Topic 3 - Software Flashcards
(55 cards)
What are Vectors in Computer Security?
Vectors are the mechanism through which a malware infects a machine i.e. a software vulnerability or someone clicked a suspicious link, etc…
What are payloads?
Payloads are the actual malware deposited on the machine, or the harmful results
What is the formal definition of a virus?
A piece of self-replicating code, which propagates by attaching itself to a disk, file or document
What is the formal definition of a worm?
Worms are self-replicating and stand-alone programs, which do not require human intervention. They exploit known software vulnerabilities in order to spread.
What is the ‘Exploit Lifecycle’?
Exploit lifecycle measures how long the exploit takes to cause problems. Example - Standard lifecycle involves the exploit being discovered by reverse-engineering a patch.
What is a ‘Zero-Day’ exploit?
It is an exploit in the system that was previously unknown by the system developers - Substantially more dangerous than a standard exploit.
What is a Trojan?
A malicious program pretending to be a legitimate application
It is often obtained through email attachments or malicious websites.
How does ransomware work?
Ransomware will encrypt or block access to files and demand a ransom. Due to this, if you attempt to remove it via an Anti-Virus, then your files will still remain inaccessible.
What is a defining feature of Trojans?
Trojans cannot replicate themselves - They rely on human error to spread.
What are some challenges faced when attempting to install ransomware on another machine?
Getting a user to run it
Bypassing the Anti-Virus and browser protections
What are some of the common methods for deploying Ransomware?
Fake emails
Malicious web pages
Obfuscated Javascript attachments
Deployed using exploit kits
What is a formal definition of an Exploit?
A software or hardware bug that allows an attacker to circumvent an OS’s security perimeter.
What are some key areas that exploits target with Memory Management?
Buffer Overflow
Stack Overflow
Heap Overflow
How does a Buffer Overflow occur?
Buffer overflows occur when data is written into a buffer. If the data is larger than the buffer and exceeds its size, then an overflow occurs, and then the data will overwrite the memory beyond the buffer.
How is the Stack defined?
A stack holds information on local variables and function calls. A function call will push a new frame onto the stack, and a return will pop it off.
How does Stack Smashing work?
Stack Smashing works by crafting a specific long string, and then, within C/C++ programs, causing the memory management to push over a buffer limit, thereby overriding data with custom exploit code
How does a Canary work?
Stack canaries modify the prologue and epilogue of all functions to check a value in front of the return address is unchanged.
How do modern systems defend against a memory overflow attack?
Modern systems include a feature called Data Execution Prevention (NX), which marks stacks as non-executable if they detect any issues.
What are some further protection methods that are used?
Developers restrict access to obvious system calls
Address Space Layout Randomisation (ASLR) moves the address of library and programs around
Null bytes are inserted into standard library addresses
What is Return-Oriented Programming?
It doesn’t insert exploit code, and instead pieces together other bits of code already on the machine and uses them to execute exploits instead.
What are the three types of Anti-Virus?
Signature-based detection
Heuristics
Machine Learning/Next-Gen
How does Signature-based detection work in Anti-Virus?
Stores some small code signature for each virus
Scan files either in bulk or at runtime, compare with the signatures on file
Uses generic signatures
How does Heuristic Detection work in Anti-Virus?
Heuristics determine what actions and rules a virus program will normally adopt
It starts the program in a VM, and sees what it does
Theoretically it can detect a virus that doesn’t strictly match some signatures
What is an IDS and how does it work?
Intrusion Detection System:
Detects possible intrusion attempts, and generates alerts and logs for administrators
