Types Of Malware/ Anti-Malware Tools ( Comptia Objective 2.4)

Question 1

What is Ransomware and how does it work?

Answer 1

• Is a type of malware where you try to logon to your computer and are greeted with a message that says something along the lines of “ Your computer has been Locked! Due to a law violation of some sort, please make a payment of $200 to unlock your system
• May be a Fake Ransom( Locks your computer and claims to be the police who have locked it)
• The bad guys just want your money( They’ll take your computer in the meantime)
• The ransom may be avoided. A security professional may be able to remove these kinds of malware.

Question 2

What is Crypto-malware and how does it work?

Answer 2

• The latest generation of ransomware. Your data is unavailable until you provide cash.
• This type of Malware encrypts your data files( Pictures, documents, music, movies etc) and the only way to decrypt the data is to pay the ransom to receive a key to decrypt your data. Your operating system however remains unaffected.( They want you running but not working)
• Again when trying to gain access to your system you will see a popup window(The malware software) stating you have to pay to unlock your system and decrypt your data. Often they will ask for payment in cryptocurrency such as bitcoin which makes it untraceable.
• Because of Malware’s such as this it is crucial to keep an offline backup image so that if you do get this type of malware you can just wipe everything and install from the backup and regain access.

Question 3

What is Trojan horse malware and how does it work?

Answer 3

• Historically used by the greeks to capture Troy from the Trojans( presented a wooden horse as a gift the trojans not knowing that inside the horse was hundreds of soliders who once inside attacked and captured Troy)
• A Trojan horse is basically a digital wooden horse.
• The malware poses itself as something else that is safe and trusted and then behind the scenes infects you with the malware so that it can conquer your computer.
• Circumvents your existing security because you the user are choosing to install it. Anti-virus may catch it when it runs however the better trojan horses are built to avoid and disable AV.
• Once it’s inside your system it has free reign and may open the gates for other programs.

Question 4

What is Spyware and what does it do?

Answer 4

• Malware that spies on you( Advertising, identity theft, affiliate fraud
• Can trick you into installing( Peer to peer software, fake security software) and then installs in a trojan like fashion.
• The spyware can also view your browser surfing habits.
• In some instances Keyloggers could be used to capture usernames and passwords used online and then send onto the mothership.

Question 5

What are keyloggers and how do they work?

Answer 5

• Your keystrokes contain valuable information( Web site login URLS, passwords, email messages etc)
• The keylogger is able to capture your inputs on your keyboard and figure out your usernames, passwords etc. Very powerful malware can save all of your inputs and send it to the bad guys.
• Circumvents encryption protections( Your keystrokes are in the clear)
• There are other special types of keyloggers used for other types of data logging( Clipboard logging, screen logging, instant messaging, search engine queries etc) .

Question 6

What is a rootkit and what does it do?

Answer 6

• This is a very serious type of Malware
• Originally a Unix technique( The “root” in rootkit)
• Modifies core system files( Part of the kernel)
• Is not usually an application becomes part of the operating itself and can be invisible in the operating system( Won’t see it running in the task manager) making it extremely dangerous.
• Also invisible to traditional anti-virus utilities( If you can’t see it, you can’t stop it)
• Fortunately rootkits are relatively rare

Question 7

What does the term Virus mean?

Answer 7

• A generic term for malware.
• Malware that can reproduce itself( With your assistance of course)
• It needs you to execute a program/application
• Can reproduces itself through file systems or the network. Just running a program can spread a virus.
• May or may not cause problems. ( Some viruses are invisible, some are annoying)
• Anti-virus is very common( Thousands of new viruses every week is your signature file updated? )

Question 8

What are the various types of viruses?

Answer 8

• Program viruses( It’s part of an application install)
• Boot sector virus( Who needs an OS?)
• Script viruses( Operating system and browser based such as taking advantage of java script inside your browser)
• Macro viruses( Common in Microsoft Office) . Can delete your data or send your files to a third party.

Question 9

What are Worms? And what makes them more dangerous than your standard type of malware?

