Podcast
Questions and Answers
Malware can be distributed through social engineered click-jacking.
Malware can be distributed through social engineered click-jacking.
True
A Trojan horse can only delete files on a computer.
A Trojan horse can only delete files on a computer.
False
Drive-by downloads exploit flaws in browser software to install malware.
Drive-by downloads exploit flaws in browser software to install malware.
True
Adware is a type of malware that typically only delivers advertisements to users.
Adware is a type of malware that typically only delivers advertisements to users.
Signup and view all the answers
Compromised legitimate websites are a method used by hackers to distribute malware.
Compromised legitimate websites are a method used by hackers to distribute malware.
Signup and view all the answers
A wrapper binds a Trojan executable with a visible .EXE application.
A wrapper binds a Trojan executable with a visible .EXE application.
Signup and view all the answers
A Botnet Trojan infects a single computer to control it for various attacks.
A Botnet Trojan infects a single computer to control it for various attacks.
Signup and view all the answers
A Command Shell Trojan allows an attacker to gain remote control of a victim's command shell.
A Command Shell Trojan allows an attacker to gain remote control of a victim's command shell.
Signup and view all the answers
Changing a Trojan's syntax can help it evade detection by antivirus software.
Changing a Trojan's syntax can help it evade detection by antivirus software.
Signup and view all the answers
Viruses are non-replicating programs that do not attach themselves to other software.
Viruses are non-replicating programs that do not attach themselves to other software.
Signup and view all the answers
A computer worm can replicate itself but cannot attach to other programs.
A computer worm can replicate itself but cannot attach to other programs.
Signup and view all the answers
Computer viruses can be detected using signature detection methods.
Computer viruses can be detected using signature detection methods.
Signup and view all the answers
One reason people create computer viruses is for financial benefits.
One reason people create computer viruses is for financial benefits.
Signup and view all the answers
Users can prevent infections by installing pirated software.
Users can prevent infections by installing pirated software.
Signup and view all the answers
The stages of a virus life include design, replication, launch, detection, incorporation, and elimination.
The stages of a virus life include design, replication, launch, detection, incorporation, and elimination.
Signup and view all the answers
A worm requires human interaction to spread across networks.
A worm requires human interaction to spread across networks.
Signup and view all the answers
Antivirus software developers assimilate defenses against viruses during the elimination phase.
Antivirus software developers assimilate defenses against viruses during the elimination phase.
Signup and view all the answers
Opening infected email attachments can lead to viral infections.
Opening infected email attachments can lead to viral infections.
Signup and view all the answers
Computer viruses use self-replication as a method of spreading.
Computer viruses use self-replication as a method of spreading.
Signup and view all the answers
A key difference between a virus and a worm is that a worm spreads automatically without attaching to other programs.
A key difference between a virus and a worm is that a worm spreads automatically without attaching to other programs.
Signup and view all the answers
Sniffing is a method used to capture data packets over a network.
Sniffing is a method used to capture data packets over a network.
Signup and view all the answers
Passive sniffing sends additional data packets to capture traffic.
Passive sniffing sends additional data packets to capture traffic.
Signup and view all the answers
Active sniffing is primarily used in switch-based networks.
Active sniffing is primarily used in switch-based networks.
Signup and view all the answers
In a hub-based network, only the host sending the data can capture the traffic.
In a hub-based network, only the host sending the data can capture the traffic.
Signup and view all the answers
MAC flooding is a technique used in active sniffing.
MAC flooding is a technique used in active sniffing.
Signup and view all the answers
A hacker can extract passwords from redirected traffic.
A hacker can extract passwords from redirected traffic.
Signup and view all the answers
Protocols like HTTPS are vulnerable to sniffing.
Protocols like HTTPS are vulnerable to sniffing.
Signup and view all the answers
Sniffers operate at the Data Link layer of the OSI model.
Sniffers operate at the Data Link layer of the OSI model.
