L4 Malicious Software and Application Attacks

Question 1

Name a few different types of attacks

Answer 1

Passive
Active
Insider
Outsider

Question 2

What is a passive attack?

Answer 2

An attempt to learn or make use of information from the system that does not affect the system resources.

Question 3

What is a active attack?

Answer 3

An attempt to alter the system resources or affect their operation.

Question 4

What is an insider attack?

Answer 4

An attack initiated by an entitiy inside the security perimeter, an inside attack.

Question 5

What is a outsider attack?

Answer 5

An attack initiated by an entity outside the security perimeter.

Question 6

What is an Attack tree?

Answer 6

Is an branching, hierarchical data structure that represent a set of potential techniques for exploting security vulnerabilities.

Question 7

What is Malware?

Answer 7

a program that is inserted into a system, usually without the owner of the system knowing it. With the intent of compromising the CIA of the victims data, applications or operating system. Or otherwise annoying or disrupting the victim.

Question 8

What types of malware are there?

Answer 8

• Viruses
• Worms
• Trojan horses
• Logic bombs
• etc.

Question 9

What is a virus?

Answer 9

• Is a piece of malicious code replicating itself by attaching to another piece of executable code.
• When the executuble code is run, the virus is also executed and has the oportunity to infect and perform any other nefarious actions it was intended to do.

Question 10

What is a worm?

Answer 10

• Is a piece of code that attempts to penetrate networks and computer systems
• When the worm penetrates it copies itself on the penetrated system.
• A worm doesn’t have to rely on the attachement to another piece of code as a virus would have to.

Question 11

What is the difference in the lifcycle of a worm when compared to a virus?

Answer 11

A worm can survive on it’s own, whereas a virus code has to attach itself to something else.

Question 12

What is a Trojan horse?

Answer 12

• Is a piece of software that appears to do a thing, and may even do it in order to hide other functionality.

Question 13

What is a challenge with a Trojan horse?

Answer 13

The attacker have to somehow entice the intended victim to copy and run the program.

Question 14

What is the difference in the lifcycle of a trojan when compared to a virus?

Answer 14

Unlike the virus which has to copy itself by attaching to other files or programs the trojan is a standalone program that must be copied and installed by the victims.

Question 15

What is a logic bomb?

Answer 15

• It’s a type of mailcious software that is deliberately installed, often by a authorized user and in particular by administrators.
• Logic bombs difficult to detect.

Question 16

What is the difference in the lifcycle of a Logic bomb when compared to other malware?

Answer 16

A logic bomb is a piece of code that sits dormant for a period for time until som kind of event invokes its malicous payloud.

Question 17

What is a buffer overflow

Answer 17

Is an attack where input is placed into a buffer or data holding area, filling it more than it has the capacity too handle, in turn overwriting information. At this time attackers exploit the condition to crash the system or place specifically crafted code which could allow them to gain control of the system.

Question 18

What is a scripting attack?

Answer 18

Is an attack where additional commands are hidden inside the user input. The usual intent is to provide the attacked with unauthorized or create damage to websites.

Question 19

What makes a system vulnerable to scripting attacks?

Answer 19

Where the user input is unvalidated.
Examples:
* Adding - - to user input at the end may leave a database open to attacks, because code is commented out and your own code can be added in.

Question 20

What is an SQL injection attack?

Answer 20

• SQL commands are placed between single quotes.
• E.g SELECT * FROM client WHERE name = ‘Bob’ OR 1=1 – ‘
• A legal username is inserted into the query, but because name = Bob OR 1=1 is TRUE the entire client table is selected.