Chapter 1 - Trojans and Backdoors Flashcards
(25 cards)
backdoor
The entrance to a network that bypasses normal authentication and security procedures.
client-server network model
The model that defines communication interactions between individual client computers and servers.
covert channel
Illegal, hidden path used to transfer data from a network.
Internet Control Message Protocol (ICMP)
A connectionless protocol that is generally used to provide error messages to unicast addresses
ICMP tunneling
Utilization of the ICMP to bypass filtering by network devices.
Internet Relay Chat (IRC)
A form of instant text-based communication carried out over the internet.
keylogger
Hardware or software that records the keystrokes or mouse movements entered into a computer.
overt channel
Legal, secure channels for transferrign information and data within a network.
Post Office Protocol version 3 (POP3)
An e-mail transfer protocol for downloading e-mail from a POP server, using port 110.
Transmission Control Protocol (TCP)
A protocol that defines and regulates the method of data transmission between computers
Trojan horse
A program in which malicious or harmful code is contained inside apparently harmless programming or data.
User Datagram Protocol (UDP)
A data-transmission protocol that does not require transmission paths to be established before data is transmitted.
virtual network computing (VNC) software
Software that allows users to remotely control a computer.
wrapper
A program used to bind trojan executables to legitimate files.
What are the signs of a Trojan infection?
Various unexplained activity and ports listening that shouldn’t be.
Name and describe three types of Trojans.
RAT - Allow full control over system. Data-Sending Trojan - Provides attackers with passwords and confidential information. Proxy Trojans - Turn the infected system into a proxy server for attacker anonymity.
What is a Trojan horse construction kit?
Kits help attackers construct Trojan horses of their choice.
How do RATs work?
They turn the system into a server that listens on specific ports. Not as effective if the system is behind a firewall.
Name 3 methods used to detect Trojans.
- Scan for suspicious open ports. 2 Scan for suspicious running processes. 3. Scan for suspicious registry entries. 4. Scan for suspicious network activities. 5. Run a Trojan detector.
How does a reverse connecting Trojan work?
The Trojan initiates a connection back to a listening system, allowing the attacker to bypass firewalls.
What is an XSS tunnel?
A tunnel allowing HTTP traffic through an XSS channel to use any application that supports HTTP proxies.
How is a virus different from a worm?
Worms are self-replicating, does not modify stored programs, and is easy to remove while viruses are the opposite.
What are the three best methods of virus detection?
Scanning, Integrity checking and interception.
What do macro viruses target?
Single applications
