Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Core 2 > 2.3 Malware Detection, Removal and Prevention > Flashcards

2.3 Malware Detection, Removal and Prevention Flashcards

1
Q

Define social engineering

A

Any attempt to manipulate users to reveal confidential information or perform actions detrimental to a system’s security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Phishing

A

A social engineering attack where the malicious actor communicates with he victim from a supposedly reputable source to lure the victim into divulging sensitive information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What can the response rate be up to for generic phishing campaigns?

A

60-70% (with good grammar)
30-40% (with bad grammar)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Spearphishing

A

A more targeted version of phishing using mainly the same techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Whaling

A

Focused on key executives within an organisation or other key leaders, executives and managers in the company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the most effective form of phishing in a pentest?

A

Whaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Smishing

A

Phishing over SMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Vishing

A

Message being communicated to the target using the voice functions of a telephone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

BEC

A

An attacker takes over or impersonates a high-level executive’s email account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Pharming

A

Tricking users into divulging private information by redirecting a victim to a website controlled by the attacker or pentester

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How can attackers execute pharming?

A

Redirects, popups, URL masking, background processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Malware

A

Software that is designed to infiltrate and damage a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Boot sector virus

A

Viruses stored in the first sector of a hard drive and loaded into memory upon boot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Macro (virus)

A

Virus embedded into a document and executed when the document is opened

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Why is it called a macro?

A

Because it is written in the same macro language used to create software programs (e.g. Excel, Word)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Program virus

A

Viruses that seek out executables or applications to infect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When are program viruses launched?

A

When the program is installed or executed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Name three ways program viruses can infect a computer.

A

CD, removable media, email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Multipartite

A

A virus that combines boot and program viruses to attach to boot sector and system files before attacking other files on the computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How do multipartite viruses propagate?

A

Through compromised files, downloads, or bootable media

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Self-encryption

A

When a virus uses a cipher to encrypt its contents and avoid detection by AV software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Polymorphic

A

Advanced encrypted virus that changes the code after every infection, varying encryption keys to avoid detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Metamorphic

A

Viruses able to rewrite their own code entirely without an encryption key

24
Q

Stealth

A

A broad category to describe any virus that attacks while trying to avoid detection by AV software

25
Q

How do stealth viruses avoid detection?

A

It copies itself between files and replaces itself with a “clean” file

26
Q

Armored

A

A virus designed to conceal the code by encrypting the payload, making it difficult to detect and analyse

27
Q

Hoax

A

A warning about a nonexistent computer virus designed to trick a user into infecting their own machine

28
Q

Worm

A

A standalone malware program that replicates itself on a network in order to spread to other users

29
Q

Trojan

A

A type of malware disguised as a legitimate program

30
Q

How does ransomware gain access to a computer to encrypt files?

A

By using vulnerabilities in the software

31
Q

Spyware

A

Malware that secretly gathers information about the user without their consent

32
Q

Adware

A

Malicious software that secretly installs itself onto a device and displays unwanted advertisements and popups.

33
Q

Grayware

A

Applications or files that are not classified as malware but can worsen the performance of computers and/or cause security risks

34
Q

Rootkit

A

Software designed to gain admin level control over a system without detection, often made up of a collection of certain tools

35
Q

Name three ways rootkits can be downloaded onto a computer

A
  • DLL Injection
  • Driver Manipulation
  • Shim
36
Q

Shim

A

A piece of software code that is placed between two components to intercept API calls and redirect them

37
Q

Driver manipulation

A

Compromising the kernel-mode device drivers that operate at a privileged or system level

38
Q

DLL Injection

A

Malicious code is inserted into a running process on a Windows machine by taking advantage of DLL libraries that are loaded at runtime

39
Q

DLL

A

Dynamic Link Library

40
Q

Zombie

A

A computer connected to the internet that has been compromised by a hacker

41
Q

Botnet

A

A collection of compromised computers under the control of a master node

42
Q

DDoS

A

Many machines targeting a single victim at the same time

43
Q

If you are looking at files and folders, what are some symptoms that a PC might be infected?

A
  • Hard drives/files/applications no longer accessible
  • Double file extensions being displayed
  • New files/folders created
  • Files/folders missing or corrupted
44
Q

Give five symptoms (not related to files) that may indicate an infected computer

A
  • Strange noises
  • Unusual error messages
  • Display looks strange
  • Jumbled printouts
  • System Restore won’t function
45
Q

List the seven steps of removing malware

A
  1. Identify the symptoms of a malware infection
  2. Quarantine the infected systems
  3. Disable System Restore
  4. Remediate the infected system
  5. Schedule automatic updates and scans
  6. Enable System Restore and create a new restore point
  7. Provide end user security awareness training
46
Q

How do you scan a computer for a boot sector virus?

A

Reboot the computer from an external device and scan it; then remove the hard drive and connect as a secondary drive to a clean workstation and scan it also

47
Q

What three types of malware are best detected with anti-malware solutions?

A

Worms, trojans and ransomware

48
Q

Give two simple protections against malware

A

Updating OS regularly and having a good host-based firewall.

49
Q

Give three steps for protecting against malware sent over email

A
  1. Remove email addresses from website
  2. Use allowlist and blocklists
  3. Train and educate end users
50
Q

Give three steps for protecting against downloadable malware

A
  1. Update your anti-malware software automatically and scan your computer
  2. Update and patch the operating system and applications regularly
  3. Educate and train end users on safe internet surfing practices
51
Q

What are two ways email servers should not be configured?

A

Open mail relays/SMTP open relays

52
Q

What is the best firewall setup?

A

Personal software-based and a network-based (preferably hardware) to provide two layers of protection

53
Q

What is iptables?

A

A firewall utility for Linux operating systems

54
Q

Briefly overview how iptables works.

A

It compares network traffic against a set of rules and rejects packets that don’t match the rules

55
Q
A

Core 2 (26 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions