Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security > Chapter 6 > Flashcards

Chapter 6 Flashcards

malicious software

1
Q

Advanced persistent threat

A

cybercrime directed at business + political targets using wide variety of intrusion technologies + malware , applied persistently + effectively to specific target over extended period , often state-sponsored

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Malware

A

program inserted into system covertly with intent to compromise confidentiality , integrity or availability of victim’s data , applications or OS or otherwise annoy/disrupt victim

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Adware

A

advertising integrated into software - result in pop-up ads/redirection of browser to commercial site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

attack kit

A

set of tools for generating new malware automatically using variety of supplied propagation + payload mechanisms
- Zeus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

auto-rooter

A

malicious hacker tool used to break into new machines remotely

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

backdoor/trapdoor

A

mechanism bypassing normal security checks - allow unauthorized access to functionality in program / compromised system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

downloaders

A

code that installs other items on machine that is under attack - normally included in malware code first inserted on compromised system to then import larger malware package

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

drive-by-download

A

attack using code in compromised web site - exploits browser vulnerability to attack client system when site = viewed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

exploits

A

code specific to single/set vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

flooders

A

used to generate large volume of data to attack networked computer systems by carrying out sort of DOS attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

keylogger

A

logs keystrokes on compromised system - typically includes filter only returns info close to keywords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

logic bomb

A

code inserted - lies dormant until predefined condition met - code triggers unauthorized act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

macro virus

A

type of virus that uses macro/scripting code - embedded in document + triggered when document viewed/edited to run + replicate itself into other documents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

mobile code

A

software can be shipped unchanged to heterogeneous collection of platforms + execute with identical semantics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

rootkit

A

set of hacker tools used after attacker has broken into computer system + gained root-level access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

spammer program

A

use to send large volumes of unwanted emails

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

spyware

A

software collect info from computer + transmits to another system by monitoring keystrokes ,screen data + network traffic /scan files on system for sensitive data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

trojan horse

A

computer program appears to have useful function but also hidden + potentially malicious function that evades security measures - exploit legitimate authorization of system entity that invokes trojan horse program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

virus

A

malware when executed tries to replicate into other executable machine/script code when succeeds = infected . When infected code =executed - virus also executed

20
Q

worm

A

computer program can run independently + can propagate complete working version of itself on other host on network , usually by exploiting software vulnerabilities in target system

21
Q

zombie/bot

A

program activated on infected machine that is activated to launch attacks on other machines

22
Q

classification of malware

A
  1. how spreads to reach target
  2. actions/payloads
  3. parasitic code
  4. independent
  5. does not replicate
  6. does replicate
23
Q

propagation mechanisms

A
  1. infection of existing content by viruses that spread to other systems
  2. exploit of software vulnerabilities to allow malware to replicate
  3. social engineering attacks
24
Q

payload actions

A
  1. corrupt system files
  2. theft of service
  3. theft of info
  4. hiding presence on system
25
Q

Attack sources

A
  1. politically motivated attackers
  2. criminals
  3. organized crime
  4. organizations that sell services to companies + nations
  5. national government agencies
26
Q

virus components

A
  1. infection mechanism
  2. trigger
  3. payload
27
Q

virus phases

A
  1. dormant - idle
  2. triggering - virus activated to perform function for which intended
  3. propagation - copy of itself in program - polymorphism
  4. execution - function performed
28
Q

threats of macro virus

A
  1. platform independent
  2. infect documents not executable portion of code
  3. easily spread
  4. infect user documents - traditional file control system = limited in preventing spread
  5. easier to write/modify
29
Q

virus classification

A
  1. target - boot sector(spread when boot), file infector(files considered executable) , macro virus , multipartite virus(infects in multiple ways)
  2. concealment strategy - encrypted virus, stealth virus (hide from anti-virus), polymorphic virus(mutates with each infection) , metamorphic virus(mutates + rewrites at each iteration - change behaviour + appearance)
30
Q

worm replication

A
  1. email/instant messenger - copy of worm sent
  2. file sharing - creates copy of itself on removable media
  3. remote execution capability - worm executes itself on other system
  4. remote file access - worm uses remote file access to copy itself from system to another
  5. remote login - worm logs in onto remote system + uses command to copy itself
31
Q

target discovery

A
  1. scanning - 1st function in propagation for worm - search for other systems
  2. random - compromised host probes random addresses in IP address using seed - produces high volume of internet traffic
  3. hit list - attacker has long list of potential vulnerable machines - each infected machine = provided with portion of list to scan - very short scanning period
  4. topological - use info on infected machine to find more hosts to scan
  5. local subnet - if host can be infected behind firewall - host looks for target in own local network
32
Q

Morris worm

A
  1. Unix systems
  2. attempt to crack password file to use login to logon to other systems
  3. exploited bug - report location of remote user
  4. exploits trapdoor in debug options of remote process - receives + sends mail
  5. successful - communication with OS command interpreter - sends bootstrap program to copy worm over
33
Q

watering-hole attack

A

attacker researches intended victims - identify websites likely to visit , scan website to identify those with vulnerabilities + wait for intended victim

34
Q

malvertising

A

place malware on website without actually compromising website self

35
Q

clickjacking

A

UI redress attack
transparent layers to trick user into clicking on button /link on another page when intended to click on top level

36
Q

social engineering

A
  1. spam - used for phishing
  2. trojan horse - program containing hidden harmful code
  3. mobile phone trojans
37
Q

payload : system corruption

A

damage to physical equipment

38
Q

remote control facility

A

bot controlled from central facility (differs from worm )
IRC server (internet relay chat)
- bots join specific channel + treat incoming messages as commands
- user peer-to-peer protocols - avoid single point of failure

39
Q

phishing

A
  • social engineering to leverage user’s trust by masquerading as communication from trusted source - URL to website, urgent action
40
Q

spear phishing

A

recipients carefully researched - email crafted to suit recipient

41
Q

rootkit

A

hidden programs installed on system to maintain covert access to system - subverting mechanisms that monitor + report on processes, files + registries on computer
- administrator privileges to attacker - can change programs

42
Q

rootkit characteristics

A
  1. persistent
  2. memory based
  3. user mode
  4. kernel mode
  5. virtual machine based
  6. external mode (BIOS)
43
Q

malware countermeasure

A
  1. prevention - policy , awareness , vulnerability mitigation , threat mitigation
  2. detection
  3. identification
  4. removal
44
Q

generation of anti-virus

A
  1. simple scanner - require malware signature to identify malware
  2. heuristic scanner - heuristic rules for probable malware - integrity checking
  3. activity traps - identify by actions
  4. full-featured - variety of techniques used in conjunction
45
Q
A

Security (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions