Chapter 4 Programs and Programming Pt2

What is malware?

Software/code intentionally created to cause harm, steal information, damage systems, or perform unexpected actions.

What is a virus?

Malicious code that replicates/spreads by attaching to or modifying another program or file.

What is a transient virus?

A virus that depends on its host program and runs while the infected program runs.

What is a resident virus?

A virus that places itself in memory and can remain active after the original program stops.

What is a worm?

Malicious code that spreads copies of itself through a network as a stand-alone program.

What is a Trojan horse?

A program that looks legitimate/useful but secretly performs malicious behavior.

Key difference: virus vs. worm?

A virus attaches to/modifies another program or file; a worm spreads as a stand-alone program through a network.

Does a virus require a network?

No. It can spread through programs, documents, USB drives, or other files.

What is the main characteristic of a Trojan horse?

Hidden malicious behavior inside something that appears legitimate.

What are common malware objectives?

Stealing information, spying, ads, damaging files, spreading malware, exploiting vulnerabilities, or gaining system control.

What are two important attacker motivations in the chapter?

Financial gain and espionage.

What are the four important aspects of malware?

Harm; Transmission and Propagation; Activation; Stealth.

What is harm in malware analysis?

The damage malware causes to users or systems.

What is transmission/propagation?

How malware gets from one place to another and makes additional copies.

What is activation?

How malicious code starts running, gains control, installs itself, or runs again later.

What is stealth?

How malware hides during installation, execution, or storage to avoid detection.

What is an appended virus?

A virus that attaches itself to another program; it runs before the original program.

What is a surrounding virus?

A virus that controls execution before and after the original program and can use that control to hide.

What is an integrated virus?

A virus that inserts itself into parts of the original program.

What is replacement?

Malicious code completely replaces the original program.

What is a boot sector virus?

Malware that places itself in the startup process and can run early when the computer starts.

What is a memory-resident virus?

Malware that remains active in memory and can infect other files/devices during the session.

What is a macro virus?

Malware that uses stored command sequences in applications such as word processors or spreadsheets.

Why can PDFs be a malware risk?

Programs interpret commands inside PDFs; a vulnerability in the interpreter may allow malicious commands to execute.

Why are code libraries possible malware hosts?

Many programs use shared libraries, so malicious code placed in a common library can execute through many programs.

What is signature detection?

Searching for a recognizable pattern associated with known malware.

Why is signature detection limited?

New malware may lack a known signature, and malware can be modified while keeping the same effect.

What can antivirus do after finding malware?

Warn, block, quarantine, or remove it.

What is modularity?

Breaking a large program into smaller components that are easier to understand, test, maintain, and secure.

What is high cohesion?

Everything inside a module closely relates to its main purpose.

What is low coupling?

A module depends very little on other modules.

What is encapsulation?

Hiding internal implementation and allowing controlled interaction through defined interfaces.

What is information hiding?

Other modules know what a component does but do not need to know how it does it.

What is mutual suspicion?

Programs should not automatically trust other programs or their inputs; each should check and protect itself.

What is confinement?

Restricting an untrusted/suspicious program to a limited area so damage remains limited.

What is least privilege?

Give a user or program only the permissions it actually needs.

What is economy of mechanism?

Keep security mechanisms small and simple.

What is open design?

Security should not depend on attackers being unaware of how the system works.

What is complete mediation?

Check every access request.

What is permission-based security?

Default to denying access unless permission is granted.

What is separation of privilege?

Important access should depend on more than one condition.

What is least common mechanism?

Reduce unnecessary sharing between users and programs.

Why is ease of use a security principle?

Security mechanisms must be usable enough that users will actually use them.

What is unit testing?

Testing one individual component.

What is integration testing?

Checking whether components work together correctly.

What is function testing?

Checking whether required functions work.

What is performance testing?

Checking whether the system meets performance and other requirements.

What is acceptance testing?

Checking whether the system satisfies customer expectations.

What is installation testing?

Checking whether the system works properly after installation.

What is regression testing?

Checking that a change/fix did not break something that previously worked.

What is black-box testing?

Testing without examining internal code; provide input and observe output.

What is clear/white-box testing?

Testing with access to the code/internal structure.

What is penetration testing?

Security experts attack a system like real attackers to find vulnerabilities.

Does a clean penetration test prove a system is secure?

No. Finding nothing does not prove the system is completely secure.

What is defensive programming?

Writing software while expecting inputs and conditions to be wrong or unexpected.

What inputs should defensive programs validate?

Data type, allowed range, reasonable values, number of parameters, and parameter order.

What is the problem with 'penetrate and patch'?

It can fix symptoms while missing design problems, introduce faults, or break other parts of the system.

What is security by obscurity?

Assuming something is secure because attackers do not know about it; the chapter says this is unreliable.

What is ransomware?

Malware that encrypts files or steals data and demands money.

What are infostealers?

Malware that steals passwords, browser cookies, credit-card data, or login sessions.

What are RATs?

Remote Access Trojans that secretly let attackers control a computer.

What is phishing malware?

Malware/attacks delivered through fake emails, links, attachments, QR codes, or fake login pages.

What is cryptojacking?

Secretly using a victim's computer to mine cryptocurrency.

What is supply-chain malware?

Malware introduced by compromising trusted software, updates, libraries, or vendors.

What is fileless malware?

Malware that tries to use legitimate system tools instead of installing an obvious malicious file.

What is a major modern malware focus?

Credential theft and account access, not only destruction of computers.

Name core user-side malware protections.

Updates, antivirus/endpoint protection, MFA, strong unique passwords, backups, cautious attachments/links, trusted software, and avoiding unknown USB drives.

What should a user do if a computer suddenly behaves strangely?

Disconnect it from the network and report it rather than continuing to use it.

What is the main security lesson of the chapter?

Security requires multiple layers; protect the user, account, application, data, and software supply chain.