Common Online Threats

Cryptography: Basic Quiz - Virus/Trojans

  

•What is the easiest method to get a password?

–Brute-force cracking

–Guessing

–Dictionary attack

–Hybrid attack

•Which of the following is a passive online attack?

–Password guessing

–Network sniffing

–Brute-force attack

–Dictionary attack

•How do you remove a Trojan from a system?

–Search the Internet for freeware removal tools.

–Purchase commercially available tools to remove the Trojan.

–Reboot the system.

–Uninstall and reinstall all applications.

•What is the difference between a backdoor and a Trojan?

–A Trojan usually provides a backdoor for a hacker.

–A backdoor must be installed first.

–A Trojan is not a way to access a system.

–A backdoor is provided only through a virus, not through a Trojan.

•What type of virus modifies itself to avoid detection?

–Stealth virus

–Polymorphic virus

–Multipartite virus

–Armored virus

•

•What is a covert channel?

–Using a communications channel in a way that was not intended

–Tunneling software

–A Trojan removal tool

–Using a communications channel in the original, intended way

•Which of the following are the best indications of a virus attack? (Choose all that apply.)

–Any anomalous behavior

–Unusual program opening or closing

–Strange pop-up messages

–Normal system operations as most viruses run in the background

•What components of a system do viruses infect? (Choose all that apply.)

–Files

–System sectors

–Memory

–CPU

–DLL files

•What is cryptography?

–The study of computer science

–The study of mathematics

–The study of encryption

–The creation of encryption algorithms

•What is the process of changing the order of some characters in an encryption key?

–Transposition

–Subtraction

–Substitution

–Transrelation

•How many keys exist in a public/private key pair?

–A. 1 B. 2 C. 3 D. 4

•Which cryptographic attack attempts to crack the code by looking for patterns and using statistical analysis?

–Cipher text–only attack

–Chosen–plain text attack

–Chosen–cipher text attack

–Brute-force attack

•What is the goal of a known–plain text attack?

–To read the encrypted data

–To gain access to the public key

–To discover the encryption key

–To validate the sender of the data

•Why would hackers want to cover their tracks?

–To prevent another person from using the programs they have installed on a target sys-

–tem

–To prevent detection or discovery

–To prevent hacking attempts

–To keep other hackers from using their tools

•What is the process of hiding text within an image called?

–Steganography

–Encryption

–Spyware

–Keystroke logging

•What is privilege escalation?

–Creating a user account with higher privileges

–Creating a user account with administrator privileges

–Creating two user accounts: one with high privileges and one with lower privileges

–Increasing privileges on a user account

Information Security: Viruses

    

A computer virus is a piece of software that can “infect” other programs by modifying them; the modification includes injecting the original program with a routine to make copies of the virus program, which can then go on to infect other programs. A computer virus carries in its instructional code the recipe for making perfect copies of itself. The typical virus becomes embedded in a program on a computer. Then, whenever the infected computer comes into contact with an uninfected piece of software, a fresh copy of the virus passes into the new program. Thus, the infection can be spread from computer to computer by unsuspecting users who either swap disks or send programs to one another over a network. In a network environment, the ability to access applications and system services on other computers provides a perfect culture for the spread of a virus.

A virus can do anything that other programs do. The difference is that a virus attaches itself to another program and executes secretly when the host program is run. Once a virus is executing, it can perform any function, such as erasing files and programs that is allowed by the privileges of the current user.

A computer virus has three parts:

·      Infection mechanism: The means by which a virus spreads, enabling it to replicate. The mechanism is also referred to as the infection vector. 


·      Trigger: The event or condition that determines when the payload is activated
or delivered.

·      Payload: What the virus does, besides spreading. The payload may involve damage or may involve benign but noticeable activity. 


During its lifetime, a typical virus goes through the following four phases: 


·      Dormant phase: The virus is idle. The virus will eventually be activated by some event, such as a date, the presence of another program or file, or the capacity of the disk exceeding some limit. Not all viruses have this stage. 


·      Propagation phase: The virus places a copy of itself into other programs or into certain system areas on the disk. The copy may not be identical to the propagating version; viruses often morph to evade detection. Each infected program will now contain a clone of the virus, which will itself enter a propagation phase. 


·      Triggering phase: The virus is activated to perform the function for which it was intended. As with the dormant phase, the triggering phase can be caused by a variety of system events, including a count of the number of times that this copy of the virus has made copies of itself.

·      Execution phase: The function is performed. The function may be harmless, such as a message on the screen, or damaging, such as the destruction of programs and data files.


