L10 - Modern Malware

Question 1

The bot “Spamming” is:

a) Used by botmasters to fraudulently increase revenue from advertisers
b) Used to gather valuable financial information
c) Infected machines send out unsolicited emails

Answer 1

c) Infected machines send out unsolicited emails

Question 2

The bot “Click Fraud” is:

a) Used by botmasters to fraudulently increase revenue from advertisers
b) Used to gather valuable financial information
c) Infected machines send out unsolicited emails

Answer 2

a) Used by botmasters to fraudulently increase revenue from advertisers

Question 3

The bot “Phishing” is:

a) Used by botmasters to fraudulently increase revenue from advertisers
b) Used to gather valuable financial information
c) Infected machines send out unsolicited emails

Answer 3

b) Used to gather valuable financial information

Question 4

The attacker does not have to use his own computer in the attack

a) True
b) False

Answer 4

a) True

Question 5

Since there are so many computers involved in the attack, it is difficult to distinguish legitimate from malicious traffic

a) True
b) False

Answer 5

a) True

Question 6

The characteristics of DNS servers help mitigate the effect of DDoS attacks

a) True
b) False

Answer 6

b) False

Question 7

Bots have more sophisticated communication capabilities than worms and viruses

a) True
b) False

Answer 7

a) True

It has the ability to perform C&C (command and control)

Question 8

Bots require direct communication with the C&C server before beginning an attack

a) True
b) False

Answer 8

b) False

No need to communicate if attack is set on a timer

Question 9

A botnet will be less likely to be found if it uses custom communication protocols

a) True
b) False

Answer 9

b) False

If it is custom, it will stand out from normal traffic.

Question 10

A Gmail account is used for C&C, email address hardcoded in botcode.

Does it satisfy the following C&C schemes:

• Efficient/reliable communications
• Stealth communications (hard to detect)
• Resilient communications (hard to disrupt)

a) True
b) False

Answer 10

b) False

An account receiving emails for C&C all over the internet. This is not hard to detect.

Question 11

P2P protocol is used for C&C, query string is hardcoded in botcode

Does it satisfy the following C&C schemes:

• Efficient/reliable communications
• Stealth communications (hard to detect)
• Resilient communications (hard to disrupt)

a) True
b) False

Answer 11

b) False

Not hard to detect, P2P traffic in enterprise network will stand out

Question 12

A “news” web site has been set up for C&C, i.e. commands can be “parsed” from news articles. Website and parsing logic hardcoded in botcode.

Does it satisfy the following C&C schemes:

• Efficient/reliable communications
• Stealth communications (hard to detect)
• Resilient communications (hard to disrupt)

a) True
b) False

Answer 12

b) False

This is hard to detect. Reading news appears a lot like normal traffic but the website can be easily blocked.

Question 13

The “Boy in the Browser” APT activity does the following:

a) Eavesdrops
b) Modifies web pages
c) Covertly records keystrokes
d) Covertly changes a computer’s network routing
e) Web users unknowingly click on something that is not as it is portrayed

Answer 13

d) Covertly changes a computer’s network routing

Question 14

The “Clickjacking” APT activity does the following:

a) Eavesdrops
b) Modifies web pages
c) Covertly records keystrokes
d) Covertly changes a computer’s network routing
e) Web users unknowingly click on something that is not as it is portrayed

Answer 14

e) Web users unknowingly click on something that is not as it is portrayed

Question 15

The “Man in the Browser” APT activity does the following:

a) Eavesdrops
b) Modifies web pages
c) Covertly records keystrokes
d) Covertly changes a computer’s network routing
e) Web users unknowingly click on something that is not as it is portrayed

Answer 15

b) Modifies web pages

Question 16

The “Man in the Middle” APT activity does the following:

a) Eavesdrops
b) Modifies web pages
c) Covertly records keystrokes
d) Covertly changes a computer’s network routing
e) Web users unknowingly click on something that is not as it is portrayed

Answer 16

a) Eavesdrops

Question 17

The “Keyloggers” APT activity does the following:

a) Eavesdrops
b) Modifies web pages
c) Covertly records keystrokes
d) Covertly changes a computer’s network routing
e) Web users unknowingly click on something that is not as it is portrayed

Answer 17

c) Covertly records keystrokes

Question 18

What approach can be used to detect the example APT malware (the malicious browser extension)?

A network monitor that analyses traffic to detect anomalies or known bad traffic (e.g. to known bad domains)

a) True
b) False

Answer 18

a) True

Question 19

What approach can be used to detect the example APT malware (the malicious browser extension)?

A host monitor that examines operating systems activities (e.g. access to files)

a) True
b) False

Answer 19

a) True

Question 20

What approach can be used to detect the example APT malware (the malicious browser extension)?

A malware analysis system that identifies malicious logic (e.g. running the browser in a sandbox and tracing its execution)

a) True
b) False

Answer 20

a) True