Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CS 6035 Spring '22 Exam 1 > Modern Malware > Flashcards

Modern Malware Flashcards

1
Q

Which of the following viruses are classified by concealment?

a. Macrovirus
b. Encrypted virus
c. Polymorphic virus
d. Metamorphic virus
e. B, C, D
f. All of the above

A

e. B, C, D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

T/F: Improper handling of user input can lead to SQL injection.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

T/F: Metamorphic viruses are harder to detect than polymorphic viruses

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is software called that collects information from the computer and transmits it to another system, monitoring keystrokes, network traffic and on the screen data

a. Spammer programs
b. Keylogger
c. Spyware
d. Trojan horse

A

c. Spyware (page 185 and lecture slides)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

For each of the below, select whether the statement describes Spamming, Click Fraud, or Phishing:

a. Used by botmasters to fraudulently increase revenues from advertisers
b. Used to gather valuable financial information.
c. Infected machines send out unsolicited emails

A

a. used by botmasters to fraudulently increase revenues from advertisers?
Answer: Click Fraud

b. Used to gather valuable financial information.
Answer: Phishing

c. Infected machines send out unsolicited emails
Answer: spamming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

List some examples of attacks and frauds by botnets:

A 
Spam
DDOS
Clickfraud
Phishing and pharming
Key logging
Key/password cracking
Anonymized terrorist and criminal communication
Cheating in online games/polls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

T/F: In DDOS attacks, the attacker does not have to use his own computer in the attack

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

T/F: In a DDOS attack, the quantity of computers involved in the attack makes it difficult to distinguish legitimate from malicious traffic

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

T/F: The characteristics of DNS servers help mitigate the effect of DDOS attacks.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

In C&C, how can the bot master contact the compromised machines (bots) and use them?

A

The naive approach is to have victims contact the botmaster. This is insufficient because it can be easily defeated via ISP intervention, blackhole routing, etc…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are good Botnet C&C Design considerations from an attacker perspective?

A

a. Efficient and reliable: able to reach a sizable set of bots within a time limit
b. Stealthy: hard to detect (blended with normal/regular traffic)
c. Resilient: hard to disable or block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

T/F: Bots have more sophisticated communication capabilities than worms and viruses.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

T/F: Bots require direct communication with the C&C server before beginning an attack.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

T/F: Bots require direct communication with the C&C server before beginning an attack.

A

False. Bots may include conditions such as time to trigger an attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

T/F: A botnet will be less likely to be found if it uses custom communication protocols.

A

False. Custom communications protocols more easily detected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How do we distinguish between bots vs worms/viruses?

A

The ability to perform C2 is a characteristic of bots, not worms or viruses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are some ways we can deal with botnet DNS lookups once we have identified a domain (i.e. hackerz.com) as a botnet master?

A

GT sinkhole: when a bot/victim makes a DNS request for hackerz.com, the DNS server responds with the ip address of a GT sinkhole.

In addition to canceling communication from/to bot master, this approach allows researchers to inspect the ip of infected machines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What do the following APT attacks do?

a. Boy in the Browser
b. Clickjacking
c. Man in the Browser
d. Man in the Middle
e. Keyloggers

A

a. Boy in the Browser: covertly changes a computer’s network routing
b. Clickjacking: web users unknowingly click on something that is not as it is portrayed
c. Man in the Browser: modifies web pages covertly
d. Man in the Middle: eavesdrops
e. Keyloggers: covertly records keystrokes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is malware static analysis and malware dynamic analysis?

A

a. Static analysis: understand what a malware instance would do if executed
b. Dynamic analysis: understand what a program does when executed

20
Q

Which of the following Malware needs host program (can be multiple)?

a. Trapdoor
b. Viruses
c. Logic bombs
d. Worms
e. Botnets
f. APT

A

a, b, c

21
Q

_______ is an attack that exploits a security vulnerability occurring in the database layer of an application (such as queries).

A. Trojan horse
B. Logic bomb
C. SQLi
D. Buffer overflow

A

Answer C

Source: Book pg. 156

22
Q

T/F: Improper handling of user input can result in a SQL injection

A

Answer True

The attack is viable when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements OR user input is not strongly typed.

Source: Book pg. 156

23
Q

SQLi attacks can be grouped into three main categories: _______, ________, and ______.

A. parameterized, user input, blind injection
B. second-order injection, out-of-band, parameterized
C. inferential, blind injection, inband
D. inband, inferential, out-of-band

A

Answer D

Source: Book pg 158

24
Q

What are the main avenues of attack for SQL injection?

A. Cookies
B. Server variables
C. User input
D. Second-order injection
E. Physical user input
F. All of the above
G. None of the above
A

Answer F

Source: Book pg. 158

25
Q

T/F: Defensive coding is an effective way to dramatically reduce the threat from SQLi

A

Answer True

Source: Book pg. 160

26
Q

_____attack occurs when user input is incorrectly filtered for string escape characters or user input is not strongly typed.

A

Answer SQLi

Source: book p.156

27
Q

Illegal/logically incorrect queries return often overly descriptive errors from the application server and allow an attacker to gather important information about the server. This is part of what type of attack?

A

Answer inferential attack

Source: book p.159

28
Q

Which of the following are proper measures to defend against SQLi attacks?

a) user input validation
b) parameterized query insertion
c) SQL DOM
d) a and b
e) All of the above

A

Answer e)

Source: book p.160

29
Q

Which of the following Detection methods to prevent SQLi attacks define a training phase to learn normal behavior?

A) Anomaly-based
B) Signature-based
C) Code analysis
D) None of the above

A

Answer A.

Anomaly based attempts to define normal behavior then detect behavior patterns outside the normal range.

Source: Book Chapter 5.4 Page 182

30
Q

There are _________ generations of antivirus software.

a) Two
b) Three
c) Four
d) Five

A

Answer c) Four

31
Q

A __________ virus is a virus that mutates with every infection, making detection by the “signature” of the virus impossible.

A. Metamorphic
B. Encrypted
C. Polymorphic
D. Stealth

A

Answer C

32
Q

Which of the following viruses are classified by concealment?

A) Macro Virus
B) Encrypted Virus
C) Polymorphic Virus
D) Metamorphic Virus
E) B, C, D
F) All of the above
A

Answer E. viruses in B,C,D fit this description. Macro viruses are classified by Target rather than concealment

Source: Book Chapter 6.3 Page 215

33
Q

Which phase does a virus place a copy of itself into other programs?

A) Dormant Phase
B) Propagation Phase
C) Triggering Phase
D) Execution Phase

A

Answer B

Source: Book Chapter 6.3 Page 211

34
Q

Which type of document is not known to carry macro viruses?

A. Microsoft Word Document
B. Plain Text File
C. Adobe PDF File
D. Microsoft Excel File

A

Answer B

Source: page 212 Chapter 6.3

35
Q

T/F: Macro Viruses will manipulate call functions on the host document’s content only.

A

Answer False

Source: page 213 Chapter 6.3. Their ability to interact with other parts of the system is demonstrated by the “Melissa” macro virus, which uses a Windows system registry to keep track of infection status.

36
Q

T/F: Metamorphic Viruses are harder to detect than Polymorphic Viruses.

A

Answer True

Source: page 215 Chapter 6.3

37
Q

Which of the following are NOT a typical use case for botnets?

A) Spamming
B) DDos attacks
C) Spear phishing
D) Sniffing traffic

A

Answer C

Spear phishing is a targeted attack whereas botnets are typically used as a swarm to work in concert to perform their attacks.

Source: Book P207

38
Q

Which Malware was the first of a new generation that included aspects of virus, worm and trojan in one package.

a) Morris worm
b) Melissa e-mail worm
c) Cod Red worm
d) WannaCry ransomware

A

Answer b)

global edition pg. 219 chapter 6, Malicious software

39
Q

What type of Malware is Easter egg?

a) Virus
b) Worm
c) Trojan
d) Trapdoor

A

Answer d

Malicious Code slides

40
Q

What is software that collects information form a computer and transmits it to another system monitoring keystrokes, network traffic and other screen data?

A.) Spammer Programs
B.) Keylogger
C.) Spyware
D.) Trojan Horse

A

Answer C.)

Page 185

41
Q

Which type of malware is a program installed on an infected machine that is activated to launch attacks on other machines?

A) Virus
B) Trojan
C) Worm
D) Bot
E) Root Kit
A

Answer D

Source: Book Chapter 6.1 Page 207

42
Q

Which of the following properties are not commonly found in both Viruses and Worms?

A. Dormant, Propagation, Triggering, and Execution phases
B. May attempt to determine if a system has been previously infected
C. Requires a host program to run
D. Can be polymorphic to evade detection

A

Answer C

Source Page 222 Chapter 6.4

43
Q

T/F: In order to increase the difficulty of an offline dictionary attack, a salt can be combined with a password before hashing

A

Answer True

For a salt of length b bits, the number of possible passwords is increased by a factor of 2^b

Source: Book pg. 72

44
Q

In Information Security, a “logic bomb” generally refers to _____________

a. A useful program or command procedure but with hidden (malicious) side-effects
b. A program which secretly takes over another networked computer then uses it to indirectly launch attacks
c. A program that always sends large volumes of unwanted email
d. A program embedded in the malware that lies dormant until a predefined condition is met; it triggers an unauthorized act
e. A program that bypasses a normal security check; it may allow unauthorized access to functionality in a program, or onto a compromised system

A

Correct Answer: D

45
Q

__________ detection methods for SQL injection attacks are based on verifying distinct patterns. This approach must be routinely updated and may be unsuccessful against self-modifying attacks.

a. Anomaly based
b. Code analysis
c. Signature based
d. All of the above
e. None of the above

A

Correct Answer: C

46
Q

Which of the following components is always included in contemporary types of malware?

a. Infection mechanism
b. Header
c. Payload
d. Trigger
e. B & C
f. A, C, & D

A

Answer: F

47
Q

________ will integrate with the operating system of a host computer and monitor program behavior in real time for malicious action.

a. Behavior blocking software
b. Generic decryption technology
c. Heuristic scanners
d. Fingerprint-based scanners

A

Correct Answer: A

CS 6035 Spring '22 Exam 1 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions