Lecture 4: Malware & Automated Attacks

what is malware?

range of computer programs used to automate attacks against computer systems

are there any specific laws against the creation of malware?

no

5 reasons malware across networks is costly

1. loss of data and copyright info

2. identity theft

3. loss of revenue due to customer apprehension

4. time spent removing programs

5. losses in productivity

what does malware do?

operated by exploiting vulnerabilities or flaws in computer software

the execution of the exploit activates a ___

payload

what is a payload?

portion of the program that does the damage

the same payload may be delivered by DIFFERENT carries (t/f)

true

what are the 4 most common malware programs?

viruses

trojans

worms

blended threat

in order for a virus to work, it must be ___

attached to a host to be spread

where are viruses typically concealed?

e-mail attachments, pirated software and shareware files

viruses are user activated (t/f)

true

a viruses does NOT deliver a payload (t/f)

false

viruses were initially benign, and later evolved into vulnerability exploits (t/f)

true

what is the difference between a virus and a worm?

a worm is replicating and does NOT need a host to be transmitted or replicate

worms deliver a payload (t/f)

false

worms propagate independently (t/f)

true

do worms or viruses cause DOS attacks?

worms, take up memory space and network resources

what are trojans?

programs that appear normally but contain hidden functions

what happens when someone downloads/opens a trojan?

payload is executed silently

what are examples of trojan horses?

keystroke logging

webcam control

backdoors for rev shell

antivirus control

access to stored information

what is botnet malware?

similar to viruses/worms as they infect other machines, but deliver payload like a trojan

multiple machines infected by the same bot are called botnets (t/f)

true

what is ransomware?

computer viruses that encrypts users files and demands a ransom (payment) to regain access

what does RAT stand for?

remote access trojan

what does a RAT do?

malware program that includes a backdoor for admin control over target computer

a RAT is designed to..

allow an attacker to remotely control an infected computer

all hackers can write malware (t/f)

false

knowledge of programming languages, vulnerabilities and exploits are seen as __

elite