then execute it to install it. Once installed, the malware can allow the attacker to take control of the computer whenever desired.
Software bugs are the most common reason that arbitrary code execution and remote code execution is possible. This is another reason why it is important to keep systems up to date with current patches.
Answer is B. A zero-day attack takes advantage of an undocumented exploit or an exploit that is unknown to the public.
A buffer overflow attack sends unexpected data to a system to access system memory or cause it to crash. Although some buffer overflow attacks are unknown, others are known. If the server isn't kept up to date with patches, it can be attacked with a known buffer overflow attack.
Fuzzing sends random data to a system and can detect buffer overflows and zero-day attack methods, but the scenario doesn't indicate the user is sending random data.
Session hijacking takes over a user's session and isn't related to an attack on a server.
See Chapter 7 of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide for more information on common attacks.