Signup and view all the answers
A hardware protocol analyzer alters the traffic it captures.
A hardware protocol analyzer alters the traffic it captures.
Signup and view all the answers
Passwords and data sent in clear text are not susceptible to interception.
Passwords and data sent in clear text are not susceptible to interception.
Signup and view all the answers
Active wiretapping involves monitoring, recording, and altering communication traffic.
Active wiretapping involves monitoring, recording, and altering communication traffic.
Signup and view all the answers
Lawful interception requires consent from all parties involved in the communication.
Lawful interception requires consent from all parties involved in the communication.
Signup and view all the answers
Wiretapping is considered a criminal offense without a warrant in most countries.
Wiretapping is considered a criminal offense without a warrant in most countries.
Signup and view all the answers
PRISM is a tool designed specifically for domestic surveillance within the United States.
PRISM is a tool designed specifically for domestic surveillance within the United States.
Signup and view all the answers
A protocol analyzer allows attackers to view individual data bytes of data packets.
A protocol analyzer allows attackers to view individual data bytes of data packets.
Signup and view all the answers
Passive wiretapping can alter the traffic it monitors.
Passive wiretapping can alter the traffic it monitors.
Signup and view all the answers
The Keysight N2X N5540A is a type of protocol analyzer.
The Keysight N2X N5540A is a type of protocol analyzer.
Signup and view all the answers
The Access Switch/Tap is not part of the lawful interception process.
The Access Switch/Tap is not part of the lawful interception process.
Signup and view all the answers
Wiretapping requires the use of complex algorithms for basic monitoring tasks.
Wiretapping requires the use of complex algorithms for basic monitoring tasks.
Signup and view all the answers
The NSA utilizes PRISM to wiretap foreign internet traffic that passes through U.S. servers.
The NSA utilizes PRISM to wiretap foreign internet traffic that passes through U.S. servers.
Signup and view all the answers
In an offline attack, the attacker tries to crack passwords on their own system after copying the target's password file.
In an offline attack, the attacker tries to crack passwords on their own system after copying the target's password file.
Signup and view all the answers
A brute forcing attack attempts to guess a password using predefined dictionary words.
A brute forcing attack attempts to guess a password using predefined dictionary words.
Signup and view all the answers
Default passwords are typically supplied by the manufacturer with new equipment.
Default passwords are typically supplied by the manufacturer with new equipment.
Signup and view all the answers
A keylogger sends back user credentials to the attacker after infecting the victim's machine.
A keylogger sends back user credentials to the attacker after infecting the victim's machine.
Signup and view all the answers
Password guessing attacks have a high failure rate because the attacker guesses randomly.
Password guessing attacks have a high failure rate because the attacker guesses randomly.
Signup and view all the answers
A rainbow table is used to capture sensitive information like passwords from raw network traffic.
A rainbow table is used to capture sensitive information like passwords from raw network traffic.
Signup and view all the answers
In a replay attack, attackers capture packets and authentication tokens to gain access to a system.
In a replay attack, attackers capture packets and authentication tokens to gain access to a system.
Signup and view all the answers
Enabling information security audit can help monitor and track password attacks.
Enabling information security audit can help monitor and track password attacks.
Signup and view all the answers
The passive online attack known as Wire Sniffing is computationally complex and hard to perpetrate.
The passive online attack known as Wire Sniffing is computationally complex and hard to perpetrate.
Signup and view all the answers
Attacks that utilize cleartext protocols are more secure than those using strong encryption.
Attacks that utilize cleartext protocols are more secure than those using strong encryption.
Signup and view all the answers
Using a random string as a prefix or suffix with the password enhances security before encrypting it.
Using a random string as a prefix or suffix with the password enhances security before encrypting it.
Signup and view all the answers
Vertical privilege escalation involves acquiring the same level of privileges as another user.
Vertical privilege escalation involves acquiring the same level of privileges as another user.
Signup and view all the answers
Implementing multi-factor authentication can help defend against privilege escalation.
Implementing multi-factor authentication can help defend against privilege escalation.
Signup and view all the answers
Locking out an account after too many incorrect password guesses can prevent brute force attacks.
Locking out an account after too many incorrect password guesses can prevent brute force attacks.
Signup and view all the answers
Malicious applications executed during the attack phase are used to gather information and maintain access.
Malicious applications executed during the attack phase are used to gather information and maintain access.
Signup and view all the answers
Password cracking techniques are used to recover passwords from computer systems.
Password cracking techniques are used to recover passwords from computer systems.
Signup and view all the answers
Active online attacks involve the attacker communicating indirectly with the victim machine.
Active online attacks involve the attacker communicating indirectly with the victim machine.
Signup and view all the answers
Shoulder surfing is a type of non-electronic password attack.
Shoulder surfing is a type of non-electronic password attack.
Signup and view all the answers
Trojans can only be used for deleting files on a computer.
Trojans can only be used for deleting files on a computer.
Signup and view all the answers
Hiding files is a significant goal during the system hacking stage.
Hiding files is a significant goal during the system hacking stage.
Signup and view all the answers
Study Notes
Malware Threats
- Malware is malicious software designed to damage or disable computer systems, granting the creator limited or full control for theft or fraud.
- Examples of malware include Trojan Horses, viruses, backdoors, worms, rootkits, spyware, ransomware, botnets, adware, and crypters.
Ways Malware Enters Systems
- Instant messaging applications (IRC, etc.)
- Browser and email software bugs
- Removable devices
- Attachments
- Legitimate "shrink-wrapped" software (disgruntled employee)
- NetBIOS (FileSharing)
- Fake programs
- Untrusted sites and freeware
- Downloading files, games, and screensavers from Internet sites
Malware Distribution Techniques
- Blackhat SEO: Ranking malware pages highly in search results.
- Social Engineering (Clickjacking): Tricking users into clicking on innocent-looking webpages.
- Malvertising: Embedding malware in ad networks displayed across many legitimate sites.
- Spearphishing Sites: Mimicking legitimate institutions to steal login credentials.
- Compromised Legitimate Websites: Hosting embedded malware that spreads to visitors.
- Drive-by Downloads: Exploiting browser flaws to install malware by visiting a webpage.
How Hackers Use Trojans
- Delete or replace critical operating system files.
- Disable firewalls and antivirus.
- Generate fake traffic to create DDoS attacks.
- Record screenshots, audio, and video of victim's PC.
- Use victim's PC for spamming, blasting email messages, and downloading malicious files.
- Create backdoors to gain remote access.
- Infect victim's PC as a proxy server for relaying attacks.
- Use victim's PC as a botnet to perform DDoS attacks.
- Steal information like passwords, security codes, credit cards using keyloggers.
How to Infect Systems Using a Trojan (Steps)
- Create a new Trojan packet using a Trojan Horse Construction Kit.
- Create a dropper, which installs malicious code on the target system.
- Create a wrapper using wrapper tools to install Trojan on the victim's computer.
- Propagate the Trojan.
- Execute the dropper.
- Execute the damage routine.
Wrappers
- Bind a Trojan executable with an innocent-looking .EXE application, like games or office programs.
- Installation happens in the background while the application runs in the foreground.
- Two programs are wrapped into a single file.
- Attackers might send a birthday greeting that installs a Trojan.
Command Shell Trojans
- Give remote control of a command shell.
- Trojan server installed on the victim's machine opens a port for attacker connection.
- The attacker's client machine launches a command shell on the victim's machine.
Remote Access Trojans (RATs)
- Trojan works like a remote desktop access program.
- Hacker gains complete GUI access to the remote system.
- An attacker can control the infected computer remotely.
Botnet Trojans
- Infect a large number of computers geographically to create a network of controllable "bots" (Command and Control Center).
- Botnet is used to launch various attacks like denial-of-service attacks, spamming, click fraud, and theft of financial information.
