2.4 Malicious Code Attacks and Defenses

Question 1

What is the definition of malicious code?

Answer 1

Malicious code is any code in any part of a software system or script that is intended to cause harm, such as gaining unauthorized access, disrupting operations, or stealing data.

Examples include viruses, worms, and ransomware.

Question 2

How do attacks that rely on user error differ from those using malicious code?

Answer 2

Attacks relying on user error, such as social engineering and misconfigurations, are considered less technically demanding compared to those using malicious code which require more technical expertise.

Malicious code attacks often involve crafting and deploying specialized code.

Question 3

List three common forms that malicious code can take.

Answer 3

• Executables
• Scripts
• Macro viruses

These forms allow attackers to exploit specific vulnerabilities in systems.

Question 4

What is the primary role of a firewall in defending against malicious code?

Answer 4

The primary role of a firewall is to block traffic known to be malicious from passing through the network.

It acts as a barrier to prevent unwanted data from entering or leaving.

Question 5

What vulnerability did the WannaCry ransomware attack exploit?

Answer 5

WannaCry exploited a vulnerability in Server Message Block version 1 (SMBv1) on Windows systems.

This flaw allowed for arbitrary code execution.

Question 6

How did attackers gain access to credit card information during the British Airways incident?

Answer 6

Attackers injected 22 lines of malicious JavaScript code onto the checkout pages of British Airways’ website, which collected payment details from customers.

This attack is an example of Cross-Site Scripting (XSS).

Question 7

What type of malicious code was used in the Estonian Central Health Database breach?

Answer 7

SQL injection was the type of malicious code used to breach the Estonian Central Health Database.

The consequence was a compromise of all health information for Estonian citizens.

Question 8

What crucial defense mechanism is highlighted as essential for preventing malicious code attacks?

Answer 8

User training is highlighted as a crucial defense mechanism for preventing malicious code attacks.

Training users in secure computing habits helps prevent initial compromises.

Question 9

How do continuous updates and patches contribute to defense against malicious code?

Answer 9

Continuous updates and patches help by consistently closing vulnerabilities as soon as security issues are discovered.

This proactive approach prevents attackers from exploiting known weaknesses.

Question 10

What does ‘arbitrary code execution’ mean in the context of the WannaCry attack?

Answer 10

‘Arbitrary code execution’ means the attacker could run any software they desired on a user’s machine, allowing them to gain access to the operating system.

This facilitated the installation of further malware, such as ransomware.

Question 11

True or False: Social engineering is a type of attack that relies on technical vulnerabilities.

Answer 11

False

Social engineering relies on psychological manipulation rather than technical flaws.

Question 12

Fill in the blank: A _______ is a type of malicious software that blocks access to a computer system until a ransom is paid.

Answer 12

Ransomware

Ransomware typically encrypts data to prevent access.

Question 13

Define Cross-Site Scripting (XSS).

Answer 13

Cross-Site Scripting (XSS) is a type of malicious code injection attack where an attacker injects malicious scripts into a legitimate website.

These scripts are then executed by other users’ browsers.

Question 14

What are patches in the context of software security?

Answer 14

Patches are software updates designed to fix bugs, improve performance, or address security vulnerabilities in a program or operating system.

Regular patching is crucial for maintaining system security.

Question 15

What is a Trojan Horse in cybersecurity?

Answer 15

A Trojan Horse is a type of malware that disguises itself as legitimate software but contains malicious functions when executed.

It often tricks users into installing it.

Question 16

What is the role of anti-malware software?

Answer 16

Anti-malware software is designed to prevent, detect, and remove malicious software.

It primarily blocks executables, scripts, and macro viruses.

Question 17

What is SQL Injection?

Answer 17

SQL Injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database.

This can potentially allow attackers to view, modify, or delete data.