Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CEH > Chapter 11 - Trojans & Other Attacks > Flashcards

Chapter 11 - Trojans & Other Attacks Flashcards

1
Q

Overt Channesl vs Covert Channels

A

Overt - legitimate communication channels used by programs. Covert Channels - Used to transport data in unintended ways.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Wrappers

A

Programs that allow you to bind an executable to an innocent file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Crypters

A

Use a combination of encryption and code manipulation to render malware undetectable to security programs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Packers

A

Use compression to pack the executable which helps evade signature based detection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Infinity

A

Exploit Kit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Bleeding Life

A

Exploit Kit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Crimepack

A

Exploit Kit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Blackhole

A

Exploit Kit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is an exploit kit?

A

Helps deliver exploits and payloads.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Proxy Server Trojan

A

Allows attacker to use the target system as a proxy.’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Chebacca

A

Botnet Trojan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Skynet

A

Botnet Trojan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Botnet Trojan

A

Turns the computer into bot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

RAT

A

Remote access Trojan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

MoSucker

A

Remote Access Trojan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Optix Pro

A

Remote Access Trojan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Blackhole

A

Remote access trojan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Zeus

A

E-Banking Trojans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Spyeye

A

E-Banking Trojans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Command Shell Trojan

A

Provides a backdoor to connect to through command-line access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Netcat

A

With malicious intent, can be considered as a trojan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Trojan - Death

A

Port 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Trojan - Senna Spy

A

Port 20

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Trojan - Hacker’s Paradise

A

Port 31, 456

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Trojan - TCP Wrappers

A

Port 421

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Trojan - Doom, Satanz Backdoor

A

Port 666

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Trojan - Silencer, WebEx

A

Port 1001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Trojan - RAT

A

Port 1095-98

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Trojan - SubSeven

A

Port 1243

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Trojan - Shiva-Burka

A

Port 1600

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Trojan - Trojan Cow

A

Port 2001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Trojan - Deep Throat

A

Port 6670-71

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Trojan - Tini

A

Port 7777

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Trojan - NetBus

A

Port 12345-6

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Trojan - Whack a Mole

A

Port 12361-3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Trojan - Black Orifice

A

Port 31337, 31338

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Netstat -an

A

Shows open ports in numerical order

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Netstat -b

A

Displays all active connections and the processing using them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Process Explorer

A

Microsoft tool that shows you everything about running processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

SysAnalyzer

A

Registry monitoring tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Tiny Watcher

A

Registry monitoring tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Active Registry Monitor

A

Registry monitoring tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Regshot

A

Registry monitoring tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Msconfig

A

Windows program that shows all programs set to start on startup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Tripwire

A

Integrity verifier that can act as a HIDS in protection against trojans

46
Q

SIGVERIF

A

built into Windows to verify the integrity of the system. Log file can be found at c:\windows\system32\sigverif.txt

47
Q

Virus

A

Self-replicating program that reproduces by attaching copies of itself into other executable code. . Usually installed by user .

48
Q

Ransomware

A

Malicious software designed to deny accesss to a computer until a price is paid; usually spread via email.

49
Q

WannaCry

A

Famous ransomware. Within 24 hours, had 230,000 victims; exploited unpatched SMB

50
Q

Cryptorbit

A

Ransomware type

51
Q

Cryptolocker

A

Ransomware type

52
Q

CryptoDefense

A

Ransomware type

53
Q

Boot Sector Virus

A

Known as system virus; moves boot sector to another location and then inserts code into the original location.

54
Q

Shell Virus

A

Wraps around an application’s code, inserting itself before the application’s

55
Q

Cluster Virus

A

Modifies directory table entries so every time a file or folder is opened, the virus runs.

56
Q

Multipartite Virus

A

Attempts to infect both boot sector and files; generally referred to as virus with multiple infection methods

57
Q

Macro Virus

A

Written in VBA ; infects template files - mostly Word and Excel

58
Q

Polymorphic Code Virus

A

Mutates its code by using a polymorphic engine; difficult to find because code is always changing.

59
Q

Encryption Virus

A

Uses encryption to hide the code from antivirus

60
Q

Metamorphic Virus

A

Rewrites itself every time it infects a new file.

61
Q

Stealth Virus

A

Known as tunneling virus; attempts to evade Avs by intercepting their requests and returning them instead of letting them pass to the OS

62
Q

Cavity Virus

A

Overwrite portions of host files as to not increase the actual size of the file; uss null content sections

63
Q

Sparse Infector Virus

A

Only infects occasionally (e.g. every 10th time)

64
Q

File Extension Virus

A

Changes the file extensions of files to take advantage of most people having them turned off (readme.txt.vbs shows as readme.txt

65
Q

Sonic Bat

A

Virus maker

66
Q

Poison

A

Virus maker

67
Q

Sam’s Virus Generator

A

Virus maker

68
Q

IPS Virus Maker

A

Virus maker

69
Q

Worm

A

Self-replicating malware that sends itself to other computers without human intervention. Often used in botnets, resides in active memory.

