Week 7 - Web Security and Malware Flashcards

Question

How should you mitigate sensitive data exposure?

Answer 1

Only store sensitive data which you need to carry out your service. Ensure that there is appropriate security and effective authentication and authorisation on the data. You might use encryption or hashing.

Answer 2

It is when you use XML within a Web application to retrieve external data from another source.

Answer 3

Using the latest version of JSON or something similar. Upgrading older XML processors. Disabling the processing of external entities.

Answer 4

A malicious url could be provided as the source of the external entities, and thus retrieving and evaluating this data could result in a security incident e.g. Remote request for access, DoS,, scanning if the Web app system...

Answer 5

When security controls and protocols are poorly implemented, inaccurately configured or left insecure, putting your data at risk.

Answer 6

Poor password management - allowing users to choose weak passwords, or storing passwords in physical locations. Default account management - using default names for usernames and passwords and not changing them e.g. Admin. Lack of maintenance of software - not updating software such as antiviruses and or other software or hardware.

Answer 7

It is the failure to uphold proper authentication of users and authorisation of permissions. Broken access control can main that users could act outside of their intended permissions and do things they otherwise couldn't do.

Answer 8

Insecure direct object references Missing function level access control

Answer 9

When an object is directly referenced from the url as a url parameter. These are insecure because the user could change the data being retrieved to data they cannot access by changing the parameter data in the url. It allows users to bypass permissions and authorisations. It only works if improper authentication is in place that doesn't check that the user should have access to the data.

Answer 10

Implementing better authentication,by checking whether or not a user should have access to the data being referenced. This could be done with session variables that check which user is logged in, and check whether that user can access the data. Another option is to remove direct object references from url, and use indirect object references using input fields. E.g. A drop down inout that shows the ONLY the data that the user can access.

Answer 11

When improper authentication is in place that allows a user to request functionality they don't have access to and are given access because their authorisation is not checked. Authentication is only happening at the presentation level, not the function level.

Answer 12

By implementing better authorisation. This authorisation must be at function level, rather than presentation level.

Answer 13

When there is no validation for editing a serialised object, thus introducing insecurities when derialisation of that object occurs if the deserialisation process does not valid the object either.

Answer 14

When a piece of data is converted into a format that can be stored more efficiently. Normally into a string that can be stored easily.

Answer 15

The reverse process of serialisation. When you convert data from its stored form back to its original form.

Answer 16

An attacker could change the deserialised object of someone's account data, like a cookie, so that they could change the permissions of that account or change the user logged in to gain unauthorised access to data. When deserialisation occurs, the attacker is recognised as an authorised user by the object wasn't validated for untrusted changes.

Answer 17

Reduce the amount of deserialisation taking place. Checking integrity of serialised objects before deserializing them using digital signatures. Logging exceptions and failures for deserialization.

Answer 18

If the component cotnians malicious data it could be used to enact malicious incidents on your organisation or system.

Answer 19

A component of code e.g. Classes, a block of code, methods, libraries, that are premade and can be added to systems for use.

Answer 20

It could mean that you cannot identify incidents as they occur or even afterwards, and means you will have less data to understand what happened and how to mitigate it in future.

Answer 21

By implementing logging policies that must be followed throughout the organisation, laying out what data should be logged and when. Using tools that help with monitoring your system, for example security information and event management systems (SIEMS) which make it easier to understand the data being logged by outputting it in dashboards, or intrusion detection and prevention systems (IDPS) that are focused on a organisations networks and Firewalls to find out security issues there etc.

Answer 22

A malicious software that causes damage to the system which it has infected.

Answer 23

Virus Worm Trojan horse

Answer 24

It can affect both.

Answer 25

Yes, malware can be OS specific.

Answer 26

A malicious executable that attaches itself to a host. The virus is executed when the host is interacted with. The virus's purpose is to spread to as many computers as possible.

Answer 27

A batch file An executable file A macro with an excel file

Answer 28

A virus that mutants itself by changing part of itself before it copies itself to another host. This many many different hosts will have that virus, but slightly different versions. When it mutates, the viruses signature changes, which makes it harder to combat against.

