Given a scenario, analyze indicators of compromise and determine the type of malware.
- Viruses: An unsolicited and unwanted malicious program.
- Crypto-malware: A malicious program that encrypts programs and files on the computer in order to extort money from the user.
- Ransomware: Denies access to a computer system or data until a ransom is paid. Can be spread through a phishing email or unknowingly infected website.
- Worm: A self-contained infection that can spread itself through networks, emails, and messages.
- Trojan: A form of malware that pretends to be a harmless application.
- Rootkit: A backdoor program that allows full remote access to a system.
- Keylogger: A malicious program that saves all of the keystrokes of the infected machine.
- Adware: A program that produces ads and pop ups using your browser, may replace the original browser and produce fake ads to remove the adware in order to download more malware.
- Spyware: Software that installs itself to spy on the infected machine, sends the stolen information over the internet back to the host machine.
- Bots: AI that when inside an infected machine performs specific actions as a part of a larger entity known as a botnet.
- RAT (Remote Access Trojan): A remotely operated Trojan.
- Logic bomb: A malicious program that lies dormant until a specific date or event occurs.
- Backdoor: Allows for full access to a system remotely.
Compare and contrast types of attacks
- Social engineering: Gathering information on an attack by exploiting the weakest part of security, people.
- Phishing: Sending a false email pretending to be legitimate to steal valuable information from the user.
- Spear phishing: Attacks that target specific users.
- Whaling: An attack on a powerful or wealthy individual.
- Vishing: An attack through a phone or voice communications.
- Tailgating: Closely following individuals with keys to get access to secure areas.
- Impersonation: Taking on the identity of an individual to get access into the system or communications protocol.
- Dumpster diving: Going through a business’s or person’s trash to find thrown away valuable information or possessions.
- Shoulder surfing: Watching as a person enters information.
- Hoax: False information that deceives the user into compromising security by making them believe they are at risk.
- Watering hole attack: A security attack that targets a specific highly secured group by infecting a commonly visited website by the group’s members.
- Principles (reasons for effectiveness):
- Authority: The actor acts as an individual of authority.
- Intimidation: Frightening or threatening the victim.
- Consensus: Influenced by what others do, everyone else does it.
- Scarcity: Limited resources and time to act.
- Familiarity: The victim is well known.
- Trust: Gain their confidence, be their friend.
- Urgency: Limited time to act, rush the victim.
