what is a botnet
a network of compromised machines acting as a network
- responsible for things such as large scale network probing
- launching ddos
- spam
- click-fraud campaigns
- info theft
what is a trojan horse
a program appearing as a regular program but hides malicious activity;
what is a webroot
a dll based attack; spreads via drive by downloads; sophisticated rootkit
what was the torpig botnet
it was a combination of a mebroot and a trojan horse that was distributed bia mebroot via drive by downloads and a sophisticated rootkit.
It injected into 29 software platforms to steal sensitive information, used http injection for phishing, encrypted http as command and control protocol, and used a resilient approach “domain flux”; to contact command and control center
how do you go about in beggining to understand and contain malicious software
Principle 1: the hijacked botnet should be operated so that any harm
and/or damage to victims and targets of attacks would be minimized
Always responded with okn message
Never sent new/blank con guration le
Principle 2: the sinkholed botnet should collect enough information to
enable noti cation and remediation of a ected parties
Worked with law enforcement (FBI and DoD Cybercrime units)
Worked with bank security ocers
Worked with ISPs
what is a sinkholed botnet
a bot net that is controlled by “good guys”
where do most malicipous threats start
the web
a malicious webpage does what to gain arbitraty code execution
leverage of a defect
what is malicious software
(Malware) refers to any unwanted software and executable code that is used
to perform an unauthorized, often harmful, action on a computing device. It
is an umbrella-term for various types of harmful software, including viruses,
worms, Trojans, rootkits, and botnets.
which two malicious software are self spreading
virus/worm
which five malicious software are non-spreadomg
root-kit, trojan horse, dialer, spyware, keylogger
which 3 malicious software require a host
virus, root-kit and
which 4 malicious software do not require a host
trojan, dialer, spyware, keylogger
what is a virus
Self-replicating
Needs a host to infect
Boot (Brain virus), overwrite, parasitic, cavity, entry point obfuscation,
code integration (W95/Zmist virus)
whats a worm
Self-replicating, spreads (autonomously) over network
Exploits vulnerabilities a ecting a large number of hosts
Sends itself via email
e.g., Internet worm, Netsky, Sobig, Code Red, Blaster, Slammer
whats atrojan
Malicious program disguised as a legitimate software
Many di erent malicious actions
whats a rootkit
Used to keep access to a compromised system
Usually hides les, processes, network connections
User- and kernel-level
