Page one of the Independent LLC/ US Bug Bounty handbook.
“Now son, don’t touch that cactus”
–ASDF MOVIES.
Have you ever thought that free Pokemon game was a good idea to download and install? Sometimes it's too good to be true. Unfortunately that would be an example of a Trojan Horse. What is crazy is not always all attacks from the internet are only when a user clicks on a link or downloads a program. Below is going to be an medium to high level of information to explain the attack surfaces for computers, phones, and Internet of things (IOT) devices and how to see the threat and protect yourself or your business.
This information on this page and the other pages (soon to come or available on the Independent LLC website) are allowed to be quoted, and used to study for tests like Security Plus from CompTIA or used for helpful information to protect individuals and companies.
Types of malicious programs:
Viruses:
Viruses are a type of program that is still a functional program but causes unintentional interactions with your computer or make it unusable. Viruses try to copy it's malicious code to multiple part of your system including your personal files and cause your system to be unstable or prevent features from being ran on your computer. Some viruses mimic fake antivirus software UI (User Interfaces) and state your computer has a virus... as the virus is the thing saying you have a virus. A virus attempts to basically render a individuals or a business computer useless to the owner of the computer.
A computer virus can infect a end user's computer at any time through a good amount of ways here is a few examples.
- An unsuspecting user can download file from the internet by an accidental click on an website or an advertisement. (This is considered a one click attack)
- Downloading a program that an user did not expect it to be or disguised a different program or game modification. (This is considered a Trojan Horse)
- A computer connected to an local internet connection with other infected computers on the same network. Or inserted a USB, SD card, or any other removable media to a computer. (This is considered a Worm)
- Loading up an infected website targeting a vulnerability in a program like a web browser. (This is considered a drive by attack or zero click attack. )
- A remote attacker accessing your computer from a back door or unknown zero day and implanting an attack for command and control. (This is considered a live attack and adding your computer to a bot net.)
One of the things a end user can protect themselves from virus is trust downloads from only credible sources like Microsoft.com or the vendor specific website and not a torrent/proxy or 3rd party download website. Download from vetted software stores like the Apple Store, Microsoft Store, and Google Play store. The process to get an app on the app store is more stringent vs creating a web server and creating a fake program to infect a computer with a virus. Ensure without breaking production systems or any other programs to make sure the latest security updates are applied on any system and end user is using. Systems using older version releases of operating systems are more vulnerable to being attacked as more known exploits are used on those systems. To see a change log for an operation system for security updates see Apple's Security bulletin for what updates corrected issues found by Apple and Security Researchers/Bug Bounty hunters found.
Spyware and Keyloggers.
Spyware and Keyloggers is not just a thing you see in spy movies or only used in corporate attacks. Spyware is a very scary thing, most cases it can take screenshots, Photos with your physical cameras on your PC or phone. Listen in on phone calls or conversations between family members or attempt to grab keystrokes to gather usernames and passwords. Steal Discord tokens, API keys, or any other sensitive information including Medical PII records, Social Security Numbers and other things attackers want from an end user. Keyloggers: Keyloggers are a very fascinating tool. A lot of these programs try to live on the land. which means it's using APIs built in like hooks in windows or other functions on other operating systems like iOS, Android, MacOS or Linux to abuse software created for functions like hitting the F1 (function 1) button to open an help page, to gain control of keyboard input and gather personal information. Spyware still can use keyloggers but is a lot more sophisticated here are some of the ways it runs and how users can get infected.
- Installing a unverified or compromised extension for a web browser or program.
- Physical attack on the computer or device with a usb drive to install a backdoor for an attacker to spy on the end user.
- Downloading a Game modification or cracked software or illegal software that runs malicious code in the background after install (Trojan horse) .
- Remote attacker found an open/unprotected port or known or unknown vulnerability/ZeroDay exploit to gain backdoor access to and end user’s device and installed spyware by living on the land.
- Supply chain attack on the end user’s device Bootloader or Firmware that allows functionality of the device like normal but may install a rootkit or an non-genuine Bootloader or Software to activate cameras or microphones etc.
How to protect end users from these attacks.
One of the things to do is limit what apps or programs have access to what type of data. Maybe the Calculator on your phone does not need access to location data. Maybe limit certain apps or outbound connections are allowed. For instance a HR employee's computer probably would not be communicating a large amount of data to a foreign ip address or trying to run power shell scripts if the employee does not know about computers at all. Prevent these types of scripts or ads being shown on computers with an Ad-blocker or using Lockdown mode from Apple to minimize the attack surface for an end user. Ensure switches, Routers, Phones, TVs, Voip Phones and other devices are certified and not tampered with to prevent supply chain spyware. Some operation systems try to show what apps are using what peripherals or if someone is recording your screen. Apple's About the orange and green indicators in your iPhone status bar is also a very good example of circuit detection usage for power to the camera if an app is trying to utilize the camera. (Note nothing is fool proof there may be ways to circumvent these protections but it's not easy.)