Content deleted Content added
move unrelated from "classification" |
1) Fold "Types" into "Classifications" 2) Pivoting is not a type/classification |
||
Line 23:
Another classification is by the action against the vulnerable system; unauthorized data access, arbitrary code execution, and denial of service are examples.
Exploitations are commonly categorized and named<ref>{{cite web|title=Exploits Database by Offensive Security|url=https://www.exploit-db.com/|website=www.exploit-db.com}}</ref><ref>{{cite web|title=Exploit Database {{!}} Rapid7|url=https://www.rapid7.com/db/modules/|website=www.rapid7.com}}</ref> by the type of vulnerability they exploit {{Clarify | text = (see [[Vulnerability (computing)|vulnerabilities]] for a list)| date = August 2024 | reason = This should link to the section where there is supposed to be a 'list.' Which list this is talking about isn't obvious.}}, whether they are local/remote and the result of running the exploit (e.g. [[Elevation of Privilege (computing)|EoP]], [[Denial of Service (computing)|DoS]], [[Spoofing attack|spoofing]]).
A zero-click attack is an exploit that requires no [[user interaction]] to operate – that is to say, no key-presses or mouse clicks.<ref>{{Cite magazine|title=Sneaky Zero-Click Attacks Are a Hidden Menace|language=en-US|magazine=Wired|url=https://www.wired.com/story/sneaky-zero-click-attacks-hidden-menace/|access-date=2021-09-14|issn=1059-1028}}</ref> [[FORCEDENTRY]], discovered in 2021, is an example of a zero-click attack.<ref>{{Cite magazine|title=The Stealthy iPhone Hacks That Apple Still Can't Stop|language=en-US|magazine=Wired|url=https://www.wired.com/story/apple-imessage-zero-click-hacks/|access-date=2021-09-14|issn=1059-1028}}</ref><ref>{{Cite web|title=A new NSO zero-click attack evades Apple's iPhone security protections, says Citizen Lab|url=https://techcrunch.com/2021/08/24/nso-pegasus-bahrain-iphone-security/|access-date=2021-09-14|website=TechCrunch|date=24 August 2021|language=en-US|archive-date=2021-08-24|archive-url=https://web.archive.org/web/20210824124718/https://social.techcrunch.com/2021/08/24/nso-pegasus-bahrain-iphone-security/|url-status=live}}</ref>
Line 33 ⟶ 32:
In 2022, [[NSO Group]] was reportedly selling zero-click exploits to governments for breaking into individuals' phones.<ref>{{cite news |journal=Insurance Journal |url=https://www.insurancejournal.com/news/international/2022/02/18/654917.htm |title=Beware of 'Zero-Click' Hacks That Exploit Security Flaws in Phones' Operating Systems |author=Ryan Gallagher |date=February 18, 2022}}</ref>
Pivoting is a method used by hackers and [[penetration test]]ers to expand the attack surface of a target organization. A compromised system to attack other systems on the same network that are not directly reachable from the Internet due to restrictions such as [[Firewall (computing)|firewall]]{{clarify|date=April 2023}}. There tend to be more machines reachable from inside a network as compared to Internet facing hosts. For example, if an attacker compromises a web server on a corporate network, the attacker can then use the compromised web server to attack any reachable system on the network. These types of attacks are often called multi-layered attacks. Pivoting is also known as ''island hopping''.
| |||