Untitled Quiz

Network Security Threats

• Network security threats encompass attacks compromising confidentiality, integrity, and availability of information and systems.
• Common types of network security threats include malware, viruses, worms, Trojans, ransomware, botnets, adware, spyware, and rootkits.

Malware

• Malware refers to malicious software designed to harm or exploit systems.
• Different types of malware include:
  • Malvertising
  • Viruses
  • Worms
  • Fileless malware
  • Rootkits
  • Spyware
  • Adware
  • Trojans
  • Ransomware
  • Botnets

Viruses

• Viruses are programs designed to replicate and spread from one computer to another.
• They infect applications, operating systems, and files often without user awareness.

Characteristics of Computer Viruses

• Replication: Viruses make copies of themselves to spread to other files or systems.
• Activation: Viruses remain dormant until a specific condition is met, activating and executing harmful actions.
• Payload: The action viruses perform upon activation. This can range from displaying messages to damaging or deleting data.

Types of Computer Viruses

• File Infector Virus: Attaches itself to executable files and activates upon launch.
• Macro Virus: Programs embedded in documents (e.g., Word, Excel) using macro language and spreads upon opening.
• Boot Sector Virus: Infects the boot sector of storage devices, executing every time a computer starts.
• Polymorphic Virus: Continuously changes its code to avoid detection by antivirus software.
• Multipartite Virus: Can spread in multiple ways (e.g., through files and boot sectors).

Effects of Computer Viruses

• Data Loss: Viruses corrupt or delete files, resulting in the loss of crucial data.
• Performance Issues: Increased CPU usage or slow system performance due to virus operations in the background.
• Unauthorized Access: Viruses can create backdoors, risking sensitive data to cybercriminals.
• Network Spread: Viruses spread through networks, impacting multiple connected systems.

Worms

• Worms are malicious software that self-replicates and spreads to other computers without user intervention.
• Unlike viruses, worms don't need a host file to spread. They exploit system vulnerabilities to propagate.

Key Characteristics of Computer Worms

• Self-replication: Worms create copies and spread to other devices (often over networks).
• Exploitation of Vulnerabilities: Worms leverage software or operating system weaknesses (e.g., open ports, unsecured network shares) to access new systems.
• Network Propagation: Worms often spread rapidly across networks by scanning for vulnerable devices and exploiting them.
• No User Interaction Required: Worms can spread automatically without user action, making them dangerous.
• Payloads: Some worms carry payloads performing malicious actions (e.g., installing backdoors, stealing data, encrypting files).

Examples of Notable Computer Worms

• Morris Worm (1988): Distributed via the internet, causing significant slowdowns.
• ILOVEYOU Worm (2000): Spread via deceptive email attachments, causing widespread damage.
• Conficker (2008): A highly prolific worm exploiting Windows vulnerabilities, creating a large botnet.
• WannaCry (2017): A ransomware worm that exploited a Windows vulnerability, encrypting files and demanding ransom payments.

Trojans

• Trojans are malicious software disguised as legitimate applications or files. They trick users into downloading or executing them.
• Trojans do not self-replicate; they rely on users to unleash their payloads.

Key Characteristics of Trojans

• Deceptive Appearance: Trojans often masquerade as harmless software (e.g., games, utilities, updates).
• Payload Delivery: Once executed, Trojans can carry out various malicious activities, including stealing sensitive information (passwords, credit card details), gaining remote access, or installing additional malware.

Types of Trojans

• Backdoor Trojans: Allow remote access to a system, enabling attackers to take control.
• Banking Trojans: Target financial institutions and compromise online banking credentials.
• Ransomware: Encrypts files and demands ransom; often classified as a Trojan but sometimes standalone.
• Trojans that Download Other Malware: Install additional malicious software on an infected system.

Ransomware

• Ransomware is malicious software designed to deny access to a computer system or data until a ransom is paid.

