Chapter 11 - Trojans & Other Attacks Flashcards
1
Q
Overt Channesl vs Covert Channels
A
Overt - legitimate communication channels used by programs. Covert Channels - Used to transport data in unintended ways.
2
Q
Wrappers
A
Programs that allow you to bind an executable to an innocent file
3
Q
Crypters
A
Use a combination of encryption and code manipulation to render malware undetectable to security programs.
4
Q
Packers
A
Use compression to pack the executable which helps evade signature based detection.
5
Q
Infinity
A
Exploit Kit
6
Q
Bleeding Life
A
Exploit Kit
7
Q
Crimepack
A
Exploit Kit
8
Q
Blackhole
A
Exploit Kit
9
Q
What is an exploit kit?
A
Helps deliver exploits and payloads.
10
Q
Proxy Server Trojan
A
Allows attacker to use the target system as a proxy.’
11
Q
Chebacca
A
Botnet Trojan
12
Q
Skynet
A
Botnet Trojan
13
Q
Botnet Trojan
A
Turns the computer into bot
14
Q
RAT
A
Remote access Trojan
15
Q
MoSucker
A
Remote Access Trojan
16
Q
Optix Pro
A
Remote Access Trojan
17
Q
Blackhole
A
Remote access trojan
18
Q
Zeus
A
E-Banking Trojans
19
Q
Spyeye
A
E-Banking Trojans
20
Q
Command Shell Trojan
A
Provides a backdoor to connect to through command-line access
21
Q
Netcat
A
With malicious intent, can be considered as a trojan
22
Q
Trojan - Death
A
Port 2
23
Q
Trojan - Senna Spy
A
Port 20
24
Q
Trojan - Hacker’s Paradise
A
Port 31, 456
25
Trojan - TCP Wrappers
Port 421
26
Trojan - Doom, Satanz Backdoor
Port 666
27
Trojan - Silencer, WebEx
Port 1001
28
Trojan - RAT
Port 1095-98
29
Trojan - SubSeven
Port 1243
30
Trojan - Shiva-Burka
Port 1600
31
Trojan - Trojan Cow
Port 2001
32
Trojan - Deep Throat
Port 6670-71
33
Trojan - Tini
Port 7777
34
Trojan - NetBus
Port 12345-6
35
Trojan - Whack a Mole
Port 12361-3
36
Trojan - Black Orifice
Port 31337, 31338
37
Netstat -an
Shows open ports in numerical order
38
Netstat -b
Displays all active connections and the processing using them
39
Process Explorer
Microsoft tool that shows you everything about running processes
40
SysAnalyzer
Registry monitoring tool
41
Tiny Watcher
Registry monitoring tool
42
Active Registry Monitor
Registry monitoring tool
43
Regshot
Registry monitoring tool
44
Msconfig
Windows program that shows all programs set to start on startup
45
Tripwire
Integrity verifier that can act as a HIDS in protection against trojans
46
SIGVERIF
built into Windows to verify the integrity of the system. Log file can be found at c:\windows\system32\sigverif.txt
47
Virus
Self-replicating program that reproduces by attaching copies of itself into other executable code. . Usually installed by user .
48
Ransomware
Malicious software designed to deny accesss to a computer until a price is paid; usually spread via email.
49
WannaCry
Famous ransomware. Within 24 hours, had 230,000 victims; exploited unpatched SMB
50
Cryptorbit
Ransomware type
51
Cryptolocker
Ransomware type
52
CryptoDefense
Ransomware type
53
Boot Sector Virus
Known as system virus; moves boot sector to another location and then inserts code into the original location.
54
Shell Virus
Wraps around an application's code, inserting itself before the application's
55
Cluster Virus
Modifies directory table entries so every time a file or folder is opened, the virus runs.
56
Multipartite Virus
Attempts to infect both boot sector and files; generally referred to as virus with multiple infection methods
57
Macro Virus
Written in VBA ; infects template files - mostly Word and Excel
58
Polymorphic Code Virus
Mutates its code by using a polymorphic engine; difficult to find because code is always changing.
59
Encryption Virus
Uses encryption to hide the code from antivirus
60
Metamorphic Virus
Rewrites itself every time it infects a new file.
61
Stealth Virus
Known as tunneling virus; attempts to evade Avs by intercepting their requests and returning them instead of letting them pass to the OS
62
Cavity Virus
Overwrite portions of host files as to not increase the actual size of the file; uss null content sections
63
Sparse Infector Virus
Only infects occasionally (e.g. every 10th time)
64
File Extension Virus
Changes the file extensions of files to take advantage of most people having them turned off (readme.txt.vbs shows as readme.txt
65
Sonic Bat
Virus maker
66
Poison
Virus maker
67
Sam's Virus Generator
Virus maker
68
IPS Virus Maker
Virus maker
69
Worm
Self-replicating malware that sends itself to other computers without human intervention. Often used in botnets, resides in active memory.
