Comp Security- Week 5B Flashcards
What is a malware?
A malware is a malicious software that needs to be executed in order to cause harm
How can a malware get executed?
User action or exploting an existing flaw in a system
How can malware get executed using user action?
Downloading and running malware
Viewing a website that contains malware
Opening an executable email attachment
Inserting cd/usb
How can malware get executed by exploiting a flaw in system
buffer overflow in network, buffer overflows in email clients or web browser
What are the 9 types of malware?
Viruses, trojan horses, logic bombs
Worms, backdoors, spyware
Rootkits, botnets, ransomware
What is a virus?
A piece of malware that replicates itself into other programs
How can a virus spread between files or computers?
When the file is executed/opened the virus activates and tries to infect other files with copies of itself
Virus infection:
to modify an existing non malicious program/document in a way that just execution or opening it will transfer control to virus
by adding its code to the original code
A virus often tries to infect the computer itself so every time the computer is booted the virus is activated by..
put itself in boot sector of hard disk
add itself to list of program os runs in boot time
How does a virus usually spread?
Through infected files or p2p networks (ex bittorent)
A virus requires __ to spread to another machine
User interaction
A virus has some sort of payload its meant to do and when it activates what can happen?
A payload is what a virus is meant to do
When it activates it van erase hard drive, corrupt spread sheets, install key stroker, attack a website etc.
What is a polymorphic virus?
Instead of making perfect copies of itself every time it infects a new file or host it makes a modified copy instead. Often done by having most of the virus code encrypted
What is a trojan / trojan horse?
A malicious code hidden in an apparently useful host program and when it is executed the trojan does something harmful or unwanted.
User must be tricked into executing host program
What is a logic bomb?
A malicious code hiding in software already waiting for a certain trigger to “go off” so it can execute its payload
Its usually written by insiders
Payload is dire- erase or corrupt data