70
Q

Ghost Eye Worm

A

Hacking tool that uses random messaging on Facebook and other sites to perform a host of malicious efforts

71
Q

What are the steps to analyzing malware?

A
  1. Use a VM with NIC in host-only mode and no open shares. 2. Analyze the malware on the isolated VM in a static state. 3. Run the malware and check out processes . 4. Check and see what files are added, changed, or deleted.
72
Q

What is a Sheepdip system

A

A system that is used to check things introduced into a network. It is Airgapped.

73
Q

Botnets can be controlled over…

A

HTTP, HTTPS, IRC, ICQ

74
Q

DDoS Attack Category - Fragmentation Attacks

A

Attacks take advantage of the system’s ability to reconstruct fragmented packets.

75
Q

DDoS Attack Category - Volumetric Attacks

A

Bandwidth attacks; consume all bandwidth for the system of service.

76
Q

DDoS Attack Category - Application Attacks

A

Consume the resources necessary for the application to run. Usually against weak code.

77
Q

DDoS Attack Category - TCP-State-exhaustion attacks

A

Go after load balancers, firewalls, and application servers.

78
Q

DDoS Attack - SYN Attack

A

Send thousands of SYN packets to the machine with a false source address; eventually engages all resources and exhausts the machine.

79
Q

DDoS Attack - SYN Flood

A

Sends thousands of SYN packets to; but does NOT SPOOF IP but doesn’t respond to SYN/ACK

80
Q

DDoS Attack - ICMP Flood

A

Sends ICMP Echo packets with a spoofed address; eventually reaches limit of packets per second sent.

81
Q

DDoS Attack - Smurf Attack

A

Sending a large number of pings to the broadcast address of the subnet with source IP spoofed as the target; entire subnet responds exhausting the target.

82
Q

DDoS Attack - Fraggle

A

Same as smurf but with UDP packets

83
Q

DDoS Atttack - Ping of Death

A

Fragments ICMP messages; after reassembled, the ICMP packet is larger than the maximum size and crashes the system.

84
Q

DDoS Attack - Teardrop

A

Overlaps a large number of garbled IP fragments with oversized payloads; causes older systems to crash due to fragment reassembly.

85
Q

DDoS Attack - Peer to Peer

A

clients of peer-to-peer file sharing hub are disconnected and directed to connect to the target system.

86
Q

DDoS Attack - Phlashing

A

A DoS attack that causes permanent damage to a system; also called bricking a system.

87
Q

DDoS Attack - LAND attack

A

Sends a SYN packet to the target with a spoofed IP the same as the target; if vulnerable, target loops endlessly and crashes.

88
Q

Low Orbit Ion Cannon (LOIC)

A

DDoS tool that floods target with TCP, UDP, or HTTP requests.

89
Q

Trinity

A

Linux based DDoS tool

90
Q

Tribe Flood Network

A

Uses voluntary botnet systems to launch massive flood attacks

91
Q

R-U-Dead-Yet (RUDY)

A

DoS with HTTP POST via long-for field submissions.

92
Q

Session Hijacking

A

Attacker waits for session to begin and after the victim authenticates, steals the session for himself.

93
Q

Session Hijacking steps are:

A
  1. Sniff traffic between client and server. 2. Monitor the traffic and predict the sequence number. 3. Desynchronize the session with the client. 4. Predict the session token and take over the session. 5. Inject packets to target server.
94
Q

Session Hijacking can be predicted by looking at _____________

A

Predicting can be done by knowing the window size and the packet sequence number. Sequence number increment on Acknowledgement. For example, an ACK of 105 with a window of 200 means you could expect sequence numbering from 105 to 305.

95
Q

Ettercap

A

Man-in-the middle tool and packet sniffer on steroids.

96
Q

Hunt

A

Sniff, hijack and reset connections

97
Q

T-Sight

A

Easily hijack sessions and monitor network connections

98
Q

Zaproxy

A

Session Hijacking tool

99
Q

Paros

A

Session Hijacking tool

100
Q

Burp Suite

A

Session Hijacking tool

101
Q

Juggernaut

A

Session Hijacking tool

102
Q

Hamster

A

Session Hijacking tool

103
Q

Ferret

A

Session Hijacking tool

104
Q

How can you defend against session hijacking?

A

Using unpredictable session IDs - Limiting incoming connections. - Minimizing remote access. - Regenerating the session key after authentication. - Use IPSec to encrypt

105
Q

IPSec - Transport Mode

A

Payload and ESP trailer are encrypted; IP header is NOT

106
Q

IPSec - Tunnel Mode

A

Everything is encrypted; cannot be used with NAT

107
Q

IPSec - Authentication Header

A

Guarantees the integrity and authentication of IP packet sender

108
Q

IPSec - Encapsulating Security Payload (ESP)

A

Proivdes origin authenticity and integrity as well as confidentiality.

109
Q

IPSec - Internet Key Exchange (IKE)

A

Produces the keys for the encryption process.

110
Q

IPSec - Oakley

A

Uses Diffie-Hellman to create master and session keys.

111
Q

Internet Security Association Key Management Protocol (ISAKMP)

A

Software that facilitates encrypted communication between two endpoints.

CEH (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions