BCIS 4630 FINAL STUDY GUIDE
Virus - Answer -- When host file is opened or executed, the virus also executes and is
able to infect other files/wreak havoc.
- Self replicating. Usually requires human interaction to propagate.
Worm - Answer -- Self replicating, spreads via networks.
- Does not rely on other files.
- Usually doesn't require human interaction.
How a Worm works - Answer -1) Warhead breaks in a system
2) Propagation engine allows the rest of the worm code to crawl into the infected
system.
3) Worm installs itself on system, loads itself, and changes system configuration.
4) Target selection algorithm looks for new victims on network.
5) Using algorithm the scanning engine scans the network for new victims.
- The worm carries its Payload.
Virus Difference - Answer -- An infected file cannot be spread to other systems unless it
is replicated and sent to another system.
- And infect file (.exe) is no longer what it was . It contains malicious code.
- Not prone to spreading to a large number of systems. Depends on user intervention.
Worm Difference - Answer -- After installation can replicate itself and spread via
network connections/email.
- Does not modify and files stored on the system.
- Can spread very quickly over networks.
Macro Virus - Answer -- Appearance of software with macro functionality a document
file can store not just data but exe code.
- To ensure code is run, modifies subroutine in file so it will run when open (Ex.
DocumentOpen, FileSave)
- Copies itself to default template files (Word, Excel, PPT)
Polymorphic Virus - Answer -- Modify their code for each replication.
- RNG and mutation machine
- Writing numerous variations of methods in virus code and changing the order of parts
of code.
So this makes the virus have a different signature than anti-virus knows.
- Each variation, encryption is done differently.
Trojan Horses - Answer -- Program that contains malicious code but appears to be
harmless or helpful.
- Appears to be helpful to user.
- Blends in with normal programs (games, utilities, apps).
, - Cannot reproduce, but can be spread as payload of Worms.
Typical functions for Trojan - Answer -Send/Receive files
View cached passwords
Restart system
Launch processes
Modify files
Sharing files
Modifying registry keys
Keylogging
Trojan Architecture - Answer -- Client/Server, Server part installed on victim, Client part
installed on attacker.
- Run in stealth mode. Attacker needs the remote IP to connect to machine and invoke
Trojan (Trojan can send IP itself).
- Auto start by editing registry files.
Making a Trojan - Answer -- Trojans file is bound to another file. (.exe to another .exe)
- Famous Trojans, SubSeven/NetBus/BackOrifice, all have an edit program that
configures a server program before it is deployed to a victim.
Trojan Camouflage - Answer -- Attackers create another file and process with exactly
the same name as an existing program on the system.
- Common Names
*nix: init, inetd, cron
Windows: win, iexplore, notepad
- Windows does not allow deletion of processes with certain names(Csrss.exe,
services.exe, smss.exe)
Sources of Trojan - Answer -Social engineering
P2P engineering
Physical access
Fake programs/freeware
E-mail attachments
Scripts in HTML emails
IM
Files on FTP servers
Spoofed websites
Files on forums/boards
Scripts on hacked legit sites
Detection/Prevention of Trojans - Answer -- Since Trojans modify a legit program,
Integrity of the file is compromised. Can detect with Integrity check.
- Perform checks(Date and Time, Size, Checksum)
- Object reconciliation:
Widely used method to detect Trojans
Virus - Answer -- When host file is opened or executed, the virus also executes and is
able to infect other files/wreak havoc.
- Self replicating. Usually requires human interaction to propagate.
Worm - Answer -- Self replicating, spreads via networks.
- Does not rely on other files.
- Usually doesn't require human interaction.
How a Worm works - Answer -1) Warhead breaks in a system
2) Propagation engine allows the rest of the worm code to crawl into the infected
system.
3) Worm installs itself on system, loads itself, and changes system configuration.
4) Target selection algorithm looks for new victims on network.
5) Using algorithm the scanning engine scans the network for new victims.
- The worm carries its Payload.
Virus Difference - Answer -- An infected file cannot be spread to other systems unless it
is replicated and sent to another system.
- And infect file (.exe) is no longer what it was . It contains malicious code.
- Not prone to spreading to a large number of systems. Depends on user intervention.
Worm Difference - Answer -- After installation can replicate itself and spread via
network connections/email.
- Does not modify and files stored on the system.
- Can spread very quickly over networks.
Macro Virus - Answer -- Appearance of software with macro functionality a document
file can store not just data but exe code.
- To ensure code is run, modifies subroutine in file so it will run when open (Ex.
DocumentOpen, FileSave)
- Copies itself to default template files (Word, Excel, PPT)
Polymorphic Virus - Answer -- Modify their code for each replication.
- RNG and mutation machine
- Writing numerous variations of methods in virus code and changing the order of parts
of code.
So this makes the virus have a different signature than anti-virus knows.
- Each variation, encryption is done differently.
Trojan Horses - Answer -- Program that contains malicious code but appears to be
harmless or helpful.
- Appears to be helpful to user.
- Blends in with normal programs (games, utilities, apps).
, - Cannot reproduce, but can be spread as payload of Worms.
Typical functions for Trojan - Answer -Send/Receive files
View cached passwords
Restart system
Launch processes
Modify files
Sharing files
Modifying registry keys
Keylogging
Trojan Architecture - Answer -- Client/Server, Server part installed on victim, Client part
installed on attacker.
- Run in stealth mode. Attacker needs the remote IP to connect to machine and invoke
Trojan (Trojan can send IP itself).
- Auto start by editing registry files.
Making a Trojan - Answer -- Trojans file is bound to another file. (.exe to another .exe)
- Famous Trojans, SubSeven/NetBus/BackOrifice, all have an edit program that
configures a server program before it is deployed to a victim.
Trojan Camouflage - Answer -- Attackers create another file and process with exactly
the same name as an existing program on the system.
- Common Names
*nix: init, inetd, cron
Windows: win, iexplore, notepad
- Windows does not allow deletion of processes with certain names(Csrss.exe,
services.exe, smss.exe)
Sources of Trojan - Answer -Social engineering
P2P engineering
Physical access
Fake programs/freeware
E-mail attachments
Scripts in HTML emails
IM
Files on FTP servers
Spoofed websites
Files on forums/boards
Scripts on hacked legit sites
Detection/Prevention of Trojans - Answer -- Since Trojans modify a legit program,
Integrity of the file is compromised. Can detect with Integrity check.
- Perform checks(Date and Time, Size, Checksum)
- Object reconciliation:
Widely used method to detect Trojans
