Chapter 03: Malicious Code Flashcards
______ describes a wide range of software that is intentionally designed to cause harm to systems and devices, networks, or users. It can also gather info provide illicit access, and take a broad range of actions that the legitimate owner of a system or network may not want to occur.
Malware
_____ is malware that takes over a computer and then demands a ransom.
Ransomware
Defense against ransomware.
Effective backup system that stores files in a separate location that will not be impact if the system or device it backs up is infected and encrypted by ransomware.
crypto malware is an example of ______.
Ransomware
_____ are a type of malware that is typically disguised as legitimate software.
Trojans
______ provide attackers with remote access to systems.
Remote Access Trojans
Defense against Trojans
Security Awareness training
True or False: Every Trojan is a Remote Access Trojan.
False. A Remote Access Trojan is a subject of a Trojan. But, not every Trojan is a remote access Trojan.
____ are self-install and spread themselves.
Worms
Stuxnet is an example of a ___.
Worm
_______ are malware that is specifically designed to allow attackers to access a system through a backdoor.
Rootkits
What are the ways to detect a rootkit on a computer?
- Testing the suspected system from a trusted system or device.
- Rootkit detection tools
What is a common recommendation for removing rootkits?
Restore from a good last known backup
_____ are methods or tools that provide access that bypasses normal authentication and authorization procedures, allowing attackers access to systems, devices, or applications.
Backdoor
Detection for backdoors.
- Unexpected ports
- Unexpected services
Note: More advanced backdoors may be leveraging existing services.
_____ are remotely controlled systems or devices that have a malware infection.
Bots
Groups of bots are known as ______.
Botnets
_____ are used by attackers who control them to perform various actions, ranging from additional compromises and infection, to Denial-of-service attacks or acting as spam relays.
Botnets
Many botnet _______ systems operate in a client-server mode. For example, they will contact the _____ systems, which provide commands and updates, and track how many systems are in the botnet.
COC (Command and Control)
____ was frequently used to manage client-server botnets in the past, but many modern botnets rely on HTTPS traffic to hide C&C traffic and to prevent it from easily being monitored and analyzed by defenders.
Internet Relay Chat (IRC)
_____ are programs that capture keystrokes from keyboards.
Keyloggers
Name a defence against Keylogger
Use multifactor Authentication (MFA)
______ are not independent malicious programs. Instead, they are functions or code that are placed inside other programs that will activate when set conditions are met.
Logic bombs
_____ are malicious programs that self-copy and self-replicate. These typically have a trigger and a payload.
Computer Viruses
Payload
What the virus does, delivers, or the actions it performs.
Trigger
Sets conditions for the virus to execute.
______ remains in memory while the system of device is running.
Memory-resident viruses
_____ which will execute, spread and then shut down.
Non-memory resident Virus
____ which use macros or code inside word processing software or other tools to spread.
Macro Viruses
____ which spread via email either as attachments or as part of the email itself using flaws within email clients.
Email Viruses
_____ attacks are similar to traditional viruses in a number of critical ways. They spread via methods like spam email and malicious websites, and they exploit flaws in browser plug-ins and web browsers themselves.
Fileless Viruses
_____ is malware that is designed to obtain information about an individual, organization, or system.
Spyware
____ is a type of spyware used to illicitly monitor partners in a relationships.
stalkerware
Spyware Defense
- Antimalware tools
- User awareness
______ are programs not wanted by the user but are not as dangerous as other types of malware. These are typicall installed without the user’s awareness or as part of a software bundle.
Potentially Unwanted Programs (PUP)
____ include adware, browser toolbars, web browser-tracking programs, and others.
PUPs
______ is where AI is used by attackers for malicious purposes.
Adversarial Artificial Intelligence
