Cybersecurity Quiz: Malware and Trojans

False (B)

VBA

<p>PDF readers</p> Signup and view all the answers

<p>Microsoft Office files = Can contain macros that may spread viruses PDF files = Can include embedded scripts Adobe Flash files = Often used to spread malware before deprecation Executable files = Traditional target of viruses</p> Signup and view all the answers

<p>Stealth (D)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Adobe Flash files</p> Signup and view all the answers

<p>Stealing banking information (D)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Phishing emails</p> Signup and view all the answers

<p>remotely</p> Signup and view all the answers

<p>DarkComet (A)</p> Signup and view all the answers

<p>RATs = Remote system control Spy Trojans = Monitoring user actions Trojan Droppers = Installing other malware Zeus Trojan = Stealing banking information</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>They can slow down systems and cause instability.</p> Signup and view all the answers

<p>To provide unauthorized access to a system (A)</p> Signup and view all the answers

<p>Modifying system calls (A)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>System's superuser or administrator</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Preventing them from scanning certain files or memory regions.</p> Signup and view all the answers

<p>hide</p> Signup and view all the answers

<p>covert</p> Signup and view all the answers

<p>Hiding Files = Making specific files invisible Hiding Processes = Concealing malicious processes from monitoring tools Creating Hidden Filesystems = Storing data or tools in undetectable locations Maintaining Remote Access = Ensuring persistent access to compromised systems</p> Signup and view all the answers

<p>Exploiting vulnerabilities = Gaining root access to install a rootkit Social engineering = Tricking users into running malicious software Intercepting system calls = Modifying how applications interact with the OS Modifying logs = Erasing traces of rootkit activity</p> Signup and view all the answers

<p>They operate within the operating system kernel. (A)</p> Signup and view all the answers

<p>They operate at the kernel level. (A)</p> Signup and view all the answers

<p>True (A)</p> Signup and view all the answers

<p>True (A)</p> Signup and view all the answers

<p>Modifying logs.</p> Signup and view all the answers

<p>Kernel mode allows the execution of privileged CPU instructions. (C)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>supervisor mode</p> Signup and view all the answers

<p>device</p> Signup and view all the answers

<p>Full access to system resources = Kernel mode Restricted access and isolation = User mode Potential crash affects whole system = Kernel mode Errors only affect the application = User mode</p> Signup and view all the answers

<p>Device drivers (A)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Isolation</p> Signup and view all the answers

<p>User applications (D)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>To request services from the kernel.</p> Signup and view all the answers

<p>system calls</p> Signup and view all the answers

<p>Kernel = Kernel Mode Web browsers = User Mode Device drivers = Kernel Mode Media players = User Mode</p> Signup and view all the answers

<p>Web browser (A)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>The CPU switches from user mode to kernel mode.</p> Signup and view all the answers

Viruses can infect data files like Microsoft Office files, PDF files, and Flash files by embedding malicious code or scripts that run when the file is opened.

Microsoft Office documents (like .docx and .xlsm) can contain small programs called macros written in VBA (Visual Basic for Applications). Viruses can hide in these macros and spread when the document is opened.

A virus can embed malicious code into PDF files that can be executed when the file is opened, often exploiting vulnerabilities in PDF reader software.

Adobe Flash files (like .swf) often contained embedded scripts that could be used to spread malware. This method was common before Flash was discontinued.

Viruses try to hide their presence and blend in with the normal functioning of the system.

Viruses try to spread themselves to as many files and systems as possible to maximize their impact.

Trojan horses (Trojans) are malicious software programs designed to look legitimate but secretly perform harmful actions on a compromised system.

Trojans are often spread through phishing emails, malicious websites, software bundles, and social engineering tactics.

Governments use Trojans for surveillance purposes, such as monitoring encrypted communication platforms and gathering evidence in investigations.

Zeus Trojan, RATs (Remote Access Trojans) like DarkComet, Trojan droppers, and Spy Trojans are examples of malware.

Trojans can steal sensitive information, lead to financial loss, compromise system performance, and enable attackers to infiltrate networks.

Trojans can intercept login credentials, granting attackers access to bank accounts, credit cards, and other sensitive financial information.

RATs provide attackers with remote control of infected systems, allowing them to view files, steal data, install malware, and even operate the system remotely.

Trojan droppers act as installers for other types of malware, including ransomware or keyloggers, secretly installing malicious software on your system.

A type of malware designed to provide attackers with hidden and persistent access to a computer system.

These operate within the OS kernel, the core component of the operating system, making them extremely difficult to detect.

Rootkits can hide files, processes, and even create hidden filesystems, essentially erasing their tracks.

This refers to a malicious program's ability to remain hidden and active within a system, even after restarts.

Rootkits are designed to mask their presence, making it difficult to detect the malware infection.

Files related to the malware or logs are concealed to avoid detection.

These rootkits manipulate the OS's process management to hide malicious processes from system monitoring tools.

Rootkits can create hidden filesystems to securely store their tools, stolen data, or additional payloads.

Rootkits can change how the operating system works by altering or replacing core functions like system calls. This gives them control over how the system operates.

To hide their presence, rootkits can make antivirus or anti-malware software unable to scan certain files or memory regions.

Rootkits can use hidden communication methods to talk to other machines without being detected.

Rootkits can hide deep within the operating system's core, giving them full control over the system and making them harder to remove.

Rootkits can intercept how applications communicate with the operating system and modify that information to hide their presence.

Rootkits can modify system logs to erase evidence of their activity.

Attackers can use existing security vulnerabilities to gain administrator access and then install a rootkit.

Attackers can trick users into running malicious programs disguised as legitimate software or updates.

A privileged mode where the operating system runs with unrestricted access to hardware and memory.

A less privileged mode where user applications and non-critical processes run with restricted access.

A mechanism that allows user applications to request services from the kernel.

The process of switching the CPU between Kernel Mode and User Mode.

This protects the system's stability by preventing user applications from directly affecting the kernel.

This prevents malicious or buggy applications from harming the operating system or other programs.

By isolating user processes, the operating system minimizes the impact of software bugs on the entire system.

User mode is essential for protecting the integrity and security of the operating system.

Kernel mode (also known as supervisor mode) gives code full control over the computer's hardware and resources. This includes everything from the CPU and memory to I/O devices. It's like being the king or queen of your computer, with absolute power.

User mode is a restricted environment where programs can't directly access hardware or the computer's core system. It's like having limited privileges, only allowed to do specific tasks.

In kernel mode, programs can use special CPU instructions that are normally off-limits in user mode. This allows them to control the computer's core functions and respond to events like interrupts.

The operating system's kernel and device drivers reside in kernel mode because they need complete control over system resources. This allows them to manage how tasks get done and control hardware like printers and network cards.

Since kernel mode code has unrestricted access to everything, a single error or crash in kernel mode can bring down the entire system. This is why it's crucial to ensure the OS kernel is stable and secure.

In user mode, programs are kept separate from each other and the kernel, ensuring a crash in one program won't affect the entire system or other programs. This helps keep the system stable and safe.

Unlike kernel mode, errors in user mode usually only affect the program itself, not the entire system. This makes the system more resistant to crashes and errors.

User mode programs rely on the operating system to access system resources and perform actions like writing files or communicating over the network. They do this by sending requests to the kernel, which is like asking permission to do specific tasks.