Evading Anti-Virus Techniques
- Break the Trojan file into multiple pieces and zip them as a single file.
- Write your own Trojan and embed it in an application.
- Change Trojan's syntax (e.g., convert EXE to VB script, change extensions).
- Change content using a hex editor, alter checksum, and encrypt the file.
- Never use Trojans downloaded from the web.
Introduction to Viruses
- Self-replicating programs that spread by attaching to programs, boot sectors, or documents.
- Typically spread via downloads, infected drives, or email attachments.
- Virus Characteristics: Infects other programs, alters data, transforms itself, corrupts files, and encrypts or replicates itself.
Stages of Virus Life Cycle
- Design (developing the virus code).
- Replication (virus replicates in the system).
- Launch (virus gets activated, runs the infected program).
- Detection (the virus is identified as a threat).
- Incorporation (antivirus software developers create defenses against the virus).
- Elimination (users install antivirus software to remove virus threats).
Why People Create Computer Viruses
- Inflict damage to competitors
- Financial benefits
- Research projects
- Play pranks
- Vandalism
- Distribute political messages
- Cyberterrorism
How a Computer Gets Infected by Viruses
- Accepting files/downloads without checking the source.
Encryption Viruses
- Encipher the code with a different key for each affected file.
- Difficult for antivirus scanners to directly detect due to encryption.
Computer Worms
- Malicious programs that replicate, execute, and spread across networks independently.
- Created to replicate and spread across a network; some carry payloads to damage the system.
- Attackers use worms to install backdoors (turning computers into zombies), creating botnets for further attacks.
Worms vs. Viruses
- Worms replicate independently, spreading through networks.
- Worms don't need to attach themselves to another program, while viruses do.
Anti-Virus Sensor Systems
- Collection of software detecting and analyzing malicious code threats (viruses, worms, Trojans).
How to Detect Trojans
- Scan for suspicious open ports, running processes, files/folders, registry entries, network activities, device drivers and Windows services.
- Use Trojan scanners.
Trojan Countermeasures
- Avoid opening email attachments from unknown senders.
- Install operating system and application patches/updates.
- Block unnecessary ports using a firewall.
- Avoid accepting programs from instant messaging.
- Harden default configuration settings.
- Monitor internal network traffic.
- Scan CDs/DVDs with antivirus software.
- Restrict permissions in the desktop and avoid blindly installing programs.
- Maintain local workstation file integrity.
- Avoid downloading from untrusted sources.
- Use host-based AV, firewall, and intrusion detection software.
Backdoor Countermeasures
- Use commercial antivirus (scans and detects backdoor programs).
- Educate users not to install apps from untrusted sources and attachments.
- Use anti-virus tools (e.g., McAfee, Norton).
Virus and Worm Countermeasures
- Install anti-virus software to prevent and remove infections.
- Be attentive when downloading and pay attention to instructions.
- Avoid opening unknown sender attachments.
- Create an antivirus policy.
- Update the anti-virus software regularly.
- Back up data regularly as viruses can corrupt it.
- Don't accept disks or programs without proper checking.
- Use currently updated anti-virus software.
Virus and Worms Countermeasures (Continued)
- Ensure executable codes sent to organization is approved.
- Avoid booting with infected bootable disks.
- Know about the latest virus threats.
- Check DVDs/CDs for virus infections.
- Use pop-up blockers and internet firewalls.
- Run disk cleanup, registry scanner, and defragmentation.
- Turn on firewall if using Windows XP.
- Run anti-spyware/adware.
- Don't open files with multiple extensions.
- Be cautious about files transmitted via instant messaging.
Anti-Virus Tools
- (A list of common anti-virus tools is) included.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
This quiz covers various types of malware, including Trojan Horses and ransomware, as well as the methods through which malware can infiltrate systems. Understand how malware is distributed via techniques like Blackhat SEO and social engineering. Test your knowledge on security and protection against these threats.
