Fluent Essays

Question-1 : 10.1 What are three broad mechanisms that malware can use to propagate?10.2 What are four broad categories of payloads that malware may carry?10.3 What are typical phases of operation of a virus or worm?10.4 What mechanisms can a virus use to conceal itself?10.5 What is the difference between machine-executable and macro viruses?10.6 What means can a worm use to access remote systems to propagate?10.7 What is a “drive-by-download” and how does it differ from a worm?10.8 What is a “logic bomb”?10.9 Differentiate among the following: a backdoor, a bot, a keylogger, spyware, and a rootkit? Can they all be present in the same malware?10.10 List some of the different levels in a system that a rootkit may use.10.11 Describe some malware countermeasure elements.10.12 List three places malware mitigation mechanisms may be located.10.13 Briefly describe the four generations of antivirus software.10.14 How does behavior-blocking software work?10.15 What is a distributed denial-of-service system?Complete your answers on a WORD DocumentQuestion 2 : In no less than 250 words, describe a hacking tool that is used to gain access to a network. Explain how the tool is used, how it works and how a network administrator can prevent this tool from access the network. networksecurity_week10.pptx Unformatted Attachment Preview Network Security Essentials: Applications and Standards Sixth Edition Chapter 10 Malicious Software Copyright © 2017 Pearson Education, Inc. All Rights Reserved Table 10.1 Terminology for Malicious Software (1 of 3) Name Description Virus Malware that, when executed, tries to replicate itself into other executable code; when it succeeds the code is said to be infected. When the infected cod is executed, the virus also executes. Worm A computer program the can run independently and can propagate a complete working version of itself onto other hosts on a network. Logic bomb A program inserted into software by an intruder. A logic bomb lies dormant until a predefined condition is met ; the program then triggers an unauthorized act. Trojan horse A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entitity that invokes the Trojan horse program. Backdoor (trapdoor) Any mechanisms that bypasses a normal security check; it may allow unauthorized access to functionality. Mobile code Software(e.g., script, macro, or other portable instruction) that can be shipped unchanged to a heterogeneous collection of platforms and execute with identical semantics. Exploits Code specific to a single vulnerability or set of vulnerabilities. Copyright © 2017 Pearson Education, Inc. All Rights Reserved Table 10.1 Terminology for Malicious Software (2 of 3) Name Description Downloaders Program that installs other items on a machine that is under attack. Usually, a downloader is sent in an e-mail. Auto-rooter Malicious hacker tools used to break into new machines remotely. Kit (virus generator) Set of tools for generating new viruses automatically. Spammer programs Used to send large volumes of unwanted e-mail. Flooders Used to attack networked computer systems with a large volume of traffic to carry out a denial-of-service (DoS) attack. Keyloggers Captures keystrokes on a compromised system. Rootkit Set of hacker tools used after attacker has broken into a computer system and gained root level access. Zombie, bot Program activated on an infected machine that is activated to launch attacks on other machines. Copyright © 2017 Pearson Education, Inc. All Rights Reserved Table 10.1 Terminology for Malicious Software (3 of 3) Name Description Spyware Software that collects information from a computer and transmits it to another system. Adware Advertising that is integrated into software. It can result in popup ads or redirection of a browser to a commercial site. Copyright © 2017 Pearson Education, Inc. All Rights Reserved A Broad Classification of Malware (1 to 4) • Can be classified into two broad categories: 1. Based first on how it spreads or propagates to reach the desired targets 2. Then on the actions or payloads it performs once a target is reached • Propagation mechanisms: – Include infection of existing executable or interpreted content by viruses that is subsequently spread to other system Copyright © 2017 Pearson Education, Inc. All Rights Reserved A Broad Classification of Malware (2 to 4) – Exploit of software vulnerabilities either locally or over a network by worms or drive-by-downloads to allow the malware to replicate – Social engineering attacks that convince users to bypass security mechanisms to install trojans or to respond to phishing attacks • Earlier approaches to malware classification distinguished between: – Those that need a host program, being parasitic code such as viruses Copyright © 2017 Pearson Education, Inc. All Rights Reserved A Broad Classification of Malware (3 to 4) – Those that are independent, self-contained programs run on the system such as worms, trojans, and bots • Another distinction used was: – Malware that does not replicate, such as trojans and spam e-mail – Malware that does, including