P2L1

Question 1

types of malware

Answer 1

• needs host program (trap doors, logic bombs, trojan, virus, plugins/extension/scripts)
• independent (worms, botnets, apts - advance persistent threat)

Question 2

trapdoor

Answer 2

• backdoor to the program, only known to the programmer and the hacker
• typically works by recognizing some special sequence of input

Question 3

logic bomb

Answer 3

embedded in legitimate programs, activates when some conditions are met

Question 4

trojan

Answer 4

hidden in host program, and executes when the host executes

Question 5

virus

Answer 5

• infects a program by changing it.

- self-copy to programs to spread

Question 6

4 stages of virus

Answer 6

• Dormant
• propagation
• trigger
• execution

Question 7

Dormant phase

Answer 7

program is infected, but not execute yet

Question 8

propagation phase

Answer 8

virus is spreading

Question 9

trigger phase

Answer 9

host runs trigger virus (click email attachment)

Question 10

execution phase

Answer 10

virus execute, then look for hosts to spread

Question 11

spy on someone

Answer 11

trojan

Question 12

cripple a computer

Answer 12

logic bomb

Question 13

quickly spread

Answer 13

virus

Question 14

virus structure

Answer 14

• first line: go to main of virus
• second line: tag (infected or not)
• main: find and infect other programs, do some damage, go to first line of host to do normal work
• avoid detection: compress, decompress host

Question 15

parasitic virus

Answer 15

scan/infect program

Question 16

memory-resident virus

Answer 16

infect running program

Question 17

macro virus

Answer 17

embedded in documments

Question 18

boot sector virus

Answer 18

• run/spread when the program is boot
• load in the bootsector, move the bootstrap loader from the bootsector to some other location, and point to it after doing damage

Question 19

polymorphic virus

Answer 19

encrypt part of the virus using a random key

Question 20

boot sector always runs first?

Answer 20

true

Question 21

how macro virus spread?

Answer 21

• copies itself to the global macro

- activates, spread whenever document is open

Question 22

which virus infects the OS

Answer 22

memory resident virus

Question 23

Rookit can hide from the user?

Answer 23

yes, by intercepting OS activities

Question 24

how does worm spread

Answer 24

use network connection

Question 25

4 generation of antivirus

Answer 25

- simple scanners - heuristic scanner - activity trap - full feature analysis

Question 26

simple scanners

Answer 26

use signatures of known virus

Question 27

heuristic scanner

Answer 27

use integrity checking, checksum

Question 28

activity trap

Answer 28

base on knowledge of malware activities

Question 29

full feature analysis

Answer 29

host-based, network-based, sandboxing-based