General Programming Quiz

Malware Threats

• Malware is malicious software designed to damage or disable computer systems, giving the creator limited or full control for theft or fraud.

Types of Malware

• Trojan Horse
• Virus
• Backdoor
• Worms
• Rootkit
• Spyware
• Ransomware
• Botnet
• Adware
• Crypter

Ways Malware Enters a System

• Instant Messenger applications
• Browser and email software bugs
• IRC (Internet Relay Chat)
• Removable devices
• Attachments
• NetBIOS (File Sharing)
• Fake programs
• Untrusted sites and freeware software
• Downloading files, games, and screensavers from Internet sites
• Legitimate "shrink-wrapped" software packaged by a disgruntled employee

Malware Distribution Techniques

• Blackhat Search Engine Optimization (SEO)
• Social Engineered Click-jacking
• Malvertising
• Spearphishing Sites
• Compromised Legitimate Websites
• Drive-by Downloads

How Hackers Use Trojans

• Delete or replace operating system's critical files
• Disable firewalls and antivirus
• Generate fake traffic to create DOS attacks
• Record victim's PC activity (screenshots, audio, video)
• Use victim's PC for spamming and blasting emails
• Download spyware, adware, and malicious files
• Create backdoors for remote access
• Infect victim's PC as a proxy server for relaying attacks
• Use victim's PC as a botnet to perform DDoS attacks
• Steal information like passwords, security codes, and credit card information by using keyloggers

How to Infect Systems Using a Trojan

• Create a new Trojan packet using a Trojan Horse Construction Kit.
• Create a dropper, which is a part of a trojanized packet that installs the malicious code on the target system.
  • Example dropper - Installation path: c\windows\system32\svchosts.exe, Autostart: HKLM\Software\Mic.....\run\Iexplorer.exe
  • Example of malicious code, Client address: client.attacker.com, Dropzone: dropzone.attacker.com
• Create a wrapper using wrapper tools to install Trojan on the victim's computer.
• Propagate the Trojan.
• Execute the dropper.
• Execute the damage routine.

Wrappers

• A wrapper binds a Trojan executable with an innocent-looking .EXE application (e.g., games or office applications.)
• The two programs are wrapped into a single file.
• Attackers might send a birthday greeting that installs a Trojan.

Command Shell Trojans

• Command shell Trojan provides remote control of a command shell on a victim's machine.
• Trojan server is installed on the victim's machine and opens a port for attacker connection.
• The attacker's client machine is used to launch a command shell on the victim's machine.
  • Example command: C:>nc , C:> nc -L -p , -t -e cmd.exe

Remote Access Trojans

• This Trojan works like a remote desktop access.
• Hacker gains complete GUI access to the remote system.
• Example: Infect with server.exe and plant Reverse Connecting Trojan. The Trojan connects to Port 80, establishing a reverse connection with the attacker.

Botnet Trojans

• Botnet Trojans infect a large number of computers to form a controlled network (botnet).
• Botnet is used to launch attacks such as denial-of-service attacks, spamming, click fraud, and theft of financial information.

Evading Anti-Virus Techniques

• Break the Trojan file into multiple pieces and zip them as a single file.
• ALWAYS write your own Trojan and embed into an application.
• Change Trojan's syntax; convert an EXE to VB script, change .EXE extension to .DOC.EXE, .PPT.EXE or .PDF.EXE.
• Change the content of the Trojan using a hex editor and change checksum, then encrypt the file.
• Never use Trojans downloaded from the web (antivirus can detect these easily).

Introduction to Viruses

• A virus is a self-replicating program that copies itself by attaching to a program, computer boot sector, or document.
• Viruses are transmitted through file downloads, infected disk drives, and email attachments.

