CS 6035: 2nd Half

Question 1

_____ (aka zombie) is a compromised computer under the control of an attacker.

Answer 1

Bot

Question 2

_____ are the most prevalent form of malware. Most attacks and frauds are due to ___.

Answer 2

Botnets.

Question 3

____ bot activity that infects machines to end out unsolicited emails.

Answer 3

Spamming

Question 4

_____ used by botmasters to fraudulently increase revenue from advertisers.

Answer 4

Click Fraud.

Question 5

_____ bot activity used to gather valuable financial information.

Answer 5

Phishing

Question 6

Botnets usually have one of two goals:
1.
2.

Answer 6

monetary profit or political activism.

Question 7

Botnets are responsible for:

• Spam
• DDOS (distributed denial of service) attacks
• Click fraud
• Phishing and pharming
• Keylogging and Data/ID theft
• Key/Password Cracking
• Anonymized terrorist and criminal communication
• Cheat in online games and polls.

Answer 7

:)

Question 8

_____ are servers that any machine can query.

Answer 8

Open recursive DNS Servers. A common query is to look up the IP address of a domain name.

Question 9

The botmaster needs to control the bots, so ____ is required.

Answer 9

Control and communication (command and control)

Question 10

Botnet C&C design considerations:
1.
2.
3.

Answer 10

1. Must be efficient and reliable. It must be able to reach a sizable amount
2. Stealthy - hard to detect (i.e. it must blend with normal traffic)
3. Resilient - it should be hard to disable or block C&C traffic.

Question 11

_____ is

1. Advanced: use special malware. Used for high value theft.
2. Persistent. Long-term presence, multi-step, low and slow. Once the malware gets into an organization, it will be there for a long time.
3. Threat. The data targeted is high value.

Answer 11

Advanced Persistent Threat (APT).

Question 12

A ________ takes advantage of a previously unknown weakness or vulnerability in a system. There is no patch of fix for the system or prevention for the attack.

Answer 12

zero-day exploit

Question 13

____ covertly changes a computer’s network routing.

APT attack.

Answer 13

Boy in the Midde

Question 14

____ web users unknowingly click on something that is not as it is portrayed.

APT attack.

Answer 14

Clickjacking

Question 15

_____ modifies web pages covertly.

APT attack.

Answer 15

Man in the Browser.

Question 16

_____ eavesdrops.

APT attack.

Answer 16

Man in the Middle.

Question 17

______ covertly records keystrokes.

APT attack.

Answer 17

Keyloggers.

Question 18

____ attempts to understand what the malware instance would do if executed. This is done without actually running the malware.

Malware analysis.

Answer 18

Static Analysis.

Question 19

_____ attempts to understand what a program does when executed. Different granularities of analysis.

Malware analysis.

Answer 19

Dynamic Analysis

Question 20

_____ looking at instruction by instruction.

Malware analysis.

Answer 20

Fine-grained (e.g. automated unpacking)

Question 21

_____ (system call tracing) - looking at function calls.

Malware analysis.

Answer 21

Coarse-grained

Question 22

_____ only reveals behavior of a program during a specific runs. On a particular run, the malware may be waiting for specific conditions to be right before executing some of its code.

Malware analysis.

Answer 22

Dynamic analysis downfalls.

Question 23

_____ a technique whereby parts or all of an executable file are compressed, encrypted, or transformed into some fashion. This makes part of the program data instead of code. The code that reverses the pre-runtime transformation is included in the executable and is called ____.

Malware Obfuscation.

Answer 23

Packing.

Unpacking.