Podcast
Questions and Answers
Malware can only get into a system through removable devices.
Malware can only get into a system through removable devices.
False
Social Engineered Click-jacking is a technique where users are tricked into clicking on seemingly harmless webpages.
Social Engineered Click-jacking is a technique where users are tricked into clicking on seemingly harmless webpages.
True
Drive-by Downloads require users to actively download malware from a website.
Drive-by Downloads require users to actively download malware from a website.
False
A Trojan can be used to disable a computer's firewall and antivirus software.
A Trojan can be used to disable a computer's firewall and antivirus software.
Signup and view all the answers
Ransomware is a type of malware designed to record audio and video from a victim's computer.
Ransomware is a type of malware designed to record audio and video from a victim's computer.
Signup and view all the answers
A wrapper binds a Trojan executable with an innocent looking application, allowing it to install in the background while showing a fake interface.
A wrapper binds a Trojan executable with an innocent looking application, allowing it to install in the background while showing a fake interface.
Signup and view all the answers
Botnet Trojans can only infect computers within a localized area, limiting their reach.
Botnet Trojans can only infect computers within a localized area, limiting their reach.
Signup and view all the answers
Changing a Trojan's syntax, such as converting an EXE file to VB script, is a technique used to evade anti-virus detection.
Changing a Trojan's syntax, such as converting an EXE file to VB script, is a technique used to evade anti-virus detection.
Signup and view all the answers
A Remote Access Trojan allows an attacker to gain complete GUI access to a victim's machine.
A Remote Access Trojan allows an attacker to gain complete GUI access to a victim's machine.
Signup and view all the answers
Viruses are programs that require a user to run them in order to replicate and spread.
Viruses are programs that require a user to run them in order to replicate and spread.
Signup and view all the answers
A virus cannot replicate itself without human interaction.
A virus cannot replicate itself without human interaction.
Signup and view all the answers
Encryption viruses can be detected directly using standard signature detection methods.
Encryption viruses can be detected directly using standard signature detection methods.
Signup and view all the answers
Computer worms require user interaction to spread across a network.
Computer worms require user interaction to spread across a network.
Signup and view all the answers
The incorporation stage of a virus life cycle involves the development of new variants of the virus.
The incorporation stage of a virus life cycle involves the development of new variants of the virus.
Signup and view all the answers
Vandalism is one of the reasons people might create computer viruses.
Vandalism is one of the reasons people might create computer viruses.
Signup and view all the answers
Self-replication is a characteristic of computer viruses.
Self-replication is a characteristic of computer viruses.
Signup and view all the answers
Installing pirated software can potentially lead to a computer being infected by viruses.
Installing pirated software can potentially lead to a computer being infected by viruses.
Signup and view all the answers
Computer worms can attach themselves to other programs like viruses do.
Computer worms can attach themselves to other programs like viruses do.
Signup and view all the answers
The launch stage of a virus' life cycle occurs when it is activated by the user.
The launch stage of a virus' life cycle occurs when it is activated by the user.
Signup and view all the answers
Antivirus software can effectively eliminate all types of computer viruses without regular updates.
Antivirus software can effectively eliminate all types of computer viruses without regular updates.
Signup and view all the answers
Passive sniffing requires the use of switches to capture all network traffic.
Passive sniffing requires the use of switches to capture all network traffic.
Signup and view all the answers
Active sniffing techniques can mislead a switch's Content Addressable Memory table.
Active sniffing techniques can mislead a switch's Content Addressable Memory table.
Signup and view all the answers
In promiscuous mode, a network interface controller (NIC) can capture traffic intended for all devices on a network segment.
In promiscuous mode, a network interface controller (NIC) can capture traffic intended for all devices on a network segment.
Signup and view all the answers
Modern networks primarily utilize hubs to send traffic to all connected devices.
Modern networks primarily utilize hubs to send traffic to all connected devices.
