Malware Flashcards
What are six motivations for writing malware?
- Fun
- To show something is possible
- Vandalism
- Steal information
- Control machines for DDoS or spam
- To make money
What’s a payload?
What malware will do when triggered by an action, such as starting up Windows, keylogger starts, timed shutdowns.
What’s another term for crimeware?
Toolkits
Give three distinguishing features of a virus
- It reproduces it’s own code.
- It attaches itself to other files (a virus cannot survive by itself)
- Gets executed when the infected executable file is executed.
What is the structure of a virus and what do each components do?
- Infection mechanism: how a virus spreads or propagates, enabling it to replicate. Also known as ‘infection vector’
- Trigger: event/condition that determines when payload is activated. Also known as ‘logic bomb’
- Payload: what the virus does, besides spreading. May involve damage or benign but noticeable activity.
During its lifetime, what four phases does a typical virus go through?
- Dormant: virus is idle and will eventually be activated by some event.
- Propagation: virus places a copy of itself into other programs or into certain system areas on the disk.
- Triggering: virus activated to perform the function for which it was intended, can be caused by a variety of system events.
- Execution: function is performed.
What’s a worm and how does it replicate itself? (Five ways)
A work is a program that actively seeks out more machines to infect. Once activated, it may replicate and propagate again. Replicates through:
- Electronic mail / instant messaging
- Remote execution capability (reverse shell)
- Remote file access / transfer capability
- Remote login capability
Give three distinguishing features of a bot
Easy to control remotely.
Implementation of different commands.
Infected machines are incorporated in large networks (botnets) that are controlled by the bot master.
What is one advantage of Host-based Blocking Software over antivirus detection?
And what is one limitation?
Advantage: it can block suspicious software in real time.
Limitation: because the malicious code must run on the target machine before all its behaviours can be identified, it can cause harm before it’s been detected and blocked.
Out of a bot, Command and Control server, a botnet and the botmaster, which is the weakest link?
The Control and Command server. It’s a single point of failure, therefore real botnets don’t have a single Command and Control server.
What’s a Trojan horse and what are it’s three distinguishing features?
Trojan is a class of malware that appears to perform a desirable function but also performs undisclosed malicious activities.
- Requires user to explicitly run the program.
- Unable to make copies of itself or self-replicate.
- Can be used to perform any kind of malicious activity.
In general, what are the three lines of defence against DDoS attacks?
- Attack prevention and pre-emption (before the attack)
- Attack detection and filtering (during the attack)
- Attack source trace back and identification (during and after the attack)