Virus Characteristics

• Infects other programs
• Alters data
• Transforms itself
• Corrupts files and programs
• Encrypts itself
• Self-replication

Stages of Virus Life Cycle

• Design: Virus developer uses programming to create.
• Replication: Virus copies itself.
• Launch: Virus gets activated by the user.
• Detection: Antivirus software detects the virus.
• Incorporation: Antivirus software adapts to the virus.
• Elimination: Users use antivirus to remove virus and improve protection.

Why People Create Computer Viruses

• Inflict damage to competitors
• Financial benefits
• Research projects
• Play pranks
• Vandalism
• Distribute political messages
• Cyberterrorism

How a Computer Gets Infected by Viruses

• User accepts files/downloads without checking the source properly.
• Opening infected email attachments.
• Installing pirated software.
• Not updating or installing new versions of plugins.
• Not running the latest antivirus application.

Encryption Viruses

• This type of virus uses simple encryption to encipher the code.
• The virus has different encryption keys for each infected file.
• Antivirus scanners cannot directly detect using signature detection methods.

Computer Worms

• Malicious programs that replicate, execute, and spread across network connections without human interaction.
• Most worms replicate and spread across networks, consuming resources, but some carry a payload damaging the host system.
• Attackers install backdoors into infected computers to create botnets.

How a Worm Differs From a Virus

• Worms replicate on their own and use memory, but cannot attach themselves to other programs.
• Worms spread through infected networks.

Anti-Virus Sensor Systems

• Anti-virus sensor systems detect and analyze malicious threats (e.g. viruses, worms)
• Used alongside sheep dip computers for complete network security.

How to Detect Trojans

• Scan for suspicious open ports.
• Scan for suspicious startup programs.
• Scan for suspicious running processes.
• Scan for suspicious files and folders.
• Scan for suspicious registry entries.
• Scan for suspicious network activities.
• Scan for suspicious device drivers installed.
• Scan for suspicious Windows services.
• Run a Trojan scanner to detect Trojans.

Trojan Countermeasures

• Avoid opening email attachments from unknown senders.
• Install patches and security updates.
• Block unnecessary ports.
• Avoid accepting programs from instant messaging.
• Harden weak default configuration settings.
• Monitor internal network traffic for odd ports.
• Scan CDs and DVDs using antivirus software.
• Restrict permissions in the desktop environment.
• Avoid blindly typing commands.
• Manage workstation file integrity (checksums, auditing, port scanning).
• Avoid downloading and executing applications from untrusted sources.
• Run host-based antivirus, firewall, and intrusion detection software.

Backdoor Countermeasures

• Most commercial anti-virus products automatically scan and detect backdoor programs.
• Educate users not to install applications from untrusted sources and email attachments.
• Use anti-virus tools to detect and eliminate backdoors.

System Hacking

• Module is about unmasking the invisible hacker.

Information at Hand Before System Hacking Stage

• Footprinting Module: IP Range, Namespace, Employees
• Scanning Module: Target assessment, Identified systems, Identified services
• Enumeration Module: Intrusive probing, User lists, Security flaws

System Hacking: Goals

• Gaining Access: Bypass access controls. Technique/Exploit Used: Password cracking, social engineering
• Escalating Privileges: Acquire the rights of another user/admin. Exploit Type: Exploiting known system vulnerabilities
• Executing Applications: Create sustained remote access to the system. Exploit Type: Trojans, spywares, backdoors, keyloggers
• Hiding Files: Hide malicious attacker activities and data theft. Exploit Type: Rootkits, steganography
• Covering Tracks: Hide evidence of compromise. Technique/Exploit Used: Clearing logs

CEH Hacking Methodology (CHM)

• Footprinting
• Scanning
• Enumeration
• Gaining Access
• Cracking Passwords
• Escalating Privileges
• Executing Applications
• Hiding Files
• Clearing Logs
• Maintaining Access
• Covering Tracks

Password Cracking

• Techniques used to recover passwords from computer systems.
• Attackers use password cracking techniques to gain unauthorized access to vulnerable systems
• Most password cracking techniques succeed due to weak or easily guessable passwords.