Signup and view all the answers
Sniffing is simply the act of sending packets within a network to observe traffic patterns.
Sniffing is simply the act of sending packets within a network to observe traffic patterns.
Signup and view all the answers
Protocols vulnerable to sniffing do not include HTTPS.
Protocols vulnerable to sniffing do not include HTTPS.
Signup and view all the answers
A hardware protocol analyzer is designed to change the network traffic it captures.
A hardware protocol analyzer is designed to change the network traffic it captures.
Signup and view all the answers
Sniffers can operate independently of the upper layers of the OSI model.
Sniffers can operate independently of the upper layers of the OSI model.
Signup and view all the answers
Keystrokes including user names and passwords are protected when transmitted over Telnet.
Keystrokes including user names and passwords are protected when transmitted over Telnet.
Signup and view all the answers
The initial compromise occurs at the Physical layer of the OSI model.
The initial compromise occurs at the Physical layer of the OSI model.
Signup and view all the answers
Active wiretapping only monitors and records the traffic without altering it.
Active wiretapping only monitors and records the traffic without altering it.
Signup and view all the answers
Wiretapping without a warrant or consent is considered legal in most countries.
Wiretapping without a warrant or consent is considered legal in most countries.
Signup and view all the answers
Lawful interception requires a court order for intercepting data communication.
Lawful interception requires a court order for intercepting data communication.
Signup and view all the answers
Keysight N2X N5540A is classified as a protocol analyzer hardware.
Keysight N2X N5540A is classified as a protocol analyzer hardware.
Signup and view all the answers
PRISM is a tool designed for monitoring domestic data communication exclusively.
PRISM is a tool designed for monitoring domestic data communication exclusively.
Signup and view all the answers
Passive wiretapping can alter the content of the communication being monitored.
Passive wiretapping can alter the content of the communication being monitored.
Signup and view all the answers
The FLUKE Networks OptiView® XG Network Analyzer is one of the tools used for wiretapping.
The FLUKE Networks OptiView® XG Network Analyzer is one of the tools used for wiretapping.
Signup and view all the answers
An access switch/tap is used in lawful interception to monitor data communication.
An access switch/tap is used in lawful interception to monitor data communication.
Signup and view all the answers
Wiretapping can only be done for traditional telecommunications and not for VoIP.
Wiretapping can only be done for traditional telecommunications and not for VoIP.
Signup and view all the answers
The NSA uses PRISM to wiretap a large volume of domestic internet traffic.
The NSA uses PRISM to wiretap a large volume of domestic internet traffic.
Signup and view all the answers
A dictionary attack uses a file loaded with potential password combinations to crack user accounts.
A dictionary attack uses a file loaded with potential password combinations to crack user accounts.
Signup and view all the answers
Rainbow tables are an example of an online attack where the attacker cracks passwords in real-time on the victim's system.
Rainbow tables are an example of an online attack where the attacker cracks passwords in real-time on the victim's system.
Signup and view all the answers
Brute forcing attacks attempt every possible password combination until the correct one is found.
Brute forcing attacks attempt every possible password combination until the correct one is found.
Signup and view all the answers
Default passwords are unique to each individual device and cannot be exploited by attackers.
Default passwords are unique to each individual device and cannot be exploited by attackers.
Signup and view all the answers
Trojan, spyware, and keylogger attacks involve physically infecting a victim's machine without their knowledge.
Trojan, spyware, and keylogger attacks involve physically infecting a victim's machine without their knowledge.
Signup and view all the answers
Password cracking techniques are only used through electronic means.
Password cracking techniques are only used through electronic means.
Signup and view all the answers
Escalating privileges in system hacking refers to acquiring the rights of another user or an admin.
Escalating privileges in system hacking refers to acquiring the rights of another user or an admin.
Signup and view all the answers
Covering tracks involves creating evidence of compromise.
Covering tracks involves creating evidence of compromise.
