Page 1371 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

ability leaves your company. At the least, you should perform a
vulnerability assessment of all systems the person could access. You

may be surprised to find one or more “back doors” left in the system.
(For more on back doors, see Chapter 21.) But even in the absence of
any back doors, a former employee who is familiar with the technical
architecture of the organization may know how to exploit its
weaknesses.

Grudge attacks can be devastating if allowed to occur unchecked.

Diligent monitoring and assessing systems for vulnerabilities is the
best protection for most grudge attacks.

Thrill Attacks

Thrill attacks are the attacks launched only for the fun of it. Attackers
who lack the ability to devise their own attacks will often download
programs that do their work for them. These attackers are often called

script kiddies because they run only other people’s programs, or
scripts, to launch an attack.

The main motivation behind these attacks is the “high” of successfully
breaking into a system. If you are the victim of a thrill attack, the most
common fate you will suffer is a service interruption. Although an
attacker of this type may destroy data, the main motivation is to

compromise a system and perhaps use it to launch an attack against
another victim.

One common type of thrill attack involves website defacements, where
the attacker compromises a web server and replaces an organization’s
legitimate web content with other pages, often boasting about the
attacker’s skills. For example, attackers launched a series of automated
website defacement attacks in 2017 that exploited a vulnerability in

the widely used WordPress web publishing platform. Those attacks
managed to deface more than 1.8 million web pages in one week.

Recently, the world has seen a rise in the field of “hacktivism.” These
attackers, known as hacktivists (a combination of hacker and activist),
often combine political motivations with the thrill of hacking. They
organize themselves loosely into groups with names like Anonymous
and Lulzsec and use tools like the Low Orbit Ion Cannon to create