Sscp Infosec - Malicious Code And Attacks

Front 1

A virus can be triggered by inserting a USB drive into a system. True or False

Back 1

True

Front 2

Viruses typically have 2 primary components. What re they?

Back 2

1.) Replication component
2.) Activation component

Front 3

Nowadays, virus will rarely destroy data on the system where it's installed. Why?

Back 3

It will try to stay hidden on the same system as long as possible.
1.) A zombie is only useful as long as it is operational on the PC.
2.) If the virus destroys data on the system, the system loses it usefulness to the criminal.

Front 4

What is the difference between Polymorphic and Metamorphic?

Back 4

Polymorphic - Even though the file changes, the code used to replicate and deliver the payload remains the same.

Metamorphic - This virus actually mutates the code used to replicate and deliver a payload.

Front 5

What 3 things can you do to prevent WORMS to travel over a network?

Back 5

1.) Up-To-Date AV software on all hosts.
2.) Host-Based firewalls on all systems
3.) Reduce attack surface by removing unneeded protocols.

Front 6

Microsoft 64-bit systems have added additional protections against rootkits. What is it called?

Back 6

Kernal Patchguard protection

Front 7

What is Mobile code?

Back 7

It is any code that can be transferred between systems without the user taking explicit action to install it.

Front 8

Name 3 examples of mobile code.

Back 8

1.) Scripts such as JavaScript
2.) Java applets or ActiveX controls
3.) Documents that include macros

Front 9

What is the difference between backdoors and trapdoors?

Back 9

Nothing. They are the same.

Front 10

Application developers often add backdoor code to an application for debugging purposes.
TRUE or FALSE?

Back 10

TRUE

Front 11

What is a Malware Hoaxes?

Back 11

A malware hoax is a false message about a malware risk that does not exist. Hoaxes are commonly spread via the e-mail. They commonly include a sense of urgency using caps like URGENT!!! VIRUS ALERT!!!

Finally, hoaxes just waste people time as they really do nothing but spread fear and waste people time.

Front 12

Name 3 methods of increasing software security on organization SW applications.

Back 12

1.) Input validation
2.) Code signing
3.) Application Reviews

Front 13

Input validation does not verify the accuracy of the data. TRUE of FALSE?

Back 13

TRUE.
It only checks if the input is valid.
Input validation is shown on webpages as (*) next to items that need to be addresses.

Front 14

Input validation can prevent 3 major type of attacks. What are they?

Back 14

1.) Buffer overflow
2.) SQL injection
3.) Cross-site Scripting

Front 15

What is CSS?

Back 15

Cross-Site Scripting
Sometimes called XSS
Attempts to inject HTML or JavaScript code into a web page.

Front 16

SQL injection attacks are prevented with by what?

Back 16

1.) Input validation
2.) Stored Porcedures
A stored procedure is a group of SQL statements that executes as a small program.

Front 17

SPF records are a newer technology used to reduce spam by what?

Back 17

SPF = Sender Policy Framework
By identifying spoofed e-mail.

Front 18

What is a good way to keep up with current malware threats?

Back 18

Sign up for e-mail alerts to US-CERT.
US computer Emergency Readiness Team.