Which of the following compromises internet-connected devices and makes them vulnerable to becoming part of a botnet? (Select TWO)
Correct Answer: B,E
A botnet is a network of compromised devices that are remotely controlled by a malicious actor, usually for the purpose of launching distributed denial-of-service (DDoS) attacks, sending spam, stealing data, or performing other malicious activities1.
A malware infection is a common way of compromising internet-connected devices and making them part of a botnet. Malware is any software that is designed to harm or exploit a device, a network, or a user. Malware can be delivered through various methods, such as phishing emails, malicious downloads, drive-by downloads, or removable media2. Malware can infect a device and allow a remote attacker to take control of it, monitor its activities, or use its resources3.
The use of default credentials is another common way of compromising internet-connected devices and making them part of a botnet. Default credentials are the username and password combinations that are preconfigured by the manufacturer or vendor of a device, such as a router, a camera, or a printer. Default credentials are often easy to guess or find online, and many users do not change them after setting up their devices. This makes the devices vulnerable to unauthorized access and manipulation by attackers who can scan the internet for devices with default credentials and add them to their botnet .
A deauthentication attack is a type of wireless attack that aims to disconnect a legitimate user from a wireless network by sending spoofed deauthentication frames to the user's device or the access point (AP). A deauthentication attack can cause a denial of service, disrupt network communication, or facilitate other attacks, such as capturing the handshake during the reconnection process. However, a deauthentication attack does not compromise the device or make it part of a botnet.
IP spoofing is a technique of forging the source IP address of a packet to make it appear as if it came from a different device or location. IP spoofing can be used to bypass security filters, hide the identity of the attacker, or launch reflection or amplification attacks. However, IP spoofing does not compromise the device or make it part of a botnet, unless it is combined with other methods, such as malware infection or exploitation of vulnerabilities.
Firmware corruption is a condition where the firmware of a device, which is the software that controls its basic functions and operations, becomes damaged or altered due to various reasons, such as power surges, hardware failures, malicious attacks, or improper updates. Firmware corruption can cause the device to malfunction, lose data, or become inaccessible. However, firmware corruption does not compromise the device or make it part of a botnet, unless it is caused by a malicious attack that replaces the firmware with a malicious version.
A dictionary attack is a type of brute-force attack that tries to guess the password of a user or a device by using a list of common or likely passwords, such as those found in a dictionary, a database, or a previous breach. A dictionary attack can be used to compromise a device and make it part of a botnet, but only if the device has a weak or predictable password. Therefore, a dictionary attack is not a direct way of compromising a device, but rather a means of exploiting the use of default or weak credentials.
Reference:
1: Botnet
2: Malware
3: How Malware Can Turn Your Device into a Botnet
4: [Default Credentials]
5: [How Default Credentials Can Lead to IoT Botnets]
6: [Deauthentication Attack]
7: [IP Spoofing]
8: [Firmware Corruption]
9: [Dictionary Attack]
