Karteikarten
Malicious Code and Attacks
Karten in diesem Stapel (33)
- 1Four types of viruses described in the study guideMultipartite viruses,
Stealth viruses,
Polymorphic viruses and
Encrypted viruses - 2Multipartite virusesUse more than one propagation technique to penetrate systems that defend against only one method or the other
- 3Stealth virusesHide by messing with the OS to fool the antivirus package into thinking everything is normal
- 4Polymorphic virusesModify their own code as they travel from system to system
- 5Encrypted virusesUse cryptographic techniques to load and decrypt the main virus code stored elsewhere
- 6Difference between polymorphic and encryptedWhile both viruses leave a different signature from system to system,
encrypted viruses do not do this by changing their code.
They instead change the way they stored on the disk. - 7Logic bombsInfect a system and lie dormant until they are triggered by conditions
- 8A type of Trojan horse that claims to be an antivirus software and encourages the user to install itRogue antivirus software
- 9A type of Trojan that encrypts the files on a machine with a key known only to the creator. It also threatens to delete the files unless the victim pays up within a short period of timeRansomware
- 10What's a botnetA collection of computers across the internet under the control of an attacker
- 11WormsAre able to propagate themselves without human intervention
- 123 key areas in which to implement antivirus filtersClient systems,
server systems,
content filters (on the network) - 13Most common type of antivirus filterSignature-based: uses a definition file to identify viruses that matches the known characteristics
- 14Antivirus mechanismsSignature-based,
heuristic based: analyses the behaviour of software to look for signs of virus activity - 15Countermeasures against malicious codeAntivirus-filtering software,
access controls (maintained and enforced),
integrity checks,
sandboxing,
digital signatures to verify trusted sources,
whitelisting applications by admins - 16The difference between viruses and wormsWorms are able to propagate themselves without human assistance
- 17Types of password attacksGuessing,
dictionary attacks,
social engineering - 18Application attacksBuffer overflow vulnerabilities,
time-of-check-to-time-of-use,
back doors,
escalation of privilege and rootkits - 19What are buffer overflows and how can they be exploited?Buffer overflows can happen when an input is too large for a fixed length block of memory (or buffer) than is allocated to hold.
The extra data can overwrite values in adjacent memory addresses and potentially corrupt data or overwrite system commands. - 20How can buffer overflow exploits be avoided?The programmer should take steps to ensure that user input
cannot exceed the buffer size or variable length,
cannot input invalid value for the data type
and cannot enter a value that falls outside of specific parameters. - 21What is time-of-check-to-time-of-use (TOCTOU)?A file-based timing vulnerability where a system checks a resource before use and the state of the resource can change between the check and use, invalidating the check.
For example: if a list of a user's access permissions is checked and then "remembered" throughout a logon session. If a restriction is applied after the user logs in then the revocation won't be applied until the user's login session ends. - 22What are backdoors?Backdoors are undocumented "shortcuts" left in programs that allows bypass of normal access restrictions, typically used during dev and debugging and left in production
- 23What are escalation of privileges attacks?This occurs when an attacker gains credentials to access a system then uses a rootkit to increase their access level to root or admin level
- 24What is a rootkit?A rootkit can consist of spyware or other programs that monitors network traffic and keystrokes, creates a backdoor, alter log files and other activities to allow the hacker to mask intrusion and gain high level access to a system
- 25What are cross-site scripting (XSS) attacks?Cross-site scripting attacks are a web security exploit that is also a client-side injection attack.
It occurs when data input is not sanitized of executable code before the input is delivered back to the user's browser. The attacker can insert a string that will be used within a webpage and treated as code within a victim's browser. - 26What is SQL injection?A security exploit in which an attacker submits SQL commands to a web form input to gain access to data or make changes to a database
- 27How to protect against XSS attacks?Input validation
- 28How to protect against SQL injection?Input validation,
min. account privileges for the web server,
use stored procedures - 29What are reconnaissance attacks?Reconnaissance attacks gather information about systems to find vulnerabilities to target directly
- 30IP probesIP probes are a type of network reconnaissance where automated tools attempt to ping each address in a range to verify if the destination exists. Systems that respond to the ping are logged for further analysis.
- 31Port scansPort scans probe active systems on a network to learn which services, each associated with a well-known port number, are running on each machine.
It essentially consists of sending a message to each port and assessing the response received to judge whether it's in use. - 32A vulnerability scansProbe target systems to locate security flaws by comparing against a database of known vulnerabilities. A list of every vulnerability detected is produced.
- 33Dumpster divingIs an old reconnaissance attack where attackers go through an organization's trash to glean information or discarded items that can be used for other attacks like social engineering.
Informationen
- Beschreibung
- CISSP Study Guide Terms Karteikarten am Malicious Code and Attacks, erstellt von Dani B am 24/07/2017.
- Erstellt von
- Dani B · Jul 2017
- Aktualisiert
- 26 Jul 2017
- Aufrufe
- 3
- Bewertung