Signup and view all the answers
Active online attacks require the attacker to communicate directly with the victim machine.
Active online attacks require the attacker to communicate directly with the victim machine.
Signup and view all the answers
Rootkits are primarily used for password cracking.
Rootkits are primarily used for password cracking.
Signup and view all the answers
In a replay attack, an attacker captures packets and authentication tokens and uses them later to gain access.
In a replay attack, an attacker captures packets and authentication tokens and uses them later to gain access.
Signup and view all the answers
Rainbow table attacks make it extremely difficult to recover passwords from captured hashes.
Rainbow table attacks make it extremely difficult to recover passwords from captured hashes.
Signup and view all the answers
Packet sniffing tools can only capture data over wireless networks.
Packet sniffing tools can only capture data over wireless networks.
Signup and view all the answers
Enabling information security audits is an effective measure against password attacks.
Enabling information security audits is an effective measure against password attacks.
Signup and view all the answers
Man-in-the-Middle attacks are relatively easy to perpetrate as it does not require trust from any party.
Man-in-the-Middle attacks are relatively easy to perpetrate as it does not require trust from any party.
Signup and view all the answers
Vertical privilege escalation involves assuming the identity of another user with the same privileges.
Vertical privilege escalation involves assuming the identity of another user with the same privileges.
Signup and view all the answers
Using a strong password for SYSKEY is recommended to protect the SAM database.
Using a strong password for SYSKEY is recommended to protect the SAM database.
Signup and view all the answers
Running users and applications on the least privileges is a method to prevent privilege escalation.
Running users and applications on the least privileges is a method to prevent privilege escalation.
Signup and view all the answers
Monitoring logs for brute force attacks is unnecessary if accounts are locked after multiple incorrect guesses.
Monitoring logs for brute force attacks is unnecessary if accounts are locked after multiple incorrect guesses.
Signup and view all the answers
Encrypting sensitive data can protect it from unauthorized access during privilege escalation attacks.
Encrypting sensitive data can protect it from unauthorized access during privilege escalation attacks.
Signup and view all the answers
Study Notes
Malware Threats
- Malware is malicious software damaging or disabling systems, giving the creator control for theft or fraud.
- Examples include Trojan horses, viruses, backdoors, worms, rootkits, spyware, ransomware, botnets, adware, and crypters.
Malware Entry Points
- Malware can enter systems via instant messenger applications (like IRC), removable devices, email attachments, malicious software disguised as legitimate software, browser/email bugs, NetBIOS (file-sharing), fake programs, untrusted websites/freeware, or downloads from internet sites.
Malware Distribution Techniques
- Blackhat SEO: Ranking malware pages highly in search results.
- Malvertising: Embedding malware in legitimate, high-traffic ad networks.
- Spearphishing: Mimicking legitimate institutions to steal login credentials.
- Compromised Websites: Hosting malware that spreads to visitors.
- Drive-by Downloads: Exploiting browser flaws to install malware on web visits.
Trojan Horse Usage by Hackers
- Trojans allow hackers to delete or replace critical system files.
- They can disable firewalls and antivirus.
- Trojans also generate fake traffic to create denial-of-service attacks (DoS).
- Recording victim's screen activity, audio, and video is also possible.
- Hackers use victim's PC for spamming and email blasting and malicious software downloads.
- Information theft includes passwords, security codes, credit card data via keylogging.
Trojan Infections
- Create a new Trojan packet via Trojan Horse Construction Kit.
- Create a dropper to install malicious code on the target system.
- Executable files or applications may be wrapped.
- Trojans are installed on the victim's machine by a wrapper.
- The trojan will propagate to other systems.
- Execute the damage routine specified beforehand.
Wrappers
- Bind a Trojan executable to an innocent-looking application (e.g., game, office app).
- Install the Trojan in the background after the user runs the wrapped application.
- Two programs can be wrapped into one file, creating confusion for users.
