Chapter 9 - Trojans and Other Attacks Flashcards
Overt Channels
Covert Channels
overt - legitimate communication channels
covert - used to transport data in unintended ways
Wrappers
programs that let you bind an executable of your choice to an innocent file your target will want to open
they have their own signatures and show up on AV scans
Elitewrap
wrapping program you can embed a backdoor with
packers and crypters
tools that alter malware to hide it from signature based AV
packers - compress malware to smaller size, making it harder to detect
crypters - encrypt and manipulate code to make malware undetectable to AV
Types of Trojans
defacement trojan proxy server trojan botnet trojan remote access trojan e-banking trojan command shell trojan
botnet trojan examples - chewbacca, sky net
remote access trojan examples - RAT, MoSucker, Optic Pro, Blackhole
e-banking trojan examples - Zeus, Spyeye
command shell trojan - ECC says netcat is one
netcat commands
nc -l -p 5555
nc ipaddress -p 5555
nc -l -p 5555
opens port 5555 in a listening state on the target
nc ipaddress -p 5555
connects to target on port 5555, like telnet
Trojan names and port numbers for EC Exam
Death Senna Spy Hackers Paradise TCP Wrappers Doom, SatanzBackDoor Silencer, WebEx RAT SubSeven
Death 2 Senna Spy 20 Hackers Paradise 31, 456 TCP Wrappers 421 Doom, SatanzBackDoor 666 Silencer, WebEx 1001 RAT 1095-98 SubSeven 1243
Trojan names and port numbers for EC Exam
Shivak Burka Trojan Cow Deep Throat Tini NetBus Whack a Mole Back Orifice
Shivak Burka 1600 Trojan Cow 2001 Deep Throat 6670-71 Tini 7777 NetBus 12345, 12346 Whack a Mole 12361-63 Back Orifice 31337, 31338
what command to use on windows to show all connections and listening ports?
netstat -an
what does net stat -b show?
all active connections and the processes using them
Windows Registry locations to run things automatically
Run
RunServices
RunOnce
RunServicesOnce
all under HKLM…
Registry monitoring tools
sysanalyzer
tiny watcher
active registry monitor
regshot
Monitoring tools for processes and services
Windows Service Manager
Service Manager Plus
Smart Utility
check the startup routines, like with ‘msconfig’
Tripwire
SIGVERIF
Tripwire - integrity verifier that can act as an HIDS against trojans
SIGVERIF - built into Windows to help verify integrity of critical files. log file called SIGVERIF.TXT and is in the windows folder
Virus Types
Ransomware Boot sector virus (aka system virus) shell virus multi-partite virus macro virus
Ransomware - locks you out of your system, demands payment
Boot sector virus - moves boot sector on HD to different location, forcing virus to execute first.
shell virus - works like boot sector virus, wraps itself around application’s code, so it runs before the application
multi-partite virus - infects files and boot sector at same time. Has multiple infection vectors
macro virus - infects template files from MS Office
Virus Types
Polymorphic code virus Encryption virus Metamorphic virus Stealth virus cavity virus sparse infector virus file extension virus
Polymorphic code virus - mutates its code, hard to find because code constantly changes.
Encryption virus - uses encryption to hide its code from AV
Metamorphic virus - rewrites itself each time it infects new file
Stealth virus - evades AV by intercepting AV requests to OS and returning them to itself instead of the OS.
cavity virus - overwrite portions of host files so the actual file size doesn’t change. Uses null content sections of file, and original file still works
sparse infector virus - infect only occasionally
file extension virus - change file extensions to take advantage of extension view being turned off (ie readme.txt.vbs becomes readme.txt)
