MOD 7 - Malware Threats

Question 1

Advanced Persistent Threat

Answer 1

Gains access to network and remains undetected for a long period of time. Goal is to obtain sensitive info, rather than causing damage.

Question 2

Trojan

Answer 2

Malicious software “wrapped with” or “bound to” other programs or files. Cannot replicate or propagate on its own, so it needs the victim to intentionally install it, unaware there is a malicious “freeloader” attached. Uses a “wrapper” or “binder” program to wrap the malware with some legitimate software. RAT = Remote Access Trojan. Botnet trojans take over the machine and allow it to be remote-controlled.

Question 3

Virus

Answer 3

Malicious software that attaches to other programs and files, and spreads through human interaction (e-mail, USB drives, etc.). Requires a host application to replicate (on the same machine). Cannot propagate to other machines without human assistance.
Viruses self-replicate by attaching to another program, boot sector of the HDD, or document.

Question 4

Types of Viruses

Answer 4

Multipartite, Macro, Encryption virus, Cavity virus, polymorphic, boot-sector virus, etc.

Question 5

• Worm

Answer 5

Automated malware, similar to a virus, that can spread through your network by taking advantage of network vulns. Unlike a virus, a worm does not require human interaction to spread.

Question 6

Ransomware

Answer 6

Encrypts your files and holds them for “ransom”. You must pay the attacker to give you the decryption key. Ransomware is rampant these days so make sure you have all your company data backed-up and taken off-site regularly! Also, encrypt those tapes before taking them off-site, and transport them in a locked box or case (in case they get lost or stolen).

Question 7

• Scareware

Answer 7

Scares the victim into installing software or performing some action. For example “Your computer is infected! Click here to remove it..”

Question 8

File-less malware

Answer 8

attack technique that uses existing, built-in OS tools and utilities to launch attacks. This cannot be detected by antivirus or IDS/IPS or be blocked by application whitelisting because there is no malicious signature to look for

Question 9

VirusTotal

Answer 9

Free online service that analyzes suspicious files and URLS to detect viruses, trojans, worms, etc. Module 7 of iLabs has a lab for this.

Question 10

• Malware detection techniques

Answer 10

Signature, Behavior, Cloud-based (Cloud based sends the files to be scanned up to a cloud-based scanning service)