All right, a DDoS attack.
Mobiles can participate in DDoS? Absolutely.
Anything with an IP address can participate in a DDoS attack.
The attacker initiates the attack by
exploding vulnerabilities in the devices, installing malicious software systems.
Again, that's just bot infection on a mobile device.
You get the same situation with IoT devices.
Software defined radios, speaking of IoT
devices, IoT quite often use a wireless communication.
Software defined radios allow you to use a variety of tools for interception and
replays and attacks based on wireless communications.
So crypto analysis, replay, and even reconnaissance attacks.
Side channel attacks are cross VM breaches.
When you start talking about cloud environments, you talk about a lot of
virtualization, container engines, containerization.
A side channel attack or cross VM breach is a situation where...
Well, side channel attacks are...
They're observing external behavior and to
do something that they can't directly observe.
Password cracking, crypto analysis
cracking based on timing, heat generation, that thing.
Never done that. It's a little bit above my pay grade.
But cross VM breaches are a situation where one virtual machine is compromised
by compromising another virtual machine on, say, the same hypervisor.
So anytime you have two systems utilizing a shared resource, there's a possibility
for a covert channel attack of some sort across VM breach.
Man in the Cloud attack is when a service
account is compromised and used to distribute malware to unsuspecting victims
like a Google Cloud or a Dropbox or Skydrive or Google Drive.
They left one out there.
So the man in the cloud attack, if I was to steal a synchronization token for the
cloud account, I could use that to gain unauthorized access.
I could use it to distribute malware.
Cloudhopper attacks are spear phishing
emails targeted towards managed service providers or cloud providers.
So the idea here is to attack the insiders, the legitimate employees of the
cloud service, the cloud service provider, and then use that to gain internal access.
So it's a spear phishing campaign aimed at
the users or the staff for a cloud provider.
Supply chain attacks, we mentioned this also in the first module.
Supply chain attacks are where you attack the manufacturing or distribution of
hardware software and you infect it or manipulate it prior to delivery.
All right, on the same cloud discussion,
Amazon Web Services employs something called simple storage services or S3.
They put data in buckets and the buckets are used to store data in buckets.
The buckets themselves may be insecure.
You have a variety of scanners and
utilities that can be used to identify buckets and try to compromise them.
But you're basically attacking the storage infrastructure of Amazon Web Services.