Simple explanation
This is the "what does an attack actually look like when it's happening" lesson — the malware families, attack techniques, and behavioral indicators that tell you something is wrong.
Technical explanation
Malware attacks: ransomware (encrypts data, demands payment), trojan (disguised as legitimate software), worm (self-replicating, spreads without user action), spyware (covertly monitors activity), bloatware (unwanted pre-installed software, not always malicious but resource-draining), virus (attaches to and requires a host file/program to spread), keylogger (captures keystrokes), logic bomb (dormant code triggered by a specific condition), rootkit (hides its presence and grants persistent privileged access).
Physical attacks: brute force (physically forcing entry), RFID cloning (duplicating a badge's signal), environmental attacks (disrupting HVAC, power).
Network attacks: DDoS (overwhelming a target with traffic), DNS attacks (poisoning, hijacking), wireless attacks (rogue AP, evil twin), on-path attack (intercepting traffic between two parties — formerly "man-in-the-middle"), credential replay (reusing captured authentication data), malicious code execution over the network.
Application attacks: injection, buffer overflow, replay attacks, privilege escalation (gaining higher access than intended), forgery (CSRF — tricking a user's browser into making an unwanted authenticated request), directory traversal (accessing files outside an intended directory via ../ style paths).
Cryptographic attacks: downgrade attack (forcing use of a weaker, breakable algorithm/protocol version), collision attack (finding two different inputs producing the same hash), birthday attack (exploiting the mathematics of collision probability to find one faster than brute force).
Password attacks: password spraying (few common passwords against many accounts, to avoid lockout thresholds), brute force (many passwords against one account).
Indicators to watch for: account lockout (repeated failed logins), concurrent session usage (same account active in two places at once), blocked content (a filter catching something suspicious), impossible travel (logins from geographically distant locations too close in time to be legitimate), resource consumption (unusual CPU/memory/bandwidth spikes), resource inaccessibility (something suddenly unreachable, possibly due to attack), out-of-cycle logging (log activity at unusual times), published/documented indicators (matching known threat intel), and missing logs (a strong sign logs were deliberately deleted to cover tracks).
Synonyms / related terms
| Term | Means | |---|---| | On-path attack | Man-in-the-middle (older term) | | CSRF | Cross-Site Request Forgery = forgery | | Credential stuffing | Using breached credentials from one site against others (related to replay) |
Concept Check
"The same user account logs in successfully from New York, then five minutes later from Singapore. What indicator is this?" Not credential replay by itself (though it may involve stolen credentials) — the specific term the exam wants is impossible travel, since the defining feature is the physically implausible distance/time relationship.
Interview-style Q&A
Q: What's the real-world difference between password spraying and brute force? A: "Brute force hammers one account with many password guesses — fast to trigger a lockout. Spraying flips it: try one or two common passwords across many accounts, staying under the lockout threshold for any single account while still catching the users with weak passwords. It trades speed for stealth."
Memory trick
"RTWS-BKLR" for malware: Ransomware, Trojan, Worm, Spyware — Bloatware, Keylogger, Logic bomb, Rootkit. For indicators: "ACID-ROOM" — Account lockout, Concurrent sessions, Impossible travel, Data resource spikes, Resource inaccessibility, Out-of-cycle logs, Observed/published indicators, Missing logs.