Sniffing

• Module is about unmasking the invisible hacker.
• Sniffing is a process of monitoring and capturing data packets passing a given network using tools.

Network Sniffing and Threats

• Many enterprise switches are open, making those ports vulnerable to those in the same physical location.
• Sniffing tools are used to capture data packets such as syslog traffic, Telnet passwords, DNS, email, FTP, web traffic, chat sessions, etc. Using sniffing tools requires knowing the ports to target and potential sensitive data.

How a Sniffer Works

• Sniffer turns the NIC (Network Interface Card) of a system to promiscuous mode to listen to all transmitted data on the network segment.
• Decoders decode the data packets for useful information like data, usernames, passwords etc.

Types of Sniffing: Passive Sniffing

• Only monitors packets sent by others, without sending any additional data packets.
• Attacks on hubs, where all traffic is sent to all ports, making the attacker job easier.

Types of Sniffing: Active Sniffing

• Involves injecting address resolution packets (ARP) to flood the switch's CAM (Content Addressable Memory) table.
• Can use techniques like MAC flooding, DNS poisoning, ARP poisoning, DHCP attacks, switch port stealing, and spoofing attacks to control network traffic.

How an Attacker Hacks the Network Using Sniffers

• Attacker connects their laptop to the switch port.
• Use discovery tools to learn about network topology.
• Identify victim's machine.
• Poison victim's machine via ARP attacks.
• Redirect victim's machine traffic to attacker, via MITM (Man-in-the-Middle Attack).
• Extracts passwords and sensitive data through the redirected traffic.

Protocols Vulnerable to Sniffing

• Protocols sending data in clear text (e.g. HTTP, Telnet, Rlogin, POP, IMAP, SMTP, NNTP, FTP.)
• Protocols with no encryption can expose passwords and data.

Sniffing in the Data Link Layer of the OSI Model

• Sniffers operate at the Data Link layer of the OSI.
• Layers function independently; sniffer will not affect higher layers of OSI.

Hardware Protocol Analyzer

• Captures network signals without altering traffic, used to monitor network usage and identify malicious traffic from installed software.
• Decodes data packets for bytes within the segment.

Hardware Protocol Analyzers (Examples)

• Keysight N2X N5540A
• Keysight E2960B
• RADCOM PrismLite Protocol Analyzer
• RADCOM Prism UltraLite Protocol Analyzer
• FLUKE Networks OptiView® XG Network Analyzer
• FLUKE Networks OneTouch™™ AT Network Assistant

Wiretapping

• Monitoring telephone and internet conversations.
• Attackers connect to circuits.
• Allows monitoring, intercepting, accessing, and recording information.
• Active Wiretapping: Monitors, records, alters, and injects into communication.
• Passive Wiretapping: Only monitors and records traffic to gain data knowledge.

Lawful Interception

• Intercepting data communication for surveillance in telecommunications, VoIP, etc.
• Legally authorized requests for wiretaps.
• Processes for real-time reconstruction of intercepted data (e.g., by Law enforcement agencies).
• Central Management Server (CMS) used to administrate intercepted data.

Wiretapping Case Study: PRISM

• NSA's data collection tool, collecting foreign intelligence routed through US servers.

MAC Flooding

• Overloads switch CAM table with fake MAC addresses and IP pairs.
• Switch acts as a hub, allowing attacker to sniff traffic.

How to Defend against MAC Attacks

• Configuring Port Security on Cisco switch, using switchport port-security, limiting MAC addresses allowed on the switch port.

ARP Protocol

• ARP translates IP addresses to MAC addresses to allow networked devices to communicate.
  • ARP Request broadcast to network.
  • Responding machine provides its IP and MAC address.

ARP Spoofing Attack

• Forging ARP packets to redirect traffic to an attacker's machine.
• ARP packets overload switch's tables to become a hub for the attacker to monitor traffic.

Threats of ARP Poisoning

• Packet Sniffing
• Data Interception
• Session Hijacking
• Connection Hijacking
• Connection Resetting
• Stealing Passwords
• Man-in-the-Middle Attack
• Denial-of-Service (DoS) Attack

MAC Spoofing/Duplicating

• MAC duplicating attack involves sniffing a network for active MAC addresses of connected clients, then reusing those addresses to listen traffic and gain access.

DNS Poisoning Techniques

• DNS poisoning tricks a DNS server into accepting false IP addresses for target websites, diverting traffic to the attacker's server.
• Attacker can create fake DNS entries to mislead users to the attacker's server.

Sniffing Tool: Wireshark

• Captures and interactively browses network traffic.
• Supports various network types like Ethernet.
• Programmatically edits captured files via command line.
• Uses display filters for data display.

How to Defend Against Sniffing

• Use HTTPS instead of HTTP.
• Use switches instead of hubs.
• Use SFTP instead of FTP.
• Use strong encryption protocols (PGP, VPN, IPSec, SSL/TLS, SSH).
• Retrieve MAC addresses directly from NICs.
• Use tools to detect promiscuous mode on NICs.

How to Detect Sniffing

• Check for machines running in promiscuous mode.
• Monitor if MAC addresses change (e.g., router's MAC address) using IDS.
• Use network tools like Capsa Network Analyzer to analyze traffic.

Types of Password Attacks

• Non-Electronic: Attacker doesn't need technical knowledge. (e.g., Shoulder Surfing, Social Engineering)
• Active Online: Attacker directly communicates with victim machine. (e.g., Dictionary, Brute-Force, Rule-based Attack, Password Guessing)
• Passive Online: Attacker cracks password without communicating with victim or authorizing parties. (e.g. Wire Sniffing, Man-in-the-Middle, Replay Attacks)
• Offline: Attacker copies target's password file to try cracking it later in different location. (e.g. Rainbow Table, Pre-Computed Hashes)

Active Online Attack: Dictionary, Brute-Forcing and Rule-Based Attacks

• Dictionary attacks use pre-defined word lists that try to crack.
• Brute-force attacks try every possible combination of characters until a password is found.
• Rule-based attacks try to crack passwords based on known rules or patterns.

Active Online Attack: Password Guessing

• Creates a list of likely passwords based on information gathered.
• Ranks passwords from most to least probable.

Default Passwords

• Preset passwords set by manufacturers on new equipment that attackers exploit to easily get into systems.
• Online tools are available to search default passwords.

Active Online Attack: Trojan/Spyware/Keylogger

• Attacker install Trojan, Spyware and/or Keylogger to capture user names and passwords.
• Automatically runs in background collecting credentials and sending them to the attacker.

Example of Active Online Attack Using USB Drive

• Steps to place a keylogger on a victim's computer using a USB drive.

Passive Online Attack: Wire Sniffing

• Attacker uses packet sniffer tools on the LAN to obtain network traffic.
• Captured data may contain sensitive info like passwords, emails, etc.

Passive Online Attacks: Man-in-the-Middle & Replay Attack

• Attacker intercepts communication between victim and server.
• Replay attack uses captured authentication tokens to gain access.

Offline Attack: Rainbow Table Attack

• Precomputed table of password hashes for easier cracking.
• Attacker captures passwords and checks those hash against the rainbow table.

How to Defend Against Password Cracking

• Enable security audits to monitor attacks.
• Use strong, unique passwords and change frequently.
• Do not share passwords.
• Avoid easily guessed passwords.
• Use strong encryption.
• Regularly set password change policy.
• Keep password storing locations secure.
• Do not use pre-set system default passwords.
• Create strong, unique passwords that combine upper and lower case letters, numbers, and symbols.
• Salt passwords before encrypting to avoid standard lookup.
• Utilize SYSKEY for strong password encryption.
• Avoid easily guessable names for passwords.
• Ensure servers monitor for brute force attacks.
• Lock out accounts after multiple incorrect password entries.