Answer 29

An identifier that is attributed to a virus and can be used to identify it if it is on a system.

Answer 30

By having a dictionary of virus signatures, which is full of known virus signatures. It can then identify known viruses infecting the computer.

Answer 31

Encrypting itself | Mutating itself

Answer 32

No, the virus will check if the host is infected. If it is then it moves on, if it is not then it infects the computer and leaves its signature there so that if the virus comes back to the computer it will know it is already infected.

Answer 33

Concealment - trying to hide itself Propagation - trying to spread itself Signature - the virus identifier

Answer 34

There is code relating the the concealment of the virus. The payload of the virus. The code to propagate itself across many hosts.

Answer 35

Time bombs | Logic bombs

Answer 36

A virus that triggers at a specific date/time specified in the virus code.

Answer 37

A virus that triggers when a specific event occurs. E.g. A user logs into their account, they run a certain application etc..

Answer 38

``` File infection Boot sector infection OS infection Macro infection Email infection ```

Answer 39

TRUE A virus can be further classified depending on the actions its payload is taking e.g. If the payload encrypts the comouters data, it is a ransomware virus.

Answer 40

Ransomware | Spyware

Answer 41

A Worm is a piece of malware that spreads extremely fast until it causes damage to a system/network with the number of copies and the amount of resources it has taken up with its propagation. Note: Not all worms are created with malicious intent, but can become malicious if they spread too fast and get out of control of the creator.

Answer 42

A Worm does not attach itself to a host file, whereas a virus does. A Worm can propagate without user interactions, whereas a virus can only spread if the user has interacted with its host file.

Answer 43

The Morris Worm. Created by Robert Tappan Morris, with the purpose to count the number of computers on a network. He did not properly implement the Worm Propagation and it ended up overloading the network and causing a DoS.

Answer 44

It can use SSH to travel between comouters of a network assuming the SSH isn't secure in its password or authorisation. Bugs and issues in networks can be exploited to slip between the computers. Vulnerabilities in OS can also be exploited. It can also spread through instant messaging too.

Answer 45

A piece of malware that disguises itself as a legitimate sofyware/application to seem non-threatening. It presents itself as a useful program and delivers on that useful service, but also has hidden malicious code that executes when you use the legitimate program. Note: this can commonly introduce what is referred to as a backdoor.

Answer 46

A way for an attacker to gain access to the system and bypass security for the system.

Answer 47

Spyware, so that it can take data from the computer and send it back to the attacker with the guise of still being a legitimate program. It take son this more passive type of attack so that it is less likely to be discovered.

Answer 48

Dictionary approach Activity monitor approach Integrity checker approach

Answer 49

In this approach the antivirus software stores and refers to a dictionary of known signatures for viruses/malware. It scans the system looking for any of the signatures in the database as this would be an instance of that virus. If it finds one, then it will notify the user and take actions against the virus. It normally does this through quarantining the file.

Answer 50

In the approach the antivirus looks at the behaviour of the system overall and monitors the activities of a system. If it thinks an activity occuribg on the system is malicious then it can take action. It might notice things like if a program is taking longer than normal to run. Once it notices strange behaviour like this, it can ntofiy the user and quarantine the source.

Answer 51

Sometimes known as the 'behaviour blocker' approach. In this approach the antivirus software monitors files for changes that are unusual e.g. A very old file that suddenly becomes much larger in size. Instances of unlikely behaviour can be notified to the end user, and the antivirus can then quarantine the file.

Answer 52

When an antivirus software takes a file it knows to be malware and removes it from the systems operations so it cannot execute. It can be done in many ways, one of these includes setting up a VM that is referred to as a sandbox that is disconnected from the system and put the file in there. Note: Once a file has been quarantined, the antivirus can monitor its behaviour in a safe environment (Sandbox) to see if it is malware, and if so what was it trying to do.

Answer 53

Antivirus software must be kept up to date so that the dictionary is updated with new virus signatures. Its unlikely to catch new virus that have not been discovered and added to the dictionary. It can also have challenges with polymorphic mutating viruses, whose signatures change when they mutate.

Answer 54

The anitivirus is reactive, and must first wait for some malicious behaviour to happen before it takes action.

Answer 55

