Chapter 8 - Malicious Software

Question 1

Malicious software (malware)

Answer 1

any program that contains instructions that run on a computer system and perform operations that the user does not intend

Question 2

How does malware attack all three tenets of cybersecurity

Answer 2

1. Confidentiality - malware can disclose your organization’s private information
2. Integrity - malware can modify database records, either immediately or over a period of time
3. Availability - malware can erase or overwrite files or inflict considerable damage to storage media

Question 3

System infectors

Answer 3

target computer hardware and software startup functions

Question 4

File infectors

Answer 4

attack and modify executable programs

Question 5

Examples of executable programs

Answer 5

COM, EXE, SYS, and DLL

Question 6

Data infectors

Answer 6

attack document files containing embedded macro programming capabilities

Question 7

Lifecycle of a virus

Answer 7

Virus is dormant -> the user transmits an infected object to another computer -> the virus locates and infects suitable objects on the new computer

Question 8

Rootkits

Answer 8

malware that modifies or replaces one or more existing programs to hide the fact that a computer has been compromised

Question 9

Rootkits are…

Answer 9

difficult to detect and remove

Question 10

Ransomware

Answer 10

attempts to generate funds directly from a computer user by limiting access to data through encryption

Question 11

Spam

Answer 11

consumers computing resources bandwidth and central processing unit (CPU)

Question 12

Why is spam dangerous?

Answer 12

Diverts IT professionals from more critical activities and may contain malware

Question 13

Worms

Answer 13

self-contained programs designed to propagate from one host machine to another using the host’s own network system

Question 14

How are worms different from viruses?

Answer 14

Unlike viruses, they do not require a host program to survive and replicate

Question 15

Trojan horses

Answer 15

programs that masquerade as useful programs while hiding malicious intent

Question 16

Trojan horses are…

Answer 16

the largest class of malware

Question 17

How do trojan horses spread

Answer 17

through emails, website downloads, social networking sites, and bots

Question 18

Logic bombs

Answer 18

programs that execute a malicious function of some kind when they detect certain conditions

Question 19

Logic bombs can…

Answer 19

cause immediate damage or can initiate a sequence of events that cause damage over a longer period

Question 20

Logic bombs typically originate from…

Answer 20

organization insiders because they have more detailed knowledge of the IT infrastructure

Question 21

Active content

Answer 21

dynamic objects that do something when the user opens a webpage

Question 22

Vulnerabilities of active content

Answer 22

Users inadvertently download bits of mobile code which gain access to the hard disk and do things like fill up the desktop with infected file icons

Question 23

Add-ons

Answer 23

companion programs that extend the web browser

Question 24

Malicious add-ons

Answer 24

browser add-ons that contain some type of malware

Question 25

Botnets

Answer 25

robotically controlled networks that perform various functions

Question 26

Botnets can be used to...

Answer 26

distribute malware and spam; to launch DoS attacks

Question 27

DoS attacks

Answer 27

overwhelm a server or network segment to the point that the server or network becomes unusable

Question 28

Distributed denial-of-service attacks (DDoS)

Answer 28

use intermediary hosts to conduct the attack

Question 29

Synchronize (SYN) flood attacks

Answer 29

attacker uses IP spoofing to send a large number of packets requesting connections to the victim computer

Question 30

Smurf attack

Answer 30

attackers forge ICMP echo request packets from remote locations to generate DoS attacks

Question 31

Spyware

Answer 31

any unsolicited background process that installs itself on a user's computer and collects information about the user's browsing habits and website activities

Question 32

Adware

Answer 32

triggers nuisances such as popup ads and banners when a user visits certain websites

Question 33

Why is adware dangerous...

Answer 33

Affects productivity and collects and tracks information

Question 34

Phishing

Answer 34

tricks users into providing logon information on what appears to be a legitimate website but is actually a website set up by an attacker to obtain this information

Question 35

Spear phishing

Answer 35

attacker supplies information about the victim that seems to come from a legitimate company

Question 36

Pharming

Answer 36

the use of social engineering to obtain access credentials such as usernames and passwords

Question 37

Keystroke loggers

Answer 37

capture keystrokes or user entries and forward the information to the attacker

Question 38

Why are keystroke loggers dangerous?

Answer 38

they allow the attacker to capture logon information, banking information, and other sensitive info

Question 39

Homepage hijacking

Answer 39

exploiting a browser vulnerability to reset the homepage and then installing a browser helper object trojan program

Question 40

Webpage defacements

Answer 40

someone gaining unauthorized access to a web server and altering the index page of a site on the server

Question 41

Phases of an attack

Answer 41

Reconnaissance, gaining access, maintaining access, and covering your tracks

Question 42

Defense in depth

Answer 42

the practice of layering defenses into zones to increase the overall protection level and provide more reaction time to respond to incidents

Question 43

Application defenses

Answer 43

implement antivirus screening, ensure that applications are up to date, install firewalls

Question 43

Operating system defenses

Answer 43

deploy change-detection and integrity-checking software, ensure that all operating systems are consistent, disabling unnecessary services

Question 43

Network infrastructure defenses

Answer 43

use proxy services, use content filtering, disable any unnecessary network services