malicious software Flashcards
what is a botnet
a network of compromised machines acting as a network
- responsible for things such as large scale network probing
- launching ddos
- spam
- click-fraud campaigns
- info theft
what is a trojan horse
a program appearing as a regular program but hides malicious activity;
what is a webroot
a dll based attack; spreads via drive by downloads; sophisticated rootkit
what was the torpig botnet
it was a combination of a mebroot and a trojan horse that was distributed bia mebroot via drive by downloads and a sophisticated rootkit.
It injected into 29 software platforms to steal sensitive information, used http injection for phishing, encrypted http as command and control protocol, and used a resilient approach “domain flux”; to contact command and control center
how do you go about in beggining to understand and contain malicious software
Principle 1: the hijacked botnet should be operated so that any harm
and/or damage to victims and targets of attacks would be minimized
Always responded with okn message
Never sent new/blank conguration le
Principle 2: the sinkholed botnet should collect enough information to
enable notication and remediation of aected parties
Worked with law enforcement (FBI and DoD Cybercrime units)
Worked with bank security ocers
Worked with ISPs
what is a sinkholed botnet
a bot net that is controlled by “good guys”
where do most malicipous threats start
the web
a malicious webpage does what to gain arbitraty code execution
leverage of a defect
what is malicious software
(Malware) refers to any unwanted software and executable code that is used
to perform an unauthorized, often harmful, action on a computing device. It
is an umbrella-term for various types of harmful software, including viruses,
worms, Trojans, rootkits, and botnets.
which two malicious software are self spreading
virus/worm
which five malicious software are non-spreadomg
root-kit, trojan horse, dialer, spyware, keylogger
which 3 malicious software require a host
virus, root-kit and
which 4 malicious software do not require a host
trojan, dialer, spyware, keylogger
what is a virus
Self-replicating
Needs a host to infect
Boot (Brain virus), overwrite, parasitic, cavity, entry point obfuscation,
code integration (W95/Zmist virus)
whats a worm
Self-replicating, spreads (autonomously) over network
Exploits vulnerabilities aecting a large number of hosts
Sends itself via email
e.g., Internet worm, Netsky, Sobig, Code Red, Blaster, Slammer
