Section 3: Malware Infections

Question 1

Threat Vector

Answer 1

Method used by an attacker to access a victim’s machine

Question 2

Attack Vector

Answer 2

Method used by an attacker to gain access to a victim’s machine in order to infect it with malware (the way we get to the machine and how we infect it)

Question 3

What are the three most common delivery methods for malware infections?

Answer 3

Software, messaging, and media (usbs, etc.)

Question 4

What is a watering hole?

Answer 4

Malware is placed on a website that you know your potential victims will access

Question 5

Botnet

Answer 5

A collection of compromised computers under the control of a master node

Question 6

What is a zombie in a botnet?

Answer 6

It is one of several computers being controlled by an attacker on one computer, called a C2, or Command and Control computer. These attackers utilize the zombie computers to conduct their attacks so it looks like it’s coming from your computer, not theirs. Processor intensive functions.

Question 7

What is a DDoS?

Answer 7

Distributed Denial of Service attack. Attacker takes control of several machines, and they all make the request simultaneously to take a server down, or they use them to mine bitcoin.

Question 8

Active Interception

Answer 8

Occurs when a computer is placed between the sender and receiver and is able to capture modify the traffic between them.

Question 9

Privilege Escalation

Answer 9

Occurs when you are able to exploit a design flaw or bug in a system to gain access to resources that a normal user isn’t able to access (think about the demo with EternalBlue)

Question 10

Backdoors

Answer 10

Used to bypass normal security and authentication functions

Question 11

What is a Remote Access Trojan?

Answer 11

It is malware placed by an attacker maintain persistent access.

Question 12

Easter Egg

Answer 12

Non-malicious code that when invoked, displays an insider joke, hidden message, or secret feature

Question 13

Logic Bomb

Answer 13

Malicious code that has been inserted inside a program and will execute only when certain conditions have been met (adjacent to easter eggs) (this is the attack used in Jurassic Park)

Question 14

Symptoms of infection

Answer 14

Computer is acting strangely, blue screening or locking up, restarts a lot, can’t get to files or apps anymore, strange noises, unusual error messages, display looks strange, jumbled printouts, new icons on the desktop, disappearing icons, double file extensions, AV won’t run, new files or folders, system restore doesn’t work

Question 15

Removing Malware Common Practices

Answer 15

Identify symptoms of infection

Quarantine the infected systems so it won’t spread *unplug the network cable

Disable system restore (if you’re using Windows) so no one can take snapshots

Remediate the infected system (scan with AV and remove virus, rebooting in safe mode)

Schedule automatic updates and scans

Enable system restore and create a new restore point

Provide end user security awareness training

Question 16

How can you remediate a boot sector virus?

Answer 16

Reboot the computer from an external device and scan it

Remove the drive, plug it into an external machine and scan it from there

Question 17

What are ways you can prevent viruses?

Answer 17

A good antivirus solution, update your system, a good host-based firewall, going to secure websites

Question 18

Best way to remediate a rootkit?

Answer 18

Reimage the machine

Question 19

What is the best way to remediate spam?

Answer 19

Verify your email servers aren’t configured as open mail relays or SMTP open relays

Remove email addresses from website

Use whitelists and blacklists

Train and educate end users

Question 20

What is an exploit technique?

Answer 20

Describes the specific method by which malware code infects a target host

Question 21

Most modern malware uses _________ techniques to avoid detection by signature based security software

Answer 21

Fileless

Question 22

Process that attackers commonly follow for exploitation

Answer 22

Get a dropper on their machine

Maintain access

Strengthen access

Actions on objectives (they have enough permissions that they can start doing what they want to do)

Concealment (start hiding themselves and start covering their tracks by doing things like deleting their log files)

Question 23

Dropper

Answer 23

Malware designed to install or run other types of malware embedded in a payload on an infected host

Question 24

Shellcode

Answer 24

Any lightweight code designed to run an exploit on a target (REMEMBER FOR THE TEST)

Question 25

Code Injection

Answer 25

Exploit technique that runs malicious code with the identification number of a legitimate process

Question 26

What is living off the land?

Answer 26

Exploit techniques that use standard system tools and packages to perform intrusions