There are all kinds of naughty things that can take place for individual homes within our infrastructure.
So in this episode what I want to do is kind of talk about all of the different types of threats that
take place to our individual homes.
Now in other episodes we're going to talk about how to deal with it right now in this episode.
I want to go through these very quickly.
Make sure you recognize them now.
Hopefully some of these are going to be really obvious to you and well known spam.
And there's also a pretty good chance we're going to have a lot of stuff in here that you aren't aware
of.
So let's run through them all starting with Spam
Spam is nothing more than unsolicited email.
Now spam can be considered a threat but normally pure spam isn't anything more than an irritant.
I've got to one of my many accounts up here.
I say I've got a spam folder full of things like tinted ictus restore your site lose weight fix your
vision and stop eating this and regrow my hair anyway.
Spam usually comes from relatively legitimate sources.
I probably joined some web site or something to lose a couple of pounds in that website then sold my
email address to a third party and if I'd paid attention when I joined that Web site they probably clearly
said it in their Terms of Service.
So spam in and of itself other than filling up mailboxes can't really cause any damage but it can be
a great irritant.
There is another form of email though that I want to talk about that can be an issue.
And that's phishing
phishing is simply spam but it's trying to get some kind of information out of you.
So take a look over here it by email.
Here's an example of a classic phishing e-mail that's trying to get some information out of me.
Now fishing in and of itself is still a huge problem even here as we get closer to 2020.
It's that big of an issue.
But even worse is something called spear fishing spear fishing is also fishing but the big difference
is is that somehow they get my name or some kind of information or an account or something that tries
to get personal information out of me.
So here's an example of a much scarier spearfishing type email.
Now phishing and spearfishing usually in plie that we're talking about email however it can be from
other sources but at least for the exam.
Make sure when we talk about phishing and spearfishing that we're simply within the realm of email.
OK great let's take the technology up a little bit and let's talk about spem
spin simply means to receive spam via instant messaging.
Now I don't know about you but I use all kinds of instant messaging tools from Google to Facebook.
I can't even keep track of them all.
Hang on a minute I'm lonely.
Meet me at lowlier.
OK now there is a perfect example right there of spem.
Somebody is using my Skype account to message me and that's actually my editor Scott Jernigan.
He's not lonely but he gave me a great example of that.
So spin is a bit of an issue but the problem is is spin like regular spam it doesn't really cause any
pain other than taking up your time however the next thing I want to talk about is very dangerous and
that is phishing
Vishy means the unsolicited use of voice to try to get information out of you.
This is a big problem today and it's something that we hang on a minute I've got a message here let
me get this real quick.
This is Jim Smith at Wells Fargo lost control.
Could you call us immediately.
800 5 5 5 1 2 1 2.
This is in regards to potentially unauthorized purchases on your account.
Thank you.
All right.
Sorry guys I got to take this one give me just a second here.
Lost control.
May I ask to whom I'm speaking with.
This is Mike Meyers you guys called me.
Yes.
Thank you Mr. Meyers.
Could you confirm the following three purchases.
$356 from balloons galore I don't think so.
Fourteen dollars from Coppermine.
Definitely not me.
Twenty seven hundred dollars an honor.
Oh no I didn't authorize any of this stuff and I didn't do this.
What do we do.
I see what could possibly prompt action quickly.
Yeah.
Can I have the last one.
So security number and collapsed into the American code.
Absolutely.
For the social it's 9 4 1 6 and for my pin code it is no way I am going to tell you guys on this video.
Even a part of my PIN code.
This is a huge problem today.
Any organization is not going to ask for these types of bits of information.
Hopefully we think all of us are well-trained in these types of issues but we've all got horror stories
about these and I'm sure you probably yourself received these types of phishing calls so they're a big
problem and a serious threat out there.
OK.
The next day I want to talk about is a classic.
And that's clicked Jacki
cook jacking is when you go onto a Web site and you're trying to click on something and it does something
tricky to you to make you click someplace else.
Now I'm sure all of us have been on click bait type sites where you're trying to see something.
And number 15 will drive you crazy and you try to click on something that keeps moving the ads and all
that.
Now these types of click bait sites there's no real evil they're just trying to get you to click an
ad in those types of situations.
Usually though when we're talking about click jacking is that we're making you do something really bad.
Authorizing something downloading a piece of malware something really ugly like that.
So that's what we concentrate on when we say click Jackky.
OK.
Let's go ahead and talk about my next favorite type of squatty
typo squatting simply means to take advantage of the fact that people mis type you are Elle's when they're
typing stuff in.
So if somebody typed in w w w dot G O O G L E dot com.
But what if they typed accidentally w w w that G O G L E dot com.
I hope that's not a scary site.
Guys I'm pulling that one off the top of my head so simply what they're doing as other people are buying
up domains and loading up Web sites in the hopes that somebody is going to make a typo and then they
can go ahead and have them come to their website similar to this but not at all identical is what we
called Domain hijacking.
I've personally been a victim of this.
I have lots of domains that I use for all kinds of stuff mainly experimental things so I throw up a
website or something and be honest with you I forget about a lot of them I probably got 14:15 websites
and I have my own registered domains on those and a couple of times I've left a domain slip and when
people see this they will grab it real quick and they'll often put something really offensive in there.
The idea being that you will then pay them a lot of money to get your domain back.
So both of these can be very big issues.
Make sure you're comfortable with the idea of typo squatting and domain hijacking.
All right so we've gone through a lot of these Let's go through one more and that is privilege elevation.
So the last one I want to talk about is privilege elevation privilege escalation it's the same word
and really to me this isn't a threat but the test says it is so we'll go with that.
The whole goal of a lot of situations where we're trying to get into a system is to get enough power
to get enough privilege within that system to do whatever naughtiness it is that we want to do.
So while escalation elevation whatever you want to call it of privilege is a problem it's not really
the threat the threat is the evil that people do as a result of it.
So you know make it easy and call that one a threat is all.
Now folks we've just gone through a bunch of host threats.
You need to take some time and make sure you've got these memorized cause you're going to see it on
the exam.