Types of Attack Exploiting Actual Code | CSSLP Exam Answer
Question
An attacker exploits actual code of an application and uses a security hole to carry out an attack before the application vendor knows about the vulnerability.
Which of the following types of attack is this?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.mitigate such attacks.
Answer: A is incorrect.
A replay attack is a type of attack in which attackers capture packets containing passwords or digital signatures.
A zero-day attack, also known as zero-hour attack, is a computer threat that tries to exploit computer application vulnerabilities which are unknown to others, undisclosed to the software vendor, or for which no security fix is available.
Zero-day exploits (actual code that can use a security hole to carry out an attack) are used or shared by attackers before the software vendor knows about the vulnerability.
User awareness training is the most effective technique to whenever packets pass between two hosts on a network.
In an attempt to obtain an authenticated connection, the attackers then resend the captured packet to middle attacks occur when an attacker successfully inserts an intermediary software or program between two communicating hosts.
The intermediary software or program allows attackers to listen to and modify the communication packets passing between the two hosts.
The software intercepts the communication packets Denial-of-Service (DoS) attack is mounted with the objective of causing a negative impact on the performance of a computer or network.
It is also known as network saturation attack or bandwidth consumption attack.
Attackers perform DoS attacks by sending a large number of protocol packets to a network.
The given scenario describes a situation where an attacker exploits a vulnerability in an application that the vendor is not aware of. Such vulnerabilities are commonly referred to as "zero-day" vulnerabilities.
A zero-day vulnerability is a type of software vulnerability that is unknown to the party responsible for patching or otherwise fixing the vulnerability. In this case, the application vendor is unaware of the vulnerability, and therefore has not released a patch or update to address it.
Attackers can exploit zero-day vulnerabilities to launch attacks, as there are no available fixes to prevent or mitigate the attack. Attackers can use various techniques to identify and exploit zero-day vulnerabilities, including reverse engineering, fuzzing, and other forms of vulnerability scanning.
In the given scenario, the attacker has already identified and exploited the vulnerability before the vendor is aware of it. This type of attack can be particularly damaging, as the attacker can continue to exploit the vulnerability until the vendor releases a patch or update to fix it.
In summary, the type of attack described in the scenario is a zero-day attack, which involves exploiting a vulnerability in an application that the vendor is not aware of.
