Malicious Software Flashcards
_______ mechanisms include those used by viruses, worms, and Trojans.
Propagate (to spread)
______ include system corruption, bots, phishing, spyware, and rootlets.
Payload
A ______ _____ uses multiple methods of infection or propagation, to maximize the speed of contagion that and the severity of the attack.
blended attack
Virus creation toolkits that were developed in the 1990s to improve the development and deployment of malware.
crimeware
What does APT stand for?
Advanced
Persistent
Threats
_____ differ from other types of attack by their careful target selection, and persistent, then stealthy, intrusion efforts over extended periods.
APTs
What are the three parts of a computer virus?
Infection Mechanism(infection vector)
Trigger(logic bomb)
Payload
The means by which a virus spreads or propagates, enabling it to replicate.
Infection Mechanism (infection vector)
The even or condition that determines when the payload is activated or delivered.
Trigger (logic bomb)
What the virus does, besides spreading. The ___ may involve damage or may involve benign but noticeable activity.
Payload
What are the four phases that a typical virus goes through during its lifetime.
Dormant phase
Propagation phase
Triggering phase
Execution phase
The virus is idle. The virus will eventually be activated by some event, such as a date, the presence of another program or file, or the capacity of the disk exceeding some limit. Not all viruses have this stage.
Dormant phase
The virus places a copy of itself into other programs or into certain system areas on the disk. The copy may not be identical to the propagating version; viruses often morph to evade detection. Each infected program will now contain a clone of the virus, which will itself enter a ________ phase.
Propagation phase
The virus is activated to perform the function for which it was intended. As with the dormant phase, the ______ phase can be caused by a variety of systems events, including a count of the number of times that this copy of the virus has made copies of itself.
Triggering phase
The function is performed. The function may be harmless, such as a message on the screen, or damaging, such as the destruction of programs and data files.
Execution phase
Infects a master boot record or boot record and spread when a system is booted from the disk containing the virus.
Boot sector infector
Infects files that the operating system or shell consider to be executable
File infector
Infests files with macro or scripting code that is interpreted by an application
Macro virus
Infects files in multiple ways. Typically, the ________ virus is capable of infecting multiple types of files, so that virus eradication must deal with all of the possible sites of infection.
Multipartite virus
A form of virus that used encryption to obscure its content.
encrypted virus
A form of virus explicitly designed to hide itself from detection by anti-virus software.
Stealth virus
A form of virus that creates copies during replication that are functionally equivalent but have distinctly different bit patterns, in order to defeat programs that scan for viruses.
Polymorphic virus
A virus that mutates with every infection.
Metamorphic virus
Different than polymorphic virus is that it rewrites itself completely at each iteration.
____ viruses infect scripting code used to support active content in a variety of user document types.
Macro
What makes Macro viruses so threatening?
- Platform independent
- Infect documents
- Easily spread
- Traditional file system access controls are of limited use in preventing their spread
A _____ is a program that actively seeks out more machines to infect, and then each infected machine serves as an automated launching pad for attacks on other machines.
Worm
To replicate itself, a worm uses what means to access remote systems?
Electronic mail or instant messenger facility
File sharing
Remote execution capability
Remote file access or transfer capability
Remote login capability
The first function in the propagation phase for a network worm is for it to search for other systems to infect, a process known as ______ or fingerprinting.
scanning
What are the types of network address scanning strategies that a worm can use?
Random
Hit-List
Topological
Local subnet
What does the state of the art worn technology include?
Multiplatform Multi-exploit Ultrafast spreading Polymorphic Metamorphic Transport vehicles Zero-day exploit
_______ code often acts as a mechanism for a virus, worm, or Trojan horse to be transmitted to the user’s workstation.
Mobile
A technique that exploits browser vulnerabilities so that when the user views a Web page controlled by the attacker, it contains code that exploits the browser bug to download and install malware on the system without the user’s knowledge or consent.
Drive-by-download
Can completely disable the phone, delete data on the phone, or force the device to send costly messages.
Mobile Phone Worms
Tricking users to assist in the compromise of their own systems
Social Engineering
what is the difference between a bot and a worm?
Worm propagates itself and activates itself
Bot is initially controlled from some central facility
Unsolicited Bulk e-mail
Significant carrier of malware
Used for phishing attacks
Spam
Program or utility containing harmful hidden code
Used to accomplish functions that the attacker could not accomplish directly
Trojan Horse
First appeared in 2004
Target is the smartphone
Mobile Phone Trojans
Malware that encrypts the users’s data and demands payment in order to access the key needed to recover the information
Ransomware
Mass mailing worm infecting windows 95 to XP systems. On trigger date causes files on the hard drive to become empty.
Klez
First seen in 1998, Windows 95 and 98 virus. Infects executable files and corrupts the entire file system when a trigger date is reached
Chernobyl
The collection of bots is referred to as?
botnet
A _____ attack is an attack on a computer system or network that causes a loss of service to users.
Distributed denial-of-service (DDoS)
Captures keystrokes to allow attacker to monitor sensitive information. Typically uses some form of filtering mechanism that only returns information close to keywords.
Key logger
Subverts the compromised machine to allow monitoring of a wide range of activity on the system.
Spyware
A spam e-mail may direct a user to a fake Web site controlled by the attacker, which is used to gather a range of private, personal, info on the user
phishing
Recipients are carefully researched by the attacker
E-mail is crafted to specifically suit its recipient, often quoting a range of information to convince them of its authenticity
Spear-Phishing
Enables the anti-virus program to easily detect complex polymorphic viruses and other malware while maintaining fast scanning speeds
Generic Decryption