70
Ghost Eye Worm
Hacking tool that uses random messaging on Facebook and other sites to perform a host of malicious efforts
71
What are the steps to analyzing malware?
1. Use a VM with NIC in host-only mode and no open shares. 2. Analyze the malware on the isolated VM in a static state. 3. Run the malware and check out processes . 4. Check and see what files are added, changed, or deleted.
72
What is a Sheepdip system
A system that is used to check things introduced into a network. It is Airgapped.
73
Botnets can be controlled over…
HTTP, HTTPS, IRC, ICQ
74
DDoS Attack Category - Fragmentation Attacks
Attacks take advantage of the system's ability to reconstruct fragmented packets.
75
DDoS Attack Category - Volumetric Attacks
Bandwidth attacks; consume all bandwidth for the system of service.
76
DDoS Attack Category - Application Attacks
Consume the resources necessary for the application to run. Usually against weak code.
77
DDoS Attack Category - TCP-State-exhaustion attacks
Go after load balancers, firewalls, and application servers.
78
DDoS Attack - SYN Attack
Send thousands of SYN packets to the machine with a false source address; eventually engages all resources and exhausts the machine.
79
DDoS Attack - SYN Flood
Sends thousands of SYN packets to; but does NOT SPOOF IP but doesn't respond to SYN/ACK
80
DDoS Attack - ICMP Flood
Sends ICMP Echo packets with a spoofed address; eventually reaches limit of packets per second sent.
81
DDoS Attack - Smurf Attack
Sending a large number of pings to the broadcast address of the subnet with source IP spoofed as the target; entire subnet responds exhausting the target.
82
DDoS Attack - Fraggle
Same as smurf but with UDP packets
83
DDoS Atttack - Ping of Death
Fragments ICMP messages; after reassembled, the ICMP packet is larger than the maximum size and crashes the system.
84
DDoS Attack - Teardrop
Overlaps a large number of garbled IP fragments with oversized payloads; causes older systems to crash due to fragment reassembly.
85
DDoS Attack - Peer to Peer
clients of peer-to-peer file sharing hub are disconnected and directed to connect to the target system.
86
DDoS Attack - Phlashing
A DoS attack that causes permanent damage to a system; also called bricking a system.
87
DDoS Attack - LAND attack
Sends a SYN packet to the target with a spoofed IP the same as the target; if vulnerable, target loops endlessly and crashes.
88
Low Orbit Ion Cannon (LOIC)
DDoS tool that floods target with TCP, UDP, or HTTP requests.
89
Trinity
Linux based DDoS tool
90
Tribe Flood Network
Uses voluntary botnet systems to launch massive flood attacks
91
R-U-Dead-Yet (RUDY)
DoS with HTTP POST via long-for field submissions.
92
Session Hijacking
Attacker waits for session to begin and after the victim authenticates, steals the session for himself.
93
Session Hijacking steps are:
1. Sniff traffic between client and server. 2. Monitor the traffic and predict the sequence number. 3. Desynchronize the session with the client. 4. Predict the session token and take over the session. 5. Inject packets to target server.
94
Session Hijacking can be predicted by looking at _____________
Predicting can be done by knowing the window size and the packet sequence number. Sequence number increment on Acknowledgement. For example, an ACK of 105 with a window of 200 means you could expect sequence numbering from 105 to 305.
95
Ettercap
Man-in-the middle tool and packet sniffer on steroids.
96
Hunt
Sniff, hijack and reset connections
97
T-Sight
Easily hijack sessions and monitor network connections
98
Zaproxy
Session Hijacking tool
99
Paros
Session Hijacking tool
100
Burp Suite
Session Hijacking tool
101
Juggernaut
Session Hijacking tool
102
Hamster
Session Hijacking tool
103
Ferret
Session Hijacking tool
104
How can you defend against session hijacking?
Using unpredictable session IDs - Limiting incoming connections. - Minimizing remote access. - Regenerating the session key after authentication. - Use IPSec to encrypt
105
IPSec - Transport Mode
Payload and ESP trailer are encrypted; IP header is NOT
106
IPSec - Tunnel Mode
Everything is encrypted; cannot be used with NAT
107
IPSec - Authentication Header
Guarantees the integrity and authentication of IP packet sender
108
IPSec - Encapsulating Security Payload (ESP)
Proivdes origin authenticity and integrity as well as confidentiality.
109
IPSec - Internet Key Exchange (IKE)
Produces the keys for the encryption process.
110
IPSec - Oakley
Uses Diffie-Hellman to create master and session keys.
111
Internet Security Association Key Management Protocol (ISAKMP)
Software that facilitates encrypted communication between two endpoints.
