Malware Threats and Distribution Techniques

Malicious software designed to harm or disable computer systems, potentially granting control to the creator for theft or fraud.

A type of malware disguised as legitimate software, often used to gain unauthorized access to a system.

Ways attackers spread malware, including exploiting software bugs, social engineering tricks, and compromised websites.

Trojans can be used to delete files, disable security, generate attacks, create backdoors, and steal information, among other actions.

Creating the Trojan, adding a dropper to install it, using a wrapper to install, spreading it, and executing the dropper are steps in using a Trojan.

A malicious program that disguises itself as a legitimate application, installing a Trojan in the background and then running the legitimate program in the foreground.

A malicious program that gives attackers remote control of a command shell on a victim's computer.

A Trojan that allows hackers to gain complete graphical user interface (GUI) access to a remote computer.

A Trojan designed to create a network of infected computers (bots) controlled by an attacker (C&C center).

A self-replicating program that attaches itself to other programs, computer boot sectors, or documents, copying itself.

Viruses infect programs, alter data, replicate, corrupt files, and encrypt themselves. They're self-replicating.

A virus replicates within a system before spreading it.

Virus starts working when a user activates an infected program.

People create computer viruses for various motives, including causing damage, financial gain, research, pranks, vandalism, political messaging.

Self-replicating malicious program that spreads across a network automatically, often consuming resources.

Worms spread automatically through networks, while viruses need to attach to programs.

Viruses that encrypt files preventing access. Anti-virus often cannot detect them.

Downloading from unknown sources, opening infected email, using pirated software, incomplete program updates.

The process where a virus makes copies of itself to spread.

Antivirus software and updates eliminate viruses.

The act of monitoring and capturing network data packets passing through a network, like eavesdropping on network conversations.

A network interface card (NIC) setting that captures all data packets passing through it, regardless of the intended recipient, making it a powerful tool for sniffing.

Capturing network traffic without actively interfering, like a silent observer on a network.

A more aggressive form of sniffing that involves actively injecting packets into a network to control the flow of information.

A type of active sniffing where an attacker tricks devices into thinking they are a different network device, allowing them to intercept traffic normally meant for that device.

Intercepting network traffic to capture data packets, including passwords and sensitive information.

Communication protocols that send data in plain text, making them susceptible to sniffing attacks.

Sniffing data in the Data Link layer of the OSI model, where network traffic is captured, allowing attackers to see all the data.

A device that captures network traffic without altering it, used to monitor network activity and identify malicious traffic.

Attackers redirect traffic from the victim's machine to themselves, allowing them to capture sensitive information.

A device that captures and analyzes network data packets, providing insights into network communication.

The act of intercepting and monitoring communication between two parties without their consent.

Wiretapping that involves not only monitoring and recording but also altering or injecting data into the communication.

Wiretapping that solely monitors and records communication without interfering with it.

Legally authorized monitoring of data communication for the purpose of surveillance, usually by law enforcement agencies.

A data collection program designed by the NSA to intercept and analyze foreign intelligence passing through American servers.

To capture and analyze network traffic to understand communication patterns, identify security issues, and troubleshoot network problems.

Active wiretapping modifies the communication while passive wiretapping only monitors and records it.

To provide law enforcement agencies with legal access to intercepted data for investigations and to prevent crime.

It highlights concerns about government surveillance and data privacy, as it involves collecting large amounts of data from international communication.

Methods used to recover passwords from computer systems, often exploiting weak passwords. Attackers use these to gain unauthorized access.

Attackers don't need technical skills, relying on social engineering, observation, or physical access to obtain passwords.

Directly communicating with the victim's machine to crack passwords.

Password cracking without communicating with the victim's machine. Information is intercepted 'passively.'

Classifications of password cracking techniques based on how the attacker interacts with the target system.

An attacker copies a target's password file and attempts to crack passwords offline, outside the target's system.

A password cracking method that involves using a pre-compiled list of common words and phrases to try and guess passwords.

A method that systematically tries every possible combination of characters until the correct password is found.

A less frequent attack where an attacker manually attempts a list of possible passwords based on information gathered through social engineering or other means.

An attacker installs malicious software that secretly records keystrokes (passwords) and sends them to the attacker.

An attack where an attacker with a low-level account gains higher privileges, often using vulnerabilities in the OS or software to reach administrator level.

Gaining privileges higher than your current ones, like going from a standard user to an administrator.

Acquiring the same level of privileges you already have, but taking on the identity of another user with those privileges.

Limiting the ability to log in directly to a system with administrative privileges, making unauthorized access harder.

When attackers run malicious programs on a compromised machine to steal information, gain access, or install backdoors.

An attacker copies downloaded files to a USB drive. When inserted, the autorun feature (if enabled) executes a program (e.g., PassView), capturing passwords and saving them to a text file on the drive. The attacker then extracts the passwords from the file.

Attackers use packet sniffer tools to monitor and record all network traffic on a local area network (LAN). This can capture sensitive information like passwords, emails, and other data.

Attackers capture network packets containing authentication tokens using a sniffer. They then replay these tokens on the network to gain unauthorized access to the target system.

Attackers use precomputed tables containing lists of passwords and their corresponding hash values. They then compare captured password hashes to the table to find matches and crack passwords.

A set of rules that dictate how often users must change their passwords and what criteria they must meet. A strong policy can make password cracking less effective.