Chapter 4: Malware and Automated Computer Attacks

Coordinate national responses to vulnerabilities and wide scale attacks; Provide direct information on new threats to business, government, and industry; These entities operate within industry, universities, and governments

CERTs (CSIRTs)

*Viruses were initially ____ and more proof of concept, but evolved over time, incorporating new ways to exploit ___ *Viruses incorporated new exploitation techniques in tandem with the evolution of technology *___-viruses *____ viruses are becoming increasingly problematic *______ engines change the code of a virus each time it propagates *Make it difficult to ___ the virus *Concept was one of the first *Spreading through infected ___ shared through the Internet *The Melissa virus

benign; vulnerabilities; macro; polymorphic; polymorphic; identify; files

Viruses: Spread through various methods *___ a PC through an infected medium *__ an infected program *___ an infected file

booting; executing; opening

a blended threat combining multiple elements of existing malware together

botnet malware

*29 states in the US have made it illegal to create or distribute "computer ____" *___ specific than malware, recognizing the capacity of computer code to damage, destroy, or transmit information without the permission of the system owner *26 states also criminalize ___ or ___ attacks *Six states recognize ___ as well

contaminants; less; DoS; DDoS; ransomware

The impact of malware *There are new malware variants identified every __ *___ million variations in 2015, with an average of 230,000 per day *It is truly a ___ problem with infections identified in most industrialized nations *___ phone malware is also increasing as a target by attackers *The use of anti-virus protection does not ___ the risk of harm

day; 84; global; mobile; eliminate

Ransomware/scareware *A novel form of malware infects a system through ___ files or websites *____ is a key example *Once activated, the payload of the malware may ___ the user files or ___ the boot record in order to restrict user access *Victims must then ___ the attacker or risk losing access to their data

downloadable; cryptolocker; encrypt; modify; pay

Sometimes called "drive-by downloads" as the user does not actually interact with the malware to activate its payload

exploit packs

a unique form of malware that are installed on web servers

exploit packs

The US Computer Fraud and Abuse (CFA) Act makes it illegal to *Knowingly cause the transmission of a program, information, code, or command and thereby ___ cause damage to a protected computer *Intentionally access a protected computer ___ authorization and thereby recklessly cause damage *Intentionally access a ____ computer without authorization and thereby cause damage or loss

intentionally; without; protected

*Malware is designed and commonly used to *Log ___ by the user *Delete or corrupt ___ *Access ____ files *Delete system ___ *Create ___ in the infected system *Malware is extremely ___ for victims to remove and repair

keystrokes; files; private; calls; backdoors; costly

*_____ is a term used to encapsulate the range of programs used to automate attacks against computer systems *_____ _____ are computer programs that can be used for different purposes *Malware utilizes exploits that leverage _____ the process of intrusion into systems *The execution of the exploit activates a _____ *The system _____ and _____ implemented through the malicious software program

malware; malicious software; vulnerabilities; payload; changes; controls

Cybercrime markets: customer service *There are a number of __ used by sellers in order to draw in customers *Customers expect sellers to answer questions ___ *Some sellers give free ___ to entice buyers *Many also offer dedicated customer service lines to ___ and ___ to customer questions *Sellers who respond quickly receive ___ feedback and get a bigger portion of the market

measures; quickly; gifts; support; respond; feedback

Botnet malware *They infect ___ machines via common vulnerabilities *Similar to worms or viruses in that they ___ other machines, but they deliver a ___ like a trojan *Multiple machines infected by the same bot are called a ___ *___ of infected systems *Controlled via IRC or HTML *Now affecting ___ devices via Mirai malware *Botnet operators can use their infected systems to engage in various types of attacks ___ Distribution of ___

multiple; infect; payload; botnet; network; IoT; DDoS; spam

*Many nations have ___ criminalized malware creation *Laws are designed to deal with the connection between malware and hacking outcomes, like __ __ or ___

not; data loss; manipulation

Cybercrime markets *There are a ___ of websites, forums, and IRC channel devoted to malicious computer activity (Malware, carding, and stolen data) *These sites can provide hackers with __ access to malware, or services that ___ individuals to engage in cyberattacks *Facilitates attacks by __ and ___ attackers alike *Malware as "___"

range; direct; enable; skilled; unskilled; crimeware

*The CFA also makes it illegal to knowingly ___, ___, or ___ passwords or other information used to access a computer with the intent to defraud the victims *The computers harmed must be either: *Involved in ___ or ___ commerce or *Operated by or for the ___ government *The CFA also makes it illegal to ___ funds from individuals on the basis of *Threats to ___ damage to a protected computer *Threats to obtain information or affect the confidentiality of information without ___ or access *Damage to a computer when caused to enable ___

sell; buy; trade; interstate; foreign; federal; extort; cause; authorization; extortion

Exploit Packs *Individuals who visit a website hosted on the infected server will have their browser ___ attacked *The pack exploits common ___ in web browsers and runs exploits against the browser until it is infected

silently; vulnerabilities

*____ are programs which appear innocuous but contain hidden functions *They do not have automated ___ *Must be ___ out to others *Can conceal larger ____ *They are disguised as something that would be ___ to others *Once downloaded or opened, they execute their payload ___

trojans; replication; sent; payloads; enticing; silently

User Responsibilities in Combating Malware *Users must regularly ___ the definitions in their antivirus software in order to identify all new variants of code *The ___ is placed on users to secure their systems *Vendors do not do much by way of ___ control and control what is known about their ___

update; onus; quality; functionality

A virus is concealed on e-mail attachments, pirated software, and shareware files *It is ___ activated *Delivers a harmful ___ *Can ___ itself

user; payload; conceal

*Antivirus ___ have one of the most prominent and global roles in malware mitigation *Major ___ provide their products to the general public and collect information on new threats *AV tools work through ___-based identification *Each piece of malware is given a ___ or ____ to identify it within a user system

vendors; vendors; signature; signature; definition

A set of non-autonomous routines capable of modifying programs or systems so they contain executable copies of themselves It must be attached to a host to be spread

viruses

the most recognized form of malware

viruses

There are a range of malware programs, though the most common are 1.___ 2.___ 3.___ *Blended threats *These combine the elements of these core programs

viruses; trojans; worms

*____ are replicating malware that do not need to attach themselves to a host to be transmitted and replicated *Propagate ____ *Take up ___ space and ___ resources *Can effectively cause a ___ attack *They do not deliver a ___

worms; independently; memory; network; DoS; payload

Hackers and malware writers *Malware ___ and ___ have similar methods and motives *They do not consider their actions to be ___ *Tools would not work if there were fewer __ out there *May seek ___ *Desire to ___ or ___ *Simply make ___

writers; hackers; wrong; exploits; attention; damage; disrupt; money