How Ransomware Works

• Infection Vectors: Ransomware spreads through phishing emails, malicious downloads, or software vulnerabilities.
• Encryption: Malware encrypts files on the victim's device or network, making them inaccessible.
• Payment & Decryption: Attackers demand payment (often cryptocurrency) in exchange for a decryption key; there's no guarantee a key or access will be restored.

Types of Ransomware

• Crypto Ransomware: Encrypts files and demands ransom for the decryption key.
• Locker Ransomware: Locks the user out of the device or operating system, demanding a ransom for restoration.
• Scareware: Pretends to be legitimate software (e.g., antivirus), claiming infection and demanding payment.

Botnets

• Botnets are networks of compromised computers or devices controlled by a single entity (botmaster).
• Each compromised device is referred to as a "bot," a software allowing the malicious actor to control the infected devices 

Key Characteristics of Botnets

• Infection: Devices join a botnet through malware (e.g., malicious downloads, phishing).
• Control: Infected devices are remotely controlled by the botmaster using command-and-control (C&C) servers.
• Functions: Receive commands, update themselves, or spread to other devices.

Types of Botnets

• DDoS (Distributed Denial of Service) Attacks: Overwhelm a target server or network with traffic to disrupt service.
• Spam Distribution: Distribute massive amounts of spam emails.
• Data Theft: Extract sensitive information (e.g., login credentials, financial details).
• Cryptojacking: Use infected devices' processing power for unauthorized cryptocurrency mining.

Notable Botnets

Mirai: Exploited insecure devices (like cameras and routers) to launch DDoS attacks. Conficker: One of the largest botnets, exploiting Windows operating system vulnerabilities. Zeus: Primarily focused on stealing banking credentials and engaged in various cybercriminal activities.

Adware

• Adware, short for "advertising-supported software," automatically displays advertisements.
• It's often bundled with free software, potentially displaying unwanted ads, pop-ups, or redirecting web traffic to advertising websites.
• Can be intrusive and may track user behavior.

Spyware

• Spyware is malicious software designed to collect information about an individual or organization without their knowledge or consent.
• It can monitor user activity, collect sensitive data, and potentially compromise privacy and security.
• Forms include:
  • Data Theft: Capture personal information (passwords, credit card numbers, etc.)
  • Surveillance: Monitor user behavior (browsing habits, keystrokes, etc.), capture audio/video
  • Targeted Advertising: Serve targeted ads, raising consent and privacy concerns
  • Network Exploitation: Access additional systems via vulnerabilities to spread further

Rootkits

• Rootkits are malicious software tools that allow unauthorized users to control a computer system undetected.
• Designed to hide its presence and the presence of other malicious software, making it highly dangerous.

Types of Rootkits

• User-mode Rootkits: Modify standard executables, libraries, and applications to gain access.
• Kernel-mode Rootkits: Offer more extensive control over the operating system by modifying core functions.
• Bootkits: Embed themselves in the system's boot process to launch before the operating system starts, making detection difficult.
• Firmware Rootkits: Target firmware (BIOS/UEFI) to persist even after reinstalling the operating system.

Fileless Malware

• Fileless malware operates in memory, not writing files to the disk. It often exploits legitimate system tools, making detection and analysis challenging.
• Key Characteristics:
  • Memory-based Execution: Runs directly from memory.
  • Use of Legitimate Tools: Leverages built-in tools (e.g., PowerShell, WMI).
  • Stealthy Operations: Avoids file scanning detection methods.
  • Persistence: Maintains its presence after reboots.
  • Targeting Specific Platforms: Can be targeted at specific platforms (e.g. Windows).

Malvertising

• Malvertising is the practice of delivering malicious software through online advertising.
• This can happen when legitimate ad networks accidentally serve malicious ads or when malicious actors intentionally create and distribute harmful advertisements.

Preventing Malware

• Use antivirus software
• Keep software updated
• Be cautious with email attachments and links
• Download from trusted sources
• Use a firewall
• Practice safe browsing
• Be wary of public Wi-Fi
• Regularly back up data
• Enable pop-up blockers
• Educate yourself and others
• Limit user privileges
• Check permissions for installed apps