2 cissp ® Official Study Guide Eighth Edition

Spyware and Adware 
Two other types of unwanted software interfere with the way you normally use your com-
puter.
Spyware
monitors your actions and transmits important details to a remote system 
that spies on your activity. For example, spyware might wait for you to log into a bank-
ing website and then transmit your username and password to the creator of the spyware. 
Alternatively, it might wait for you to enter your credit card number on an e-commerce site 
and transmit it to a fraudster to resell on the black market. 
Adware
, while quite similar to spyware in form, has a different purpose. It uses a vari-
ety of techniques to display advertisements on infected computers. The simplest forms of 
adware display pop-up ads on your screen while you surf the web. More nefarious versions 
may monitor your shopping behavior and redirect you to competitor websites. 
Adware and malware authors often take advantage of third-party plug-ins 
to popular internet tools, such as web browsers, to spread their malicious 
content. The authors find plug-ins that already have a strong subscriber 
base that granted the plug-in permission to run within their browser and/or 
gain access to their information. They then supplement the original plug-in 
code with malicious code that spreads malware, steals information, or per-
forms other unwanted activity.
Zero-Day Attacks 
Many forms of malicious code take advantage of
zero-day vulnerabilities
, security fl aws 
discovered by hackers that have not been thoroughly addressed by the security community. 
There are two main reasons systems are affected by these vulnerabilities: 
■
The necessary delay between the discovery of a new type of malicious code and 
the issuance of patches and antivirus updates. This is known as the
window of 
vulnerability.
■
Slowness in applying updates on the part of system administrators
The existence of zero-day vulnerabilities makes it critical that you have a defense-in-
depth approach to cybersecurity that incorporates a varied set of overlapping security 
controls. These should include a strong patch management program, current antivirus 
software, confi guration management, application control, content fi ltering, and other pro-
tections. When used in conjunction with each other, these overlapping controls increase the 
likelihood that at least one control will detect and block attempts to install malware.

---

Password Attacks 
929
Password Attacks
One of the simplest techniques attackers use to gain illegitimate access to a system is to 
learn the username and password of an authorized system user. Once they’ve gained access 
as a regular user, they have a foothold into the system. At that point, they can use other 
techniques, including automated rootkit packages, to gain increased levels of access to the 
system (see the section “Escalation of Privilege and Rootkits” later in this chapter). They 
may also use the compromised system as a jumping-off point for attacks on other, more 
attractive targets on the same network.
The following sections examine three methods attackers use to learn the passwords of 
legitimate users and access a system: password-guessing attacks, dictionary attacks, and 
social-engineering attacks. Many of these attacks rely on weak password storage mecha-
nisms. For example, a website might store message digest 5 (MD5) hashes of passwords in a 
single file. If an attacker is able to manipulate the web server software or operating system 
to obtain a copy of the file, they could use it to conduct an attack.