Chapter 03: Malicious Code Flashcards
______ describes a wide range of software that is intentionally designed to cause harm to systems and devices, networks, or users. It can also gather info provide illicit access, and take a broad range of actions that the legitimate owner of a system or network may not want to occur.
Malware
_____ is malware that takes over a computer and then demands a ransom.
Ransomware
Defense against ransomware.
Effective backup system that stores files in a separate location that will not be impact if the system or device it backs up is infected and encrypted by ransomware.
crypto malware is an example of ______.
Ransomware
_____ are a type of malware that is typically disguised as legitimate software.
Trojans
______ provide attackers with remote access to systems.
Remote Access Trojans
Defense against Trojans
Security Awareness training
True or False: Every Trojan is a Remote Access Trojan.
False. A Remote Access Trojan is a subject of a Trojan. But, not every Trojan is a remote access Trojan.
____ are self-install and spread themselves.
Worms
Stuxnet is an example of a ___.
Worm
_______ are malware that is specifically designed to allow attackers to access a system through a backdoor.
Rootkits
What are the ways to detect a rootkit on a computer?
- Testing the suspected system from a trusted system or device.
- Rootkit detection tools
What is a common recommendation for removing rootkits?
Restore from a good last known backup
_____ are methods or tools that provide access that bypasses normal authentication and authorization procedures, allowing attackers access to systems, devices, or applications.
Backdoor
Detection for backdoors.
- Unexpected ports
- Unexpected services
Note: More advanced backdoors may be leveraging existing services.
_____ are remotely controlled systems or devices that have a malware infection.
Bots
Groups of bots are known as ______.
Botnets
_____ are used by attackers who control them to perform various actions, ranging from additional compromises and infection, to Denial-of-service attacks or acting as spam relays.
Botnets
Many botnet _______ systems operate in a client-server mode. For example, they will contact the _____ systems, which provide commands and updates, and track how many systems are in the botnet.
COC (Command and Control)
____ was frequently used to manage client-server botnets in the past, but many modern botnets rely on HTTPS traffic to hide C&C traffic and to prevent it from easily being monitored and analyzed by defenders.
Internet Relay Chat (IRC)
_____ are programs that capture keystrokes from keyboards.
Keyloggers
Name a defence against Keylogger
Use multifactor Authentication (MFA)
______ are not independent malicious programs. Instead, they are functions or code that are placed inside other programs that will activate when set conditions are met.
Logic bombs
_____ are malicious programs that self-copy and self-replicate. These typically have a trigger and a payload.
Computer Viruses