viruses and worms • Payload actions performed by malware once it reaches a target system can include: – Corruption of system or data files Copyright © 2017 Pearson Education, Inc. All Rights Reserved A Broad Classification of Malware (4 to 4) – Theft of service in order to make the system a zombie agent of attack as part of a botnet – Theft of information from the system, especially of logins, passwords, or other personal details by keylogging or spyware programs – Stealthing where the malware hides its presence on the system from attempts to detect and block it • Blended attack – Uses multiple methods of infection or propagation to maximize the speed of contagion and the severity of the attack Copyright © 2017 Pearson Education, Inc. All Rights Reserved Attack Kits • Initially the development and deployment of malware required considerable technical skill by software authors • This changed with the development of virus-creation toolkits in the early 1990s and more general attack kits in the 2000s – These toolkits are often known as crimeware – Include a variety of propagation mechanisms and payload modules that even novices can combine, select, and deploy – Can easily be customized with the latest discovered vulnerabilities in order to exploit the window of opportunity between the publication of a weakness and the deployment of patches to close it – These kits greatly enlarged the population of attackers able to deploy malware Copyright © 2017 Pearson Education, Inc. All Rights Reserved Attack Sources • Another significant malware development over the last couple of decades is the change from attackers being individuals to more organized and dangerous attack sources – These include politically motivated attackers, criminals, organized crime, organizations that sell their services to companies and nations, and national government agencies • This has significantly changed the resources available and motivation behind the rise of malware leading to development of a large underground economy involving the sale of attack kits, access to compromised hosts, and to stolen information Copyright © 2017 Pearson Education, Inc. All Rights Reserved Advanced Persistent Threat (APT) (1 of 2) • Have risen to prominence in recent years • A well-resourced, persistent application of a wide variety of intrusion technologies and malware to selected targets, usually business or political • APTs differ from other types of attack by their careful target selection, and persistent, often stealthy, intrusion efforts over extended periods – Aurora, RSA, APT1, and Stuxnet are often cited as examples • Named as a result of these characteristics: Copyright © 2017 Pearson Education, Inc. All Rights Reserved Advanced Persistent Threat (APT) (2 of 2) – Advanced ▪ The individual components may not necessarily be technically advanced, but are carefully selected to suit the chosen – Persistent ▪ Determined application of the attacks over an extended period against the chosen target in order to maximize the chance of success – Threats ▪ Threats to the selected targets as a result of the organized, capable, and well-funded attackers intent to compromise the specifically chosen targets Copyright © 2017 Pearson Education, Inc. All Rights Reserved Viruses • Parasitic software fragments that attach themselves to some existing executable content • Can “infect” other programs or any type of executable content and modify them • The modification includes injecting the original code with a routine to make copies of the virus code, which can then go on to infect other content • One reason viruses dominated the malware scene in earlier years was the lack of user authentication and access controls on personal computer systems Copyright © 2017 Pearson Education, Inc. All Rights Reserved Virus Structure (1 of 2) • A computer virus and many contemporary types of malware includes one or more variants of each of these components: Infection mechanism • The means by which a virus spreads or propagates, enabling it to replicate • Also referred to as the infection vector Trigger • The event or condition that determines when the payload is activated or delivered Copyright © 2017 Pearson Education, Inc. All Rights Reserved Virus Structure (2 of 2) • Sometimes known as a logic bomb Payload • What the virus does, besides spreading • May involve damage or benign but noticeable activity Copyright © 2017 Pearson Education, Inc. All Rights Reserved Virus Phases (1 of 2) • During its lifetime, a typical virus goes through the following four phases: 1. Dormant phase – The virus is idle – Will eventually be activated by some event – Not all viruses have this stage 2. Propagation phase – The virus places a copy of itself onto other programs or into certain system areas on the disk Copyright © 2017 Pearson Education, Inc. All Rights Reserved Virus Phases (2 of 2) 3. Triggering phase – The virus is activated to perform the function for which it was intended – Can be caused by a variety of system events 4. Execution phase – The function is performed Copyright © 2017 Pearson Education, Inc. All Rights Reserved Figure 10.1 Example Virus Logic Copyright © 2017 Pearson Education, Inc. All Rights Reserved Figure 10.2 A Compression Virus Copyright © 2017 Pearson Education, Inc. All Rights Reserved Virus Classification By Target (1 of 2) • Includes the following categories: Boot sector infector • Infects a master boot record or boot record and spreads when a system is booted from the disk containing the virus File infector • Infects files that the operating system or shell consider to be executable Copyright © 2017 Pearson Education, Inc. All Rights Reserved Virus Classification By Target (2 of 2) Macro virus • Infects files with macro or scripting code that is interpreted by an application Multipartite virus • Infects files in multiple ways Copyright © 2017 Pearson Education, Inc. All Rights Reserved Virus Classification by Concealment Strategy (1 of 2) • Includes the following categories: – Encrypted virus ▪ Portion of the virus creates a random encryption key and encrypts the remainder of the virus ▪ When an infected program is invoked, the virus uses the stored random key to decrypt the virus ▪ When the virus replicates, a different random key is selected ▪ Because the bulk of the virus is encrypted with a different key for each instance, there is no constant bit pattern to observe Copyright © 2017 Pearson Education, Inc. All Rights Reserved Virus Classification by Concealment Strategy (2 of 2) – Stealth virus ▪ A form of virus explicitly designed to hide itself from detection by antivirus software ▪ The entire virus, not just a payload is hidden – Polymorphic virus ▪ A virus that mutates with every infection, making detection by the “signature” of the virus impossible – Metamorphic virus ▪ Mutates with every infection ▪ Rewrites itself completely at each iteration, increasing the difficulty of detection ▪ May change their behavior as well as their appearance Copyright © 2017 Pearson Education, Inc. All Rights Reserved Macro and Scripting Viruses • Macro viruses infect scripting code used to support active content in a variety of user document types • Threatening for a number of reasons: – A macro virus is platform independent – Macro viruses infect documents, not executable portions of code – Macro viruses are easily spread, as the documents they exploit are shared in normal use – Because macro viruses infect user documents rather than system programs, traditional file system access controls are of limited use in preventing their spread Copyright © 2017 Pearson Education, Inc. All Rights Reserved Worms • A program that actively seeks out more machines to infect − Upon activation, the worm may replicate and propagate again • To replicate itself, a worm uses some means to access remote systems: − Electronic mail or instant messenger facility − File sharing − Remote execution capability − Remote file access or transfer capability − Remote login capability Copyright © 2017 Pearson Education, Inc. All Rights Reserved Worm Phases • A worm typically uses the same phases as a computer virus: – Dormant – Propagation – Triggering – Execution • The propagation phase generally performs the following functions: – Search for appropriate access mechanisms to other systems to infect by examining host tables, address books, buddy lists, trusted peers, and other similar repositories of remote system access details – Use the access mechanisms found to transfer a copy of itself to the remote system and cause the copy to be run Copyright © 2017 Pearson Education, Inc. All Rights Reserved Target Discovery (1 of 2) • Scanning/fingerprinting – The function in the propagation phase for a network worm to search for other systems to infect • Worm network scanning strategies: – Random ▪ Each compromised host probes random addresses in the IP address space, using a different seed ▪ Produces a high volume of Internet traffic, which may cause generalized disruption even before the actual attack is lunched – Hit list ▪ The attacker first compiles a long list of potential vulnerable machines ▪ Once the list is compiled, the attacker begins infecting machines on the list Copyright © 2017 Pearson Education, Inc. All Rights Reserved Target Discovery (2 of 2) ▪ Each infected machine is provided with a portion of the list to scan ▪ This results in a very short scanning period, which may make it difficult to detect that infection is taking place – Topological ▪ Uses information contained on an infected victim machine to find more hosts to scan – Local subnet ▪ If a host is infected behind a firewall, that host then looks for targets in its own local network ▪ The host uses the subnet address structure to find other hosts that would otherwise be protected by the firewall Copyright © 2017 Pearson Education, Inc. All Rights Reserved Figure 10.3 Worm Propagation Model Copyright © 2017 Pearson Education, Inc. All Rights Reserved The Morris Worm • Released onto the Internet by Robert Morris in 1988 • Designed to spread on UNIX systems and used a number of different techniques for propagation • When a copy began execution its first task was to discover other hosts known to this host that