Malicious Software Flashcards
Who is spam costly to?
Both the network infrastructure and the user who must filter emails.
Who sends spam?
Sometimes legitimate sources, but most is sent by botnets on comprised user systems.
Name different types of spam
Advertising, scams, carrying malware, phishing.
What makes spam hard to counter?
It exploits human behaviour, such as the user’s gullibility. It requires active user participation.
What are the three types of Trojan?
Hector, Priam, Paris…
Trojans which perform the function of a program while performing separate malicious activity.
Trojans which perform the function of the program but modifying this function to perform or disguise other malicious activity.
Trojans which replace the original function entirely, to perform a malicious function.
What is a bot?
A bot subverts the computational and network resources of an infected system, for the use of the attacker.
What is a botnet?
A coordinated network of bots.
What are bots used for?
Distributed Denial of Service Attacks, Spamming, Sniffing traffic, Key logging, Spreading malware etc.
What makes bots different from worms?
Bots are initially controlled from some central facility.
What is spear phishing?
When the target is specifically chosen and researched by the attacker, making their email more personalised to convince of authenticity.
Why might SMPT allow spam more easily?
It has no built in authenticity checks. Also, the recipient’s mail server only sees the IP address of the direct peer from which it received the message.
Why would a spammer want to hide their IP?
To avoid DNS or ISP blacklists. They could also do this by using botnets.
What is greylisting?
The server rejects the first email from a sender which it does not recognise. If the sender resends their message, then it is probably legitimate and they get accepted. Botnets do not tend to retry sending emails.
Is email security done by the protocol or the client?
The client.
What is a javascript language attack? How can we prevent it?
Since javascript is executed in the browser, the attacker can use this to be able to execute some code on the user’s machine. This is also known as cross-site scripting.
We can prevent it by pre-processing input from the user before using it in HTML, using firewalls, using an auditing system etc.
