Chapter 6 Flashcards
(24 cards)
one of the most significant categories of threats to computer systems
malware/malicious software
a program that is inserted into a system with the intent of compromising the confidentiality, integrity or availability of the victim’s data
malware
infection of existing executable or interpreted content by viruses that is subsequently spread to other system
Propagation mechanism
preformed by malware once it reaches a target system can include corruption
Payload action
it includes a variety of propagation mechanisms and payload modules that even novices can combine,select and deploy
crimeware/toolkits
is prominent, recent, example of such attack kit
Zeus crimeware
is a piece of software that can infect other programs by modifying them
computer virus
computer virus has three parts:
- Infection mechanism
- Trigger
- Payload
the means by which a virus spreads or propagates, enabling it to replicate
Infection mechanism
The event or condition that determine or delivered when the payload is activated
Trigger
What the virus does, besides spreading.
Payload
Four phases of typical virus
- Dormant phase
- Propagation phase
- Triggering phase
- Execution phase
virus classification by target
- Boot sector infector
- File infector
- Macro virus
- Multipartite virus
virus classification by concealment
- Encrypted virus
- Stealth virus
- polymorphic virus
- Metamorphic virus
Creates copies during replication that are functionally equivalent but have distinctly different bit patterns
Polymorphic virus
The portion of the virus that is responsible for generating keys and performing encryption/decryption is referred to as the _____
mutation engine
is a program that actively seeks out more machines to infect, and then each infected machine serves as an automated launching pad for attacks on other machines
Worm
Worm Replication
- Email or IM
- file sharing
- remote execution capability
- Remote file access or transfer capability
- Remote login capability
- first fucntion in the propagation phase for a network worm
- searches for other systems to infect
Scanning/fingerprinting
Scanning strategies that a worm can use
- Random
- Hit-list
- Topological
- Local Subnet
- Well-known Worm infection
- it was designed to spread on UNIX systems and used a number of different techniques for propagation
The Morris worm
NImda worm used variety of distribution methods:
- Windows shares
- Web Server
- Web clients
- Backdoors
the state of the art in worm technology:
- Multiplatform
- Multi-exploit
- Ultrafast spreading
- Polymorphic
- Metamorphic
- Transport Vehicles
- Zero-day exploit
this refers to programs that can be shipped unchanged to heterogeneous collection of platforms and execute with identical semantics
- Mobile code
