Malware Overview and Prevention - Week 6
29 Questions
3 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is a defining characteristic of worms?

  • They self-replicate and have different triggers.
  • They attach to files and require user interaction to spread.
  • They exploit network vulnerabilities to spread without user interaction. (correct)
  • They can mutate to avoid detection like viruses.

    • Viruses can only spread through email attachments.

    False

    What is the purpose of antivirus software?

    To identify and remove malware.

    A __________ is a program that appears harmless but can perform malicious activities like keylogging.

    <p>Trojan</p> Signup and view all the answers

    Match the types of antivirus approaches with their descriptions:

    <p>Virus Dictionaries = Scans for known virus signatures Behaviour Blockers = Monitors suspicious system commands Integrity Checkers = Detects changes in files caused by malware Activity Monitoring = Tracks unusual program activities</p> Signup and view all the answers

    Which approach can lead to false positives?

    <p>Activity Monitoring</p> Signup and view all the answers

    User awareness is the only method to prevent malware infections.

    <p>False</p> Signup and view all the answers

    What is threat modeling?

    <p>A process for identifying potential threats and security risks.</p> Signup and view all the answers

    What is the primary purpose of a remote access Trojan (RAT)?

    <p>To maintain access and control over the compromised system</p> Signup and view all the answers

    The action 'Disrupt' in defensive steps refers to stopping attackers from accessing critical information.

    <p>False</p> Signup and view all the answers

    What does 'C2' stand for in the context of cybersecurity?

    <p>Command and Control</p> Signup and view all the answers

    The final goal of an attacker during an intrusion can involve __________ data.

    <p>exfiltrating</p> Signup and view all the answers

    Match the following defensive steps with their descriptions:

    <p>Detect = Stopping attackers gaining access to critical information Deny = Counterattack on the attacker Degrade = Altering or stopping outbound data Deceive = Interfering with data available to attackers</p> Signup and view all the answers

    What is the primary goal of threat modeling?

    <p>To identify and mitigate potential risks</p> Signup and view all the answers

    Defenders only need to protect against a single vulnerability to be effective.

    <p>False</p> Signup and view all the answers

    What framework can be used to brainstorm potential threats during threat modeling?

    <p>STRIDE</p> Signup and view all the answers

    __________ is a security property related to ensuring the authenticity of a user.

    <p>Authentication</p> Signup and view all the answers

    Match the STRIDE elements with their corresponding definitions:

    <p>Spoofing = Masquerading as another user Tampering = Unauthorized modification of data Repudiation = Denying responsibility for an action Information Disclosure = Unauthorized access to information Denial of Service = Preventing access to services</p> Signup and view all the answers

    Which of the following is a mitigation technique for tampering?

    <p>Using strong encryption</p> Signup and view all the answers

    Continuous reflection and revision of security procedures are unnecessary after implementation.

    <p>False</p> Signup and view all the answers

    What example can illustrate information disclosure in a cybersecurity context?

    <p>Password leaks</p> Signup and view all the answers

    What is the main goal of a DDoS attack?

    <p>To flood a website with service requests</p> Signup and view all the answers

    Effective mitigation against elevation of privilege involves role-based access controls.

    <p>True</p> Signup and view all the answers

    What are the two types of reconnaissance in the Cyber Kill Chain?

    <p>Active reconnaissance and passive reconnaissance</p> Signup and view all the answers

    A successful ________ attack occurs when malware is executed to exploit a vulnerability.

    <p>exploitation</p> Signup and view all the answers

    Match the stages of the Cyber Kill Chain with their definitions:

    <p>Reconnaissance = Gathering information about the target Weaponization = Creating the malware based on vulnerabilities Delivery = Transmitting the malware to the target Exploitation = Executing the malware to gain access</p> Signup and view all the answers

    Which of the following is NOT a method of mitigating DDoS attacks?

    <p>Privilege separation</p> Signup and view all the answers

    The Cyber Kill Chain includes a stage for data exfiltration after exploitation.

    <p>False</p> Signup and view all the answers

    What is the purpose of STRIDE in software development?

    <p>To systematically evaluate components against potential threats</p> Signup and view all the answers

    Study Notes

    Malware Overview

    • Malware comes in three forms: viruses, worms, and Trojans.
    • Viruses attach to files, replicate, and spread. They can be polymorphic (mutate to avoid detection) and have triggers like logic bombs or time bombs. Spread via files, boot sectors, and email attachments.
    • Worms replicate across systems without user interaction, exploiting network vulnerabilities. Cause slowdowns and provide remote access for attackers (e.g., Blaster and Witty worms).
    • Trojans appear harmless but hide malicious activities like keylogging (recording keystrokes) or opening backdoors for attackers to control remotely.

