P2L2 Modern Malware Flashcards

1
Q

T/F: Modern malware is for fun and games

A

False. Modern malware is often for profit and political gains. It is technically sophisticated and based on the latest tech. It is designed for efficiency, robustness, and evasiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Botnet

A

Botnets are a network of bots (zombies) controlled by an attacker to carry out coordinated malicious attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Examples of Attacks/Frauds by botnets

A
  • -Spam
  • -DDOS
  • -Click fraud
  • -Phishing and Pharming
  • -Keylogging and data/ID theft
  • -Key/password cracking
  • -Anonymized terrorist and criminal communication
  • -Cheat in online games and polls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Amplified Distributed Reflective Attacks

A

Attacker uses open recursive DNS servers, which are plentiful

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Why DDoS attack?

A
  • -Attacker does not need to use his own computer

- -So many computers involved in the attack, it is difficult to distinguish legitimate from malicious traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Botnet Command and Control (C&C)

A

Botnet master needs C&C to control the bots

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

C&C design

A
  • -Must be efficient and reliable
  • -Stealthy
  • -Resilient
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

T/F: The botmasters prefer dynamic DNS servers

A

True: Because of the frequent change between domain name and IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Anomaly detection

A

The way the bots look up a domain suggest the domain is most likely used for C&C.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What can be done when the anomaly is detected?

A

Map the domain name to a sinkhole

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the advantage of the sinkhole?

A

Researchers can discover where the bots are in the net.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Advanced Persistent Threat (APT)

A

Advanced: Use special malware
Persistent: Long-term presence, multi-step, low-and-slow
Threat: Data targeted is high value

Tend to target specific organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

APT Lifecycle

A
  • -Define target
  • -Research target infrastructure/employees
  • -Test for detection
  • -deployment
  • -establish outbound connections
  • -exfiltrate data
  • -remain undetected
  • -Repeat
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Zero-day exploit

A

Takes advantage of a previously unknown weakness or vulnerability in a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Social Engineering

A

APTs are designed to fool even the most sophisticated of users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

APT attacks

A

Boy in the middle–covertly changes a computer’s network routing
Clickjacking–web users unknowingly click on something that is not as it is portrayed.
Man in the Browser–Modifies web pages covertly
Man in the middle–Eavesdrops
Keyloggers–covertly records keystrokes

17
Q

Malware analysis: Static Analysis

A

Attempts to understand what a malware instance would do if executed.

18
Q

Malware analysis: Dynamic Analysis

A

Attempts to understand what a program does when executed.

19
Q

Different granularities of analysis

A

Fine-grained: Looking at instruction by instruction

Coarse-grained: looking at function calls

20
Q

Malware Obfuscation: Packing

A

A technique whereby parts or all of an executable file are compressed, encrypted or transformed in some fashion.

21
Q

T/F: Can use signatures to detect packing.

A

False: A number of legitimate programs use packing/unpacking