Malware Flashcards
How is malware classifed
How it spreads and the payload, as if they need a host program/are independent and whether it replicates or not
Attack Kit
A toolkit which provides a variety of payloads that novices can deploy
Attack Sources
Pollitically motivated, criminals, organised crime, organisations that sell services, national gov agenices
APTS Meaning
Advanced Persistent Threats
APTS Definition
Persistent use of variety of intrusion tech to selected targets.
APTS Characteristics
Advanced (wide variety of tech), persistent (attacks over extended period of time), threats (active involvement of people increases threat liklihood)
Aim of APTS?
From stealing Intellectual property to disrupting a network
APTS techniques
Social engineering, spear phishing, drive by downloads
Intent of APTS?
to infect target and use other tools to maintain access
Virus
Malware which infects a program and modifies to include a copy. Secretely run when the host program is run
Virus Components
Infection Mechanism (Vector), Trigger (Logic Bomb), Payload
Virus Phases
Dormant, Triggering, Propagation, Execution
Triggering Phase
Virus is activated caused by system events
Dormant Phase
Virus is idle. will be activated. not all have this.
Propagation Phase
Places a copy in programs
Execution Phase
Function is performed, may be harmless or damaging
Macro + Scripting Viruses
Attaches itself to documents and uses macro programming capabilities of documents application to execute and propagate
Why are macro viruses threatening
Platform dependent, infect documents not code, easily spread, traditional file access system control struggles to find them, much easier to write/modify than traditional viruses
Virus Classifications
By Target, By Concealment strategy
Break down Virus Classifications by target
Boot sector Infector, File Infector, Macro virus, Multi-partite Virus
Break down Virus Classifications by concealment strategy
Encryption, Stealth, Polymorphic, Metamorphic
What are Worms
Seeks more machines to infect. Infected machines serve as an auto launch pad. Exploits software vulnerabilites
How do worms spread
Network Connections, Shared media, macro code in emails & instant messanger file transfer. Upon activation worm replicates and propagates.
Worm Target Discovery
Scanning, Random, Hit-list, topological, local subnet
Worm Technology
Multi-platform, multi exploit, ultrafast speading, polymorphic, metamorphic
Mobile Code
Transmitted from a remote system to a local system and executed there. Often acts as a mechanism for a virus, worm, trojan.
How is mobile code achieved
Cross site scripting, interative and dynamic websites, email attachements, downloads from untrusted sites
Drive By Download
Webpage installs virus without user knowing
Watering Hole Attack
variant of drive by download but targetted for a victim
Malvertising
Malware on website in advertisements without comprimising them
Clickjacking
Collecting a users clicks, can alter UI to add hidden buttons to redirect user
Social Engineering
Tricking users to comprimise their own system
How is Social Engineering achieved
Spam - Bulk Email, used for phishing, Trojan Horse, Ransomware
Attack Agent Bots
Takes over another internet attached computer and uses to launch/manage attacks. Uses DDoS, spamming, sniffing, keylogging
Remote Control Facility
Distinguishes a bot from a worm. Bot is controlled from a facility like an IRC server whereas worm propagates itself. Incomming message acts as commands for bots
Keylogger
Captures keystrokes, can filter for keywords such as password
Spyware
Monitors comprimised machine
Info Theft Phishing
Exploits Social engineering to leverage users trust by pretending to be a trusted source
Spearphishing
This is phishing but the target is selected and researched
Stealthing backdoor
secret entrypoint in a program allowing attacker to bypass security
Maintenance Hook
A backdoor used by programmers
Rootkit characteristics
Persistent, Memory based, user mode, kernel mode, virtual machine based, external mode
Malware prevention countermeasures
Policy, Awareness, Vulnerability mitigation, Threat Mitigation
Malware countermeasures is prevention is failed
Detection, Identification, Removal
Generations of Anti Virus
Simple Scanners, Heuristic Scanners, Activity traps, full featured protection
Sandbox Analysis
Using malware in a VM to test, anaylse and mitigate
