Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Comptia Security+ Personal > Section 3: Malware Infections > Flashcards

Section 3: Malware Infections Flashcards

1
Q

How does malware delivery happen?

A

Through
- software
- messaging & media
- botnet or zombies
- active interception (puts malware into your network, MITM)
- privilege escalation
- back doors
- logic bombs
Easiest delivery
- USB (physical access)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the two Vectors a malware uses to access a machine?

A
  • Threat Vector
  • Attack Vector
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a Threat Vector?

A

It is the potential method an attacker can use to access a victims machine.

  • unpatched software
  • installation from USB
  • phishing campaign

Remember house scenario
- no gate
- open window etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an Attack Vector?

A

It is the method an attacker uses to gain access to a victims machine in order to infect it with malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the key differences between Threat Vector & Attack Vector?

A

Threat Vector - potential way to get to the machine
Attack Vector - the actual way you got into the machine and how you will infected it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Common Delivery Methods of Malware Infections

A

Software, Messaging, Media

Software & Messaging
- email programs
- peer to peer networks (bit torrent)
- ftp servers

Media
- CD/DVD
- USB
- External HDD
- Tape backups
- Floppy Disks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the Watering Hole concept?

A

When a malware is placed on a website that you know your potential victims will access.

Social media - people always come back for more

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Type Squatting?

A

When an attacker purchases a similar domain, pretends that the website is legit by making it look like the real one, and infecting it with malware

  • DionTraining.com
  • DionTraining(s).com

One is illegitimate but if you do not pay attention you will think its the same

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a Botnet?

A

Collection of compromised computers under the control of a master node

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a Zombie?

A

A single infected computer part of a botnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a master node in a Botnet?

A

It is the Command and Control (C2) computer that controls hundreds of thousands of infected computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a Pivot Point?

A

When an attacker is using your computer to look like the attack is coming from you rather than their own system

  • Command & Control (C2) -> Zombie -> victim
  • can use zombies to host illegal files such as CP
  • can use zombies to spam people and send out phishing campaigns
  • DDoS (most common)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a DDoS?

A

Distributed Denial of Service

  • sending requests/packets to overload a server and make it slow or crash it making it inaccessible to users/customers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a common use of Botnets now?

A

To earn money. Bitcoin/Crypto Mining which is processor intensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are Botnets great for?

A

Processor intensive functions & activities

  • crypto mining
  • breaking encryptions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is an Active Interception?

A

When a computer is placed in-between the sender and receiver resulting in capturing and/or modifying the traffic between them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Privilege Escalation?

A

When you use a design flaw exploit or a bug in a system to gain access to resources that a normal user isn’t able to access

  • Going from a regular user to an admin
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a Backdoor?

A

It is a piece of software/code that lets you bypass normal security and authentication functions

  • bad security practice
  • breach of good secure coding practices
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is something that acts like a backdoor?

A

Remote Access Trojan (RAT)

  • gives persistent access
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is an Easter Egg?

A

Non-malicious code that when invoked displays an insider joke, hidden message or secret feature

  • harmless
  • additional code which could have additional vulnerabilities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a Logic Bomb?

A

Malicious code that has been inserted inside a program and will execute only when certain conditions have been met

  • employ plants this code inside server’s code which will delete everything if he is removed from payrole
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What do the Secure Coding Standards say about Easter Eggs and Logic Bombs?

A

They should not be used!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are some symptoms of an infected system?

A
  • Slow (worms use network & processor resources to spread and replicate)
  • pc locking up/crashing/BSOD
  • restarting/crashing
  • Hard drives & files are not accessible anymore
  • strange noises
  • unusual error messages
  • Display looks strange
  • Jumbled printouts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is double file extensions such as textfile.txt.exe a sign of?

A

Malware infection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is an Antivirus not running a sign of?

A

Malware Infection

26
Q

What are New files and folders appearing or files and folders missing/corrupted a sign of?

A

Malware infection

27
Q

What is System Restore not functioning a sign of?

A

Malware infection

28
Q

What to do if your computer acts strangely due to an infection?

A
  1. Boot up in safe mode
  2. boot up from an external hard drive and then scan your computer with an AV (to find boot sector viruses & root kits)
29
Q

What are the steps to identifying if you are infected?

A
  1. Scan your computer
  2. Have a healthy backup
  3. Steps after you find out you are infected

a. Identify symptoms of malware infection
b. Quarantine infected systems
c. Disable System Restore(if using Windows)
d. Remediate the infected system
e. Schedule automatic updates & scans
f. Enable System Restore and create a new clean restore point
g. Provide end user security awareness training

30
Q

How to quarantine an infected system?

A
  1. Prevent communication with other systems
  2. Turn off network card/unplug network cable
31
Q

Why should you disable System Restore if you are infected?

A

Stop windows from making snapshots of the infected machine

32
Q

How do you remediate an infected system?