    Malware Detection and Prevention

    • User Awareness educating users to avoid risky behaviors (e.g., downloading suspicious files) prevents infections.
    • Technical Solutions, like write protection, firewalls, and intrusion detection systems help prevent attacks.
    • Antivirus Software identifies and removes malware but requires regular updates to recognize new threats.

    Antivirus Approaches

    • Virus Dictionaries scan for known virus signatures. Struggles with unknown or polymorphic viruses.
    • Behavior Blockers monitor suspicious system commands (e.g., file deletions) and alert users before actions are carried out.
    • Integrity Checkers detect changes in files caused by malware but only after some damage has occurred.
    • Activity Monitoring tracks program behavior for unusual activities (e.g., attempting to alter other programs) but can produce false positives. Suspected files can be quarantined (isolated) in a sandbox environment.

    Threat Modeling

    • A systematic process for identifying potential threats and security risks.
    • Provides a more comprehensive approach to evaluating security risks than a more ad-hoc approach. Helpful in preventing vulnerabilities.
    • Systematic Approach involves mapped-out steps to map the threat landscape.
    • Threat Actors vs. Defenders Attackers only need to exploit one vulnerability, while defenders must protect against all possible threats.
    • General Approach (Key Questions):
      • What are we building? (system description, diagrams)
      • What can go wrong? (brainstorming threats, STRIDE, cyber kill chains, attack trees)
      • What will we do about it? (Identify and implement mitigation, prioritize actions)
      • Reflection (review, reflect, revise procedures)

    STRIDE Framework

    • Spoofing (S): Masquerading as another user or entity (e.g., phishing emails). Mitigation: Ensure strong authentication.
    • Tampering (T): Unauthorized modification of data (e.g., changing salary information). Mitigation: Protect data integrity via encryption and checksums.
    • Repudiation (R): Denying responsibility for an action (e.g., denying sending an email). Mitigation: Implement non-repudiation mechanisms.
    • Information Disclosure (I): Unauthorized access to information (e.g., password leaks). Mitigation: Strong encryption, access controls, and proper data handling.
    • Denial of Service (D): Preventing legitimate users from accessing services (e.g., DDoS attacks). Mitigation: Firewalls, intrusion detection/prevention systems, load balancing.
    • Elevation of Privilege (E): Gaining unauthorized access to higher-level permissions (e.g., read-only user gaining write access). Mitigation: Authorization mechanisms, role-based access controls (RBAC), privilege separation.

    Cyber Kill Chain

    • Sequence of actions attackers typically follow to infiltrate a network.

    • Stages:

      • Reconnaissance: Gathering information about the target (identifying weaknesses, entry points).
      • Weaponization: Creating the malicious tool or payload.
      • Delivery: Delivering the malware or exploit.
      • Exploitation: Executing the malware to gain access.
      • Installation: Establishing the attacker's presence.
      • Command and Control (C2): Establishing communication with the compromised system.
      • Actions on Objectives: Achieving final goal (e.g., exfiltrating data, disrupting services).

    Additional Notes (page 5)

    • Example Mitigation: Steps for minimizing attack success:
      • detecting attackers
      • stopping attackers gaining access
      • disrupting outbound data
      • counter-attacking the attacker
      • deceiving the attacker

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Week 6 Notes on Malware

    Description

    This quiz explores the various types of malware including viruses, worms, and Trojans. It also discusses key strategies for detection and prevention, focusing on user awareness and technical solutions like antivirus software. Test your knowledge on the vital aspects of malware management.

    More Like This

    Types of Malicious Software (Malware)
    5 questions

    Types of Malicious Software (Malware)

    PersonalizedEarthArt avatar
    PersonalizedEarthArt
    Types of Malware Quiz
    9 questions

    Types of Malware Quiz

    WorthEmpowerment1870 avatar
    WorthEmpowerment1870
    Types of Malware and Social Engineering
    20 questions

    Types of Malware and Social Engineering

    LeadingZinc avatar
    LeadingZinc
    1212 Ch9.7-10.2: Malware Types Quiz
    25 questions

    1212 Ch9.7-10.2: Malware Types Quiz

    ExtraordinaryMars avatar
    ExtraordinaryMars
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser