CH-5 Malware Flashcards
How a Virus Spreads
Finds a network connection, then copies itself to other hosts on the network.
Mails itself to everyone in host’s address book.
Downloaded from a website link
What is a virus?
By definition, a computer virus is a program that self-replicates. Self-replication and rapid spread are the hallmarks of a virus.
A computer virus does what?
- Self-replicates
– Spreads rapidly
– May or may not have a malicious payload
Can a Trojan horse be crafted especially for an individual?
Yes.
Can a trojan horse spread like a virus?
Yes.
Does Microsoft send “security alerts”?
NO!
Exemples of web pages that consistently give the latest, most reliable, most detailed information on virus outbreaks.
https: // www.technewsworld.com/ perl/ section/ viruses-malware/
https: // us.norton.com/ internetsecurity-malware-virus-faq.html?
https: // www.us-cert.gov/ publications/ virus-basics
http: // www.techrepublic.com/ pictures/ the-18-scariest-computer-viruses-of-all-time/
How does a Logic Bombs work?
Scheduled to run when a specific condition is met
– The condition is often a date
– Could also be volume of traffic, etc.
How does a virus spread?
Method 1: emails itself out to everyone in your email address book- most comon method, especially via MS Outlook.
Method 2: scan your computer for connections to a network and then copy itself to other machines on the network to which your computer has access.
Method 3: USB, CDs, DVDs, masking itself as a legitimate file. In such a case it’s calle a Trojan horse.
Method 4: A website infected with a virus, and when someone visits the website, that person’s computer becomes infected.
How does the Antivirus software operate?
– Scans for virus signatures
■ Keeps the signature file updated
– Watches the behavior of executables
■ Attempts to access e-mail address book
■ Attempts to change Registry settings
How to remove Spyware?
■ Anti-virus software blocks some spyware
■ Ad-blockers can block additional spyware
■ Many specialized Spyware removal tools exist as well:
– Spybot Search & Destroy
– Malwarebytes Adwcleaner
– Adaware Antivirus
– Norton Power Eraser
That can a Trojan Horse do?
Download harmful software from a website.
Install a key logger or other spyware on your machine.
Delete files.
Open a backdoor for a hacker to use.
Tips for Avoiding Viruses
- Install anti-virus software and keep it up to date
- Do not open questionable email attachments
- Patch your operating system and applications
- Avoid questionable websites
- Avoid pirated software
- Backup your computer regularly
Trojan Variation: Man-in-the-Browser, how does it work?
Perpetrator installs a Trojan on a victim’s computer
■ Trojan monitors user’s web transactions as they occur in real time
■ Trojan can detect a page-load for a specific pattern in its targeted list
■ Captures and/or modifies data being entered into the browser
■ Does not need to simulate encrypted sessions
– Browser establishes a secure connection with a website as usual
– Trojan operates between your browser’s interface and you
What are Advanced Persistent Threats (APTs)
■ Highly organized and well-financed
■ Advanced techniques, not “script kiddies”
■ Ongoing over a significant period of time
■ Often carried about by nation states
What are Rootkits?
■ A collection of hacking tools that can:
– Monitor traffic and keystrokes
– Create a backdoor
– Alter log files and existing tools to avoid detection
– Attack other machines on the network
What are the most widely accepted and used virus scanners?
McAfee and Norton - best
Kaspersky and AVG - also good
What do Trojan horses do?
- Download harmful software
– Install a key logger
– Open a back door for hackers
What does a virus do to a network?
Reduces the functionality and responsiveness of a network by exceeding the traffic load that a network was designed to carry.
What is a Boot Sector Virus? How does it work?
Boot sector: As the name suggests, this type of virus infects the boot sector of the drive. Such viruses can be difficult for antivirus software to find because most antivirus software runs within the operating system, not in the boot sector.
What is a Boot Sector Viruse?
A malicious programs that reside in your hard drive.
They infect your machine by replacing your Master Boot Record (MBR) or DOS Boot Sector with their code.
In some cases, boot sector viruses will encrypt the MBR.
The Master Boot Record is on the first sector of your hard drive and executes whenever you power on your PC. This means that even if you try to remove boot sector viruses using an antivirus, they get loaded back into your computer’s memory on your next boot.
The most common way that these malicious programs spread is through shared removable media.
What is a Botnet?
A botnet is a number of Internet-connected devices, each of which is running one or more bots. Botnets can be used to perform Distributed Denial-of-Service attacks, steal data, send spam, and allow the attacker to access the device and its connection.
What is a Macro Virus?
Macro viruses infect the macros in office documents. Many office products, including Microsoft Office, allow users to write mini-programs called macros. These macros can also be written as a virus. A macro virus is written into a macro in some business application. For example, Microsoft Office allows users to write macros to automate some tasks.
What is a Memory Resident virus? How does it work?
A memory-resident virus installs itself and then remains in RAM from the time the computer is booted up to when it is shut down.