A
  1. Update AV & Anti-malware software so that you can use its scanning capabilities, quarantine capabilities, and removal techniques
  2. Boot up in safe mode and then use AV
    - this makes sure the infected file is not in use
33
Q

Should you schedule automatic updates and scans after you remediate an infected machine?

A

Absolutely

34
Q

Should you re-enable System Restore and create a new restore point after you remediate an infected machine?

A

Yes!

35
Q

What is the final step after remediating an infected machine to prevent this from happening again?

A

Provide end user security awareness training?

36
Q

What should you do if a Boot Sector Virus is suspected?

A

Reboot the computer from an external device and scan it

OR

Remove the infected drive and install it onto a clean system as a secondary drive. Then scan it

37
Q

How to prevent malware infections?

A
  • Use of included AV with OS
  • 3rd party AV
  • Patch system and update regularly
  • Host based Firewall to block outside connections
  • Use encrypted websites (SSL certificates)
  • Security settings when browsing should be set to “Non Trusting Method”
38
Q

How are Worms, Trojans, and Ransomware best detected with?

A

Anti-Malware solutions

39
Q

How is Spyware detected?

A

Anti Spyware solution

40
Q

How can you tell if you are infected with a Spyware?

A
  • popups
  • different homepage on browser than usual
41
Q

How can you detect a rootkit?

A

Boot from an external device and scan the infected system

42
Q

How can you remove a rootkit?

A

reimage the machine

43
Q

Can scanners detect a file containing a rootkit before it is installed?

A

Yes

44
Q

How can you prevent Spam Relay?

A

Verify your email servers are not configured as:

  • Open Mail Relays
  • SMTPT Open relays are disabled
45
Q

How can you prevent Spam?

A
  • Remove email addresses from websites
  • Use whitelists and blacklists
  • Train and educate end users
46
Q

What are some Malware protection best practices?

A
  1. Update your anti-malware automatically and scan your computer
  2. Update and patch the OS and applications regularly
  3. Educate and train end users on safe internet surfing practises
47
Q

What is an Exploit Technique?

A

Method by which malware code infects a target host

  • modern malware uses fileless techniques to avoid detection by signature-based security software
48
Q

What is a Fileless Malware?

A

Malware executed directly by a script or small piece of shell code that creates a process in the system memory without having to use local file system

  • APT’s use these
49
Q

What are the 5 steps of an attack?

A
  1. Dropper or Downloader
  2. Maintain Access
  3. Strengthen Access
  4. Actions on Objectives
  5. Concealment
50
Q

How can an attacker maintain access?

A
  1. Install a second stage downloader
  2. downloader can then download a RAT
  3. gain C2 (Command & Control) over the machine
51
Q

How can an attacker strengthen their access?

A

By identifying and infecting other systems of higher value

  • servers & domain controllers
  • lateral movement to gain additional privileges and additional footprint
52
Q

What are some Actions on Objectives?

A
  • copying & stealing files
  • encrypting
53
Q

How can an attacker use Concealment to their advantage?

A

By maintaining their tool access but covering their tracks

  • deleting log files
54
Q

What is a Dropper?

A

Malware designed to install or run other types of malware embedded in a payload of an infected host.

Bundled dropper installs the malicious downloader or malware and then it runs the legit utility.

  • stage one code, once it runs, it gets a downloader to get the rest of the malware
55
Q

What is a Downloader?

A

A piece of code that connects to the internet to retrieve additional tools after the initial infection by a dropper

56
Q

What is a shellcode? (in Security+ exam)

A

Lightweight (small) code designed to run an exploit on the target, which may include any type of code format, from scripting languages to binary code

  • small piece of code used as the payload in the exploitation of a software vulnerability
57
Q

What is a Code Injection?

A

Exploit technique that runs malicious code with the identification number (UID) of a legitimate process

58
Q

What are some other Code Injection techniques?

A

Masquerading - dropper replaces a genuine exe with a malicious one

DLL Injection - dropper forces a process to load as part of the DLL (loads DLL and executable malicious code)

DLL Sideloading - dropper exploits a vulnerability in a legitimate program’s manifest to load a malicious DLL at runtime

Process hollowing - Dropper starts process in a suspended state and then rewrites the memory locations containing the process code with the malware code

59
Q

What are some anti-forensic techniques droppers can implement to prevent detection and analysis?

A
  • Encrypting payload
  • Compressing payload
  • Obfuscating payload
60
Q

What does Living Off the Land mean?

A

Exploit technique that uses standard system tools and packages to perform intrusions

  • pen tester uses power shell
  • bash scripting in Linux

These can be used in a malicious way but it is difficult to detect.

61
Q

Why is Living Off the Land more difficult to detect?

A

Because you are using the machine’s own tools to attack it. No foreign tools. (using standard tools and processes)

  • executing malware code within standard tools and processes

Comptia Security+ Personal (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions