Chapter 6 - Malware

Question 1

Threat Vector

Answer 1

Vulnerabilities that COULD be exploited

Question 2

Attack Vector

Answer 2

The way vulnerabilities WILL BE/WERE exploited (it’s a sequence of event)

Question 3

Boot Sector Virus

Answer 3

Virus that boots up with the system

Question 4

Marco (Virus)

Answer 4

performs a set of actions; it’s embedded in the document

Question 5

Program Virus

Answer 5

looks for app files to attach to the app code, so that it opens up each time with the app

Question 6

Multipartite Virus

Answer 6

With each system boot it looks for a program to attached itself to its code; can re-install itself with every boot
(BOOT+PROGRAM VIRUS)

Question 7

Encrypted Virus

Answer 7

Virus of which malicious code is deciphered making it harder to find

Question 8

Polymorphic Virus

Answer 8

Its code changes with each execution (instead of encrypting itself, its code changes)

Question 9

Metamorphic Virus

Answer 9

More advanced polymorphic virus; rewrites the entire code

Question 10

Stealth Virus

Answer 10

It’s a technique virus uses so it’s prevented from detection (e.g. encrypted virus, poly/metamorphic virus)

Question 11

Armored Virus

Answer 11

focus on making analysis difficult for researchers and security programs (obfuscation techniques like encryption, compression, and code packing)

Question 12

Hoax

Answer 12

It’s a social engineering technique meant to scare people

Question 13

Worm

Answer 13

Oppositely to a virus it can replicate itself without human intervention (application) and spreads far and wide

Question 14

Trojan

Answer 14

Disguised software that has malicious code along with the regular app of the code (is a virus APART from performing the expected tasks)

Question 15

R.A.T

Answer 15

Remote Access Trojan - provides attacker with the remote access of victim’s machine

Question 16

What are the methods to protect from ransomware?

Answer 16

1) Backups
2) Regular Updates
3) Staff training
4) MFA

Question 17

How to act in an event of ransomware attack?

Answer 17

1) NEVER PAY
2) Disconnect from network
3) Notify authorities (unless the policy states otherwise)
4) Restore the backup

Question 18

Zombie

Answer 18

A part of the BOTNET; it’s a compromised device

Question 19

Botnet

Answer 19

A network of compromised devices (Zombies); controlled remotely

Question 20

Command and Control Node (C-2 Node)

Answer 20

A device controlling the Botnet

Question 21

What are Botnets used for?

Answer 21

1) Storing illegal content on victim’s machines (zombie devices)
2) Pivot points (enables lateral movement; acts a a middleman; data exfiltrated through a zombie) e.g. spreading through IoT devices through the network
3) Disguise in the events of attacks
4) Coin mining
5) Using the computing power to break encryption
6) DDoS (Mirai Botnet)

*often only 20-25% of computing power is used not to alarm the users

Question 22

Rootkit

Answer 22

A software designed to gain admin level of permission (going from Ring 3 to Ring 0)

Question 23

Kernel Mode

Answer 23

Operating in the “Ring 0” - highest permission level allowing access to drivers, sound cards, video displays etc.

Question 24

Shim

Answer 24

Piece of software placed in between network components; shim can intercept and alter system behaviors like hiding files or bypassing security controls

Question 25

Backdoor

Answer 25

Way to directly access the "inside" of the code/system; RAT works this way. If done on purpose it's dumb

Question 26

Logic Bomb

Answer 26

A piece of malicious code activated only in a certain condition; (worker placing a data extraction code in case he gets fired)

Question 27

Keyloger

Answer 27

Software recording the keystrokes

Question 28

Spyware

Answer 28

Software gathering and sending the data to the attacker // to prevent - antivirus+anti-spyware

Question 29

Bloatware

Answer 29

A piece of software you didn't ask for (marketing purposes); pre-installed or added in other downloads // malicious for its memory usage or possibility of having vulnerabilities

Question 30

Dropper

Answer 30

Acts as a normal program but in fact initiates other malware

Question 31

Downloader

Answer 31

Retrieves tools post DROPPER infection

Question 32

Shellcode

Answer 32

A lightweight piece of code meant to execute an exploit

Question 33

Concealment

Answer 33

Hiding evidence of an attack/exploit to prolong it

Question 34

9 Indicators of Malware Attacks:

Answer 34

1) Account Lockouts (after several brute force attempts) 2) Concurrent Session Utilization (simultaneous sessions on one account) 3) Blocked Content 4) Impossible Travel (account logged in the US and an hour later in Poland) 5) Resource Consumption (spikes in CPU, memory or network usage) 6) Resource Inaccessibility 7) Out-of-Cycle Logging 8) Missing Logs (attackers trying to hide their tracks) 9) Published or Documented Attacks (you find out on a website about a leakage)