- Attackers often send birthday greetings or other enticing elements inside the wrapped Trojan.
Command Shell Trojans
- Provides remote control of a command shell on the victim's machine.
- The Trojan server is installed, opening a port for the attacker's client to connect.
- An attacker's client runs a command shell on the victim's machine to launch attacks.
Remote Access Trojans (RATs)
- This Trojan allows complete remote desktop access.
- Complete GUI control over the remote system is possible.
- The attacker gains complete access once the reverse connection is established.
- Typically employs a server.exe file to infect a system and establish a connection to the attacker.
Botnet Trojans
- Infects numerous computers forming a botnet.
- The botnet is controlled by a central command and control (C&C) server.
- Launching attacks, like denial of service, spamming, click fraud, or financial data theft, are possible using botnets.
Evading Antivirus
- Splitting the Trojan file into multiple pieces and zipping it.
- Writing a customized Trojan and embedding it into an application.
- Changing the Trojan's syntax (e.g., converting .EXE to VB script, changing extensions).
- Modifying the Trojan's content using hex editors to change checksums and encrypt the file.
- Avoid using Trojans downloaded from the web as antivirus can usually detect them.
Computer Viruses
- Self-replicating programs that attach to other programs, boot sectors, or documents.
- Common transmission methods include file downloads, infected media, and email attachments.
- Virus characteristics include infecting other programs, altering data, corrupting files, transforming itself, encrypting itself, replicating itself.
Virus Life Cycle
- Design: Virus code development.
- Replication: Virus copies itself within the target system.
- Launch: Triggered by user action.
- Detection: Antivirus detects the virus.
- Incorporation: Antivirus learns to fight against the virus and integrates defenses against it.
- Elimination: Users remove the virus.
Reasons for Creating Viruses
- Damage to competitors.
- Financial gain.
- Research projects.
- Play pranks.
- Vandalism.
- Spreading political messages.
- Cyber-terrorism.
Virus/Worm Infection
- Acceptance of files that users downloaded without verifying the source.
- Opening infected email attachments.
- Installing pirated software.
- Failure to update or install updated plug-ins.
- Not having the latest antivirus application installed and running.
Encryption Viruses
- Simple encryption encrypts code.
- Different encryption keys for each infected file create detection challenges for antivirus software via signatures.
Computer Worms
- Self-replicating programs but do not attach to other files.
- Propagate via network connections independently.
- Can spread quickly and consume network resources.
- May include payload to damage the infected system.
- Attackers create backdoors in infected computers to create zombie armies for further attacks.
Worm vs. Virus
- Worms replicate independently, while viruses need hosts.
- Worms leverage network features to spread; viruses usually attach to files.
- Worms do not need to attach to other programs, whereas viruses often do.
Antivirus Sensor Systems
- Detects and analyzes malicious threats (e.g., viruses, worms, Trojans).
- Monitors network traffic, checking for malicious code.
- Implements various detection mechanisms on different systems.
Detecting Trojans
- Scan suspicious open ports.
- Scan for suspicious startup programs.
- Scan running processes.
- Scan for suspicious files and folders.
- Examine registry entries.
- Monitor network activities.
- Look for suspicious device drivers.
- Check for Windows services.
- Execute a Trojan scanner.
Trojan Countermeasures
- Prevent opening email attachments from strangers.
- Keep operating systems and applications updated.
- Block unnecessary ports on firewalls.
- Use strong and updated password practices.
- Update virus detection software regularly.
- Exercise caution when downloading and running applications.
Backdoor Countermeasures
- Install and regularly update trusted antivirus products.
- Educate users not to download or run programs from unknown sources.
- Utilize robust antivirus tools to scan for and remove backdoors.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
This quiz covers the various types of malware, their entry points, and distribution techniques. Learn how malware can affect systems and the methods used by cybercriminals to infiltrate networks. Test your knowledge on recognizing and preventing these threats.