Privilege Escalation

• Gaining higher privileges on a system.
• Non-admin users gaining admin access via exploits, OS bugs, and configuration errors.
• Vertical Escalation: Gaining higher privileges (e.g., a user to an admin)
• Horizontal Escalation: Gaining the same level of privileges as another user.

How to Defend Against Privilege Escalation

• Limit interactive logon privileges
• Employ strong encryption to protect data
• Limit user privileges
• Minimize the amount of code that runs with high privileges
• Perform bounds checkers and stress tests
• Run services as unprivileged accounts
• Implement privilege separation methodology
• Regular system patching

Executing Applications

• Attackers execute malicious programs on a compromised system to gather information, exploit resources, crack passwords, capture screenshots, install backdoors or inflict other damage.
  • Examples of malicious programs executed include keyloggers, backdoors, crackers, spywares.

Keyloggers

• Programs/hardware that monitor keystrokes and record logged data to a file or remotely.
• Legitimate purposes include monitoring employees or children.

How to Defend Against Keyloggers

• Pop-up blocker
• Use good Anti-Virus
• Install Anti-keylogger software
• Recognize and avoid phishing emails
• Create strong, unique passwords and change frequently
• Avoid opening junk emails
• Do not click unwanted links in emails that may contain malicious sites

Spyware

• Stealthy programs that record user activities without permission and send info to attackers.
• Information gathered may include email addresses, logins, passwords, and financial credentials.

How to Defend Against Spyware

• Use computer systems under your direct control
• Be cautious about suspicious emails and websites
• Update software regularly
• Use firewalls to protect against outbound threats
• Regularly check tasks and configuration reports
• Use virus definition file updates and scan PCs regularly for spyware
• Install and use anti-spyware software
• Perform cautious web browsing
• Avoid using administrative mode on systems unless absolutely necessary
• Avoid using public terminals for transactions and sensitive activities
• Avoid downloading free music, screensavers, or smiley faces from the internet
• Read all disclosures before installing any software (including licensing agreements and privacy statements)
• Do not store personal information where it might not be completely under your control

Rootkits

• Malicious software that hides its presence and attacker's activities, granting full access to servers and hosts.
• Typically includes backdoors, DDoS programs, packet sniffers, log-wiping utilities, and IRC bots.

Steganography

• Hiding secret messages within a cover message/file (e.g. within images) to avoid detection.
• Conceals messages, code, plans, and lists of compromised servers.

Covering Tracks

• Attackers try to hide their activities (e.g., disable auditing, clearing logs, manipulating logs) to hide their intrusion.

Disabling Auditing

• Intruders disable auditing immediately after gaining administrative privileges to avoid detection.
• Turn auditing back on if needed.

Clearing Logs

• Attackers use utilities (like clearlogs.exe) to erase security log information.
• Meterpreter shell used to wipe out system logs.

Virus and Worms Countermeasures

• Install antivirus software that detects and removes infections as they occur.
• Stay alert to download instructions.
• Avoid opening attachments from unknown senders, maintain regular data back-up.
• Use antivirus software updates regularly for protection updates.
• Implement a solid antivirus policy, distribute to staff.
• Scan all drives regularly to catch issues.
• Verify all executable files sent to the system.
• Use bootable disks for running malware checks.
• Stay informed on the latest malware/virus threats.
• Use the system's pop-up blocker for protection.

Common Anti-Virus Tools (Examples)

• AVG Antivirus
• BitDefender
• F-Secure Anti-Virus
• Avast! Pro Antivirus 2014
• Kaspersky Anti-Virus
• McAfee AntiVirus Plus 2014
• Trend Micro Titanium Maximum Security
• ESET Smart Security 7
• Norton AntiVirus
• Total Defence Internet Security Suite

Test your knowledge on programming languages, their functions, and their primary uses in web development. This quiz covers essential concepts such as SQL's primary function and the role of CSS. Challenge yourself with matching languages to their uses!