would allow entry from this host • For each discovered host, the worm tried a number of methods for gaining access: – It attempted to log on to a remote host as a legitimate user – It exploited a bug in the UNIX finger protocol, which reports the whereabouts of a remote user – It exploited a trapdoor in the debug option of the remote process that receives and sends mail Copyright © 2017 Pearson Education, Inc. All Rights Reserved Worm Technology (1 of 3) Multiplatform • Newer worms can attack a variety of platforms Multi-exploit • New worms penetrate systems in a variety of ways, using exploits against Web servers, browsers, e-mail, file sharing, and other network-based applications, or via shared media Ultrafast spreading • Exploit various techniques to optimize the rate of spread of a worm to maximize its likelihood of locating as many vulnerable machines as possible in a short time period Copyright © 2017 Pearson Education, Inc. All Rights Reserved Worm Technology (2 of 3) Polymorphic • To evade detection, skip past filters, and foil real-time analysis, each copy of the worm has new code generated on the fly using functionally equivalent instructions and encryption techniques Metamorphic • In addition to changing their appearance, metamorphic worms have a repertoire of behavior patterns that are unleashed at different stages of propagation Transport vehicles • Because worms can rapidly compromise a large number of systems, they are ideal for spreading a wide variety of malicious payloads Copyright © 2017 Pearson Education, Inc. All Rights Reserved Worm Technology (3 of 3) Zero-day exploit • To achieve maximum surprise and distribution, a worm should exploit an unknown vulnerability that is only discovered by the general network community when the worm is launched Copyright © 2017 Pearson Education, Inc. All Rights Reserved Mobile Code (1 of 2) • Refers to programs that can be shipped unchanged to a heterogeneous collection of platforms and execute with identical semantics • Transmitted from a remote system to a local system and then executed on the local system without the user’s explicit instruction • Often acts as a mechanism for a virus, worm, or Trojan horse to be transmitted to the user’s workstation • Popular vehicles for mobile code include: – Java applets – ActiveX Copyright © 2017 Pearson Education, Inc. All Rights Reserved Mobile Code (2 of 2) – JavaScript – VBScript • The most common ways of using mobile code for malicious operations on local system are: – Cross-site scripting – Interactive and dynamic Web sites – E-mail attachments – Downloads from untrusted sites or of untrusted software Copyright © 2017 Pearson Education, Inc. All Rights Reserved Client-Side Vulnerabilities and Drive-byDownloads (1 of 2) • Drive-by-download – Exploits browser vulnerabilities so that when the user views a Web page controlled by the attacker, it contains code that exploits the browser bug to download and install malware on the system without the user’s knowledge or consent – Does not actively propagate as a worm does, but rather waits for unsuspecting users to visit the malicious Web page in order to spread to their systems • Watering-hole attacks are a variant of this used in highly targeted attacks Copyright © 2017 Pearson Education, Inc. All Rights Reserved Client-Side Vulnerabilities and Drive-byDownloads (2 of 2) – The attacker researches their intended victims to identify Web sites they are likely to visit and then scans theses sites to identify those with vulnerabilities that allow their compromise with a drive-by-download attack • Malvertising is another technique used to place malware on Web sites without actually compromising them – The attacker pays for advertisements that are highly likely to be placed on their intended target Web sites, and which incorporate malware in them Copyright © 2017 Pearson Education, Inc. All Rights Reserved Clickjacking (1 of 2) • Also known as a user-interface (UI) redress attack – Is a vulnerability used by an attacker to collect an infected user’s clicks – The attacker can force the user to do a variety of things from adjusting the user’s computer settings to unwittingly sending the user to Web sites that might have malicious code – Also, by taking advantage of Adobe Flash or JavaScript, an attacker could even place a button under or over a legitimate button, making it difficult for users to detect Copyright © 2017 Pearson Education, Inc. All Rights Reserved Clickjacking (2 of 2) – A typical attack uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page • Using a similar technique, keystrokes can also be hijacked – With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their e-mail or bank account but are instead typing into an invisible frame controlled by the attacker Copyright © 2017 Pearson Education, Inc. All Rights Reserved Spam • Unsolicited bulk e-mail • Imposes significant costs on both the network infrastructure needed to relay this traffic and on users who need to filter their legitimate e-mails • Most recent spam is sent by botnets usi ... Purchase answer to see full attachment