The following pseudocode fragment shows how a simple computer virus works.

beginvirus:

       if spread-condition then begin

              for some set of target files do begin

                      if target is not infected then begin

                             determine where to place virus instructions

                             copy instructions from beginvirus to endvirus into target

                             alter target to execute added instructions

                     end;

              end;

       end;

       perform some action(s)

       goto beginning of infected program

endvirus:

A virus classification by target includes the following categories:

·      Boot sector infector: Infects a master boot record or boot record and spreads 
when a system is booted from the disk containing the virus. 


·      File infector: Infects files that the operating system or shell consider to be executable. 


·      Macro virus: Infects files with macrocode that is interpreted by an application.

A virus classification by concealment strategy includes the following categories: 


·      Encrypted virus: A typical approach is as follows. A portion of the virus creates a random encryption key and encrypts the remainder of the virus. The key is stored with the virus. When an infected program is invoked, the virus uses the stored random key to decrypt the virus. When the virus replicates, a different random key is selected. Because the bulk of the virus is encrypted with a different key for each instance, there is no constant bit pattern to observe. 


·      Stealth virus: A form of virus explicitly designed to hide itself from detection 
by antivirus software. Thus, the entire virus, not just a payload is hidden. 


·      Polymorphic virus: A virus that mutates with every infection, making detection by the “signature” of the virus impossible. 


Metamorphic virus: As with a polymorphic virus, a metamorphic virus mutates with every infection. The difference is that a metamorphic virus rewrites itself completely at each iteration, increasing the difficulty of detection. Metamorphic viruses may change their behavior as well as their appearance. 

 

CyberSecurity: Malware - Virus, Worms and Trojans

The two biggest threats to consumers online are malware and phishing.

Malware is the collective name for software that has been designed to disrupt or damage data, software or hardware. There are several types of malware, such as viruses, worms and Trojans.

However, as malware has evolved, from its beginnings as demonstrations of prowess by individual programmers to sophisticated technologies developed by organised crime, the boundaries between the different categories are beginning to blur. 

Viruses
The best-known type of malware is probably the virus, although many pieces of malware are called viruses they are nothing of the sort.

A virus is a piece of software that has been written to insert copies of itself into applications and data and onto crucial parts of a computer’s hard disk. Viruses are said to be self-replicating programs and date back as far as the early 1970s, but they only became well known with the advent of microcomputers and later, the internet.

Viruses attach themselves to specific applications on a computer and are activated when the program is first run. At that point, the virus may make a copy of itself on the hard disk and continue to run, or it may only run each time the application is used. Early viruses, relying on floppy disks for transmission, spread quickly as infected data disks were shared around an office, or pirated software was passed around a playground. Nowadays, viruses rely on devices such as flash memory cards or are transmitted through internet connections.

Although some viruses are not intended to cause harm, the majority of these programs are designed to harm users, by corrupting their data or attacking the operating system itself or providing an exploitable ‘backdoor’, giving attackers access to the computer. Even where no harm is intended, viruses consume memory, disk space and processing power.

Worms
Another type of self-replicating malware is the worm; like a virus it is designed to make copies of itself; but unlike a virus, a worm is a standalone application.

Worms spread through network connections, accessing uninfected machines and then hijacking their resources to transmit yet more copies across the network.

There are four stages in a worm attack:

The first stage is when the worm probes other machines looking for a vulnerability that can be exploited to copy itself to.
The next stage is to penetrate the vulnerable machine by performing the operations for exploiting the vulnerability. For example, the worm might detect an open network connection, through which it can get the remote machine to execute arbitrary instructions.
In the third stage, the worm will download itself to the remote machine, and store itself there. This is often called the ‘persist’ stage.
In the next stage, the worm will propagate itself by picking new machines to attempt to probe.
Worms were invented as a curiosity and have even been suggested as ways of testing networks or distributing software patches across a network; however their drawbacks far outweigh their benefits. Even the most ‘benign’ worm consumes resources and can affect the performance of a computer system.

Trojans
The final major type of malware is the Trojan (or Trojan horse); named after the wooden horse that supposedly smuggled Greek soldiers into the ancient city of Troy.
A Trojan disguises itself as an entirely legitimate program (such as a screensaver), but behind the scenes it is causing damage – perhaps allowing someone else to gain control of the computer, copying personal information, deleting information, monitoring keystrokes, or using email software to pass itself on to other computers. Unlike viruses and worms, Trojans are not self-replicating, they rely on their apparent usefulness to spread between computers.

Some Trojans work in isolation. Some, however, rely on networks, either to transmit stolen information – such as passwords, bank account details or credit card numbers – or to act as back doors to compromised computers. They allow attackers to bypass the operating system’s security features and gain access to data or even control the machine over a network.

For More:
https://www.futurelearn.com/courses/introduction-to-cyber-security/8/steps/83062