Answer 9

• A type of Malware that self-replicates itself without user intervention
• Doesn’t need you to do anything
• Uses the network as a transmission medium
• Self propagates and spreads quickly.
• Worms are pretty bad things( Can take over many systems very quickly)
• Firewalls and IDS/IPS can mitigate many worm infestations. But this doesn’t help much once the worm is already inside the system.

Question 10

What is the Wannacry Worm? And what does it do?

Answer 10

• Is a type of worm that infects multiple systems with ransomware.
• Vulnerable systems are looked for over the network and are exploited with something called EternalBlue this then installs a backdoor which downloads the Wannacry worm

Question 11

What are Botnets and how do they work?

Answer 11

• Robot networks( Skynet is self-aware) performs automated functions
• Once your machine is infected it becomes a bot( You may not even know)
• Botnets get onto your computer via something like a Trojan horse(“ I just saw a funny video of you! Click here”) or you run a program or click an ad you THOUGHT was legit, but….. or via an OS or application vulnerability.
• After botnet installation it lives the life of a bot. Sit’s around and waits for instructions from a “ mother ship” .

Question 12

When it comes to anti-virus and anti-malware what is important thing to know?

Answer 12

• You need both!
• Real time options( not just an on-demand scan)
• Modern anti-malware recognizes malicious activity( Doesn’t require a specific set of signatures)

Question 13

What is the Windows Recovery Environment and what is it used for?

Answer 13

• Very powerful
• Gives you access to the operating system in the event that the malware is preventing you having access to your system
• It should be noted that using this can be very dangerous and should be used as a last resort as you could accidentally cause permanent loss of data or damage your system
• Provides complete control( Fix your problems before the system starts) . Also allows you to remove malicious software.
• Requires additional information( Use, copy, rename, or replace operating system files and folders) , Enable or disable service or device startup. Also allows you to repair the file system boot sector or the master boot record( MBR)

Question 14

How would you access the Windows Recovery Environment console?

Answer 14

• In Windows 7 you would need to boot from the installation media or press F8 on startup and select Advanced Boot Menu.
• You will then be provided System Recovery Options or the command prompt option.
• In order to access the console in Windows 8/8.1 and Windows 10 you would access the console by booting from the installation media and then select “ Troubleshoot/Advanced Options/Command Prompt

Question 15

What is one of the BEST ways to recover from Malware?

Answer 15

• Backup/Restore
• Always have a backup( This is the best insurance policy ever)
• Image backup built into Windows. In Windows 8/10 it’s called Backup and Restore( Windows 7)
• This is the only way to be 100% sure that malware has been removed. Seriously cleaning isn’t 100%.

Question 16

What is End User Education and why is it so important?

Answer 16

• It is essentially One on One personal training on how a user should or should not be using their system. ( What to click and what not to click)
• Can be in the form of Posters and signs posted throughout an office reminding users of what to do and what not to do when using their computers.
• Message board postings are another good form of End user education.
• Login messages can be helpful but may start to become invisible overtime as a user ignores what they are seeing.
• Intranet pages are also an excellent form of end user education as it can be centrally accessed by everyone within an office environment and tend to get read on a daily basis.

Question 17

What are Software Firewalls and what are they used for?

Answer 17

• Used to monitor the local computer and alert on unknown or unauthorized network communication.
• Prevent malware communication( Downloads after infection) can prevent botnet communication right at the firewall essentially preventing it communicating with the bad guys for instructions.
• Always use Windows Firewall/Windows Defender at a minimum.
• Should run by default and always be on. Constantly monitoring any network connection.

Question 18

Why are Secure DNS services an excellent way to prevent malware and how do they work?

Answer 18

• External/Hosted DNS service. Provides additional security services.
• Helps prevent users accessing known bad websites that attempt to spread malware. it does this by :
• Providing Real-Time domain blocking. Sites containing malware are not resolvable. Database is constantly updating with a list of “ bad IP addresses” that contain malware and will not resolve those IP addresses if entered by the user.
• Block Harmful websites( Phishing sites, parked domains etc)
• Use Secure Platforms to help avoid DNS cache poisoning attacks.