When vrisues are generated from the same software, they might have common structure and similarities that can be identified by an antivirus. We also look to researchers whose job it is to identify new viruses. They look for instances of entirely new malware in the 'wild', and try to get a copy of it to analyse (Find out its purpose) , disassembling (Look at its inner structure) and identify (Give it an identifier and let antivirus software know about it) within an isolated environment.

Answer 56

It helps us see the inner structure and code of the virus, and this can help us identify its original code and use in future to identify similar viruses.

Answer 57

They are trying to identify its purpose as a virus. They will split it into the separate components of the virus e.g. Split it into propagation, concealment and the payload. From this point they can look for a signature to identify the virus.

Answer 58

It could disenffect it. It attempts to remove the virus from the infected host file in an attempt to keep the file intact. This isn't always successful. It can completely remove the virus. It removes the virus and the host from the system, this can sometimes be difficult as a virus may attempt to prevent this from happening.

Answer 59

An indicator of compromise is an indicator that suggests the presence of malware or the occurrence of a secutiry incident or intrusion. This could be an event on the system, a certain behaviour or a file. These can be used to identify future incidents, by notifying the system whenever previously identified IOCs occur.

Answer 60

Static Dynamic Hybrid of both

Answer 61

Static analysis looks at the code and structure of the suspected malware without actually executing it. It looks at the file names, hashes, file header data, domains and such to identify whether it is malicious. It can be used to identify malicious infrastructure, libraries and packed files.

Answer 62

In dynamic analysis the suspected malicious code is executed within an isolated safe sandbox environment. This allows the system to observe the behaviour of the malware and identify its purpose without risking a security incident.

Answer 63

A combitons of static and dynamic analysis. It analysis the structure and internal code of the malware and runs it in a sandbox, meaning it can dig deeper into the malware by implementing both techniques.

Answer 64

Since it doesn't actually run the code, sophisticated malware and malicious runtime behaviour can go undetected. Meaning that not all malware can be identified by this analysis.

Answer 65

Attackers are getting smarter, and since they know about the existence of sandboxes, they can code the malware to detect sandboxes.this means that some malware may be coded with hidden executables that remain dormant even when the main code is run, and only run when certain conditions are met. This can mean that the true nature of the malware might not be identified if the hidden code cannot be observed.

Answer 66

It means that you get the best of both static and dynamic, withiut the disadvantages. Runtime behaviours can be noticed when running the code during dynamic analysis, while hidden code that will not execute with the main payload can be identified during static analysis.

Answer 67

They provide root cause analysis of an incident, determine its impact on the system and attempt remediation and recovery after the attacker.

Answer 68

They use behavior known to be malicious, and monitor the system for that behaviour or activity similar to it e.g. Access to a particular port or network that shouldn't be connected to.

Answer 69

Static property analysis Interactive behaviour analysis Fully automated analysis Manual code reversing

Answer 70

The analysis and identification of the properties of the malware, such as embedded resources, file header details, hashes and so on. These are used to created initial IOCs and determine whether deeper analysis must take place.

Answer 71

Analysis used to oberseve and interact with the malware sample running in a lab. The behaviour of the malware is monitored, such as its interaction with the network, howbeit uses memory, its fuke system etc.. This process is time consuming and requires a skilled analyst.

Answer 72

Quick and easy analysis that runs without the need of an analyst. It assesses the malware and determines the repercussions of it and the damage it could cause ofln the network. It then produces and easy to read report for the security teams. This is the best type of analysis for processing malware at larger scales.

Answer 73

A security mechanism used to slow done network connections to a server. It is used to delay attacks such as DoS attacks and worms. It slows done the Worm infection and delays DoS attacks.

Answer 74

A decoy computer on the server that is set up to look like a legitimate computer on the network. It stores no valuable data and it is made to look enticing to attacks and malware. Once it is infected, the affects of the malware cna be observed on the computer and information can be gathered on it.

Week 7 - Web Security and Malware Flashcards

Learn about security on the Internet and they type of attacks that occur on there. Includes SQL injection, Cross site scripting, malware taxonomy etc.