Deck 3: Malicious Code

Question 1

Which of the following is the best definition of a Trojan horse?

A) Unauthorized software that performs unwanted functions
B) Authorized software that has been embedded with malicious code that performs unwanted functions
C) Unauthorized features in an application that perform authorized but hidden functions
D) Authorized software that includes rootkit functionality to protect it from being detected as a false positive

Answer 1

Authorized software that has been embedded with malicious code that performs unwanted functions

Question 2

In terms of information security and malware classification, a RAT is a:

A) Remote Authentication Terminal
B) Someone that reports the activities of a coworker to management
C) Remote Access Tool
D) The Reveal - Access - Target, model of malicious activity

Answer 2

Remote Access Tool

Question 3

Tayzia notices that her IDS logs are showing repeated access attempts to the $ EXTERNAL_NET toward a range of ports 6662-6667. Luckily, the connections were unsuccessful, what is the bad news?

A) Tayzia will have to work overtime (unpaid, this is IT after all) trying to figure out where all the MP3s are being hid on the network.
B) Clearly someone is using BitTorrent to download the first season of "Star Trek: Deep Space Nine"
C) Something on her network is trying to access IRC, and it might be an infected host.
D) These are common administrative ports for Citrix or Oracle or something. She doesn't remember because during that discussion in her training class she was answering an email instead of listening. Either way, there is no need to investigate; it is probably just a false positive.

Answer 3

Something on her network is trying to access IRC, and it might be an infected host.

Question 4

Which of the following keys can be configured to "autostart" an application when a Windows system boots up?

A) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
B) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunStart
C) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Startup
D) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\StartOnBoot

Question 5

Larry notices in his log file that a lot of TCP traffic with the UPF flags set are targeting various internal hosts on port 31337. He suspects this traffic is unusual but does not quite know what to make of it. Knowing you just passed your CEH exam, Larry decides to ask what you think.
What would be a possible conclusion?

A) UPF scans are common license tracking mechanisms and should always be ignored. The port belongs to an old tool no one uses anymore and therefore poses no threat.
B) Larry should download the 27001 spec and pour through it word for word until it tells him what to do
C) Larry should run "Zombie P0wn3r" a tool he got from the last Defcon security conference he attended that was guaranteed to wipe out all malicious servers.
D) The traffic is being sent from a tool, and based on port 31337, the assumption could be this is this is a Back Orifice scan.

Question 6

Which command line tool can be used to detect all ports currently available on a system?

A) netstat -an
B) nbtstat -an
C) netports -all
D) Ipconfig --open-ports

Question 7

Greg is using his laptop computer one day and the screen suddenly flips upside down. He remembers
His old computer used to change resolution suddenly and for no reason and that his co-worker told him it was a virus along with a horror story about identity theft.
What should Greg do now?

A) Assume it is a virus again and go buy a new computer
B) Call Microsoft and demand they fix their stinking operating system because he is tired of this garbage
C) Check to see if his laptop has a keyboard shortcut for rotating the display, he may have accidently hit
It)
D) Download every freeware scanner he can find and spend the next three days looking for the malicious code.

Question 8

Kumar wants to maintain access a remote machine. He knows he can "drop a shell" that will be usable across his firewall using port 80. Which of the following tools will give him this capability?

A) Monkey shell
B) STunnel
C) HTTrack
D) Loki

Question 9

A tool that can combine two executables together is called ______?

A) Wrapper
B) Masher
C) Squisher
D) Flux Capacitor

Question 10

Willard wants to use the tool "Qfecheck" to scan his network to see if the latest updates are yet installed. In order to make sure it runs correctly permission on what reqistry will have to be set properly?

A) HKEY_LOCAL_MACHINE\SOFTWARE\Services\Microsoft\Updates
B) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServicePacks
C) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Patches
D) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates

Question 11

Krya is an intern that has been planted to commit economic espionage. It is too dangerous to risk physical access twice to the CEOs computer. She wants it to collect information and email the data once a day in an encrypted zip file. What sort of tool would she need to use.

A) RPC-SMTP Trojan
B) VNC remote desktop
C) Hardware keylogger
D) Screenshot spytool

Question 12

A tool that is part of the "sysinternals" collection can scan the Windows registry and help detect unusual events. What is the name of this tool?

A) Regmon
B) Rootkit Revealer
C) Registry Revealer
D) Registry Baseliner

Question 13

Code that has been posted online and given away for free such as libraries can themselves be backdoored and propagate the security hole whenever they are used in other applications. What is the name for this type of risk?

A) Rootkit
B) Trojan horse
C) Shrink-wrap code
D) Illicit Server

Question 14

Which of the following virus types is capable of eluding signature detection by reordering its code at the machine level?

A) Multipartite
B) Metamorphic
C) Polymorphic
D) Stealth Virus

Question 15

What are the three phases of a viral outbreak?

A) Release, Detection, Removal
B) Invention, release, detection
C) Infection, Spreading, Attack
D) Spreading, Attack, Infection

Question 16

Which type of virus hides itself in the unparsed areas of a binary file?

A) Cavity Virus
B) Polymorphic Virus
C) Metamorphic Virus
D) File descriptor Virus

Question 17

What type of scan best detects a virus or worm based on behavior characteristics when the signature
Based approach will not work?

A) Heuristic
B) Anomaly
C) Host based
D) PUP Analysis

Question 18

Applications that clean viruses from systems are sometimes called "Virus Scrubbers". One drawback is that they are only as good as their last signature update, and even at that, many types of malware could be undetectable if there is no signature.
Another approach is to detect corrupt files, or at the very least, files that have been modified that shouldn't be. What type of tool performs this technique?

A) Rootkit Revealers
B) Firewalls and Virtual Private Networks
C) Anti-Phishing, Anti-Malware etc
D) File Integrity Verification tools

Question 19

A virus that XORs a keystream with the shellcode, uses loader code to decrypt the shellcode, then executes the decrypted code is called:

A) Metamorphic Virus
B) Polymorphic Virus
C) XOR Virus
D) Stealth Virus

Question 20

Chandler is having a conversation with Benjamin, the present IT administrator. Benjamin is convinced his network is rock solid secure and impenetrable. He has each and every technology based countermeasure installed. Chandler mentions there is always a weak link, and that somehow, someway
A weakness will be present somewhere.
What principle of defense is Chandler talking about?

A) Viruses such as Polymorphic and Metamorphic are too sophisticated to be stopped.
B) Nuisances such as Spam will never go away and the attackers are always one step ahead.
C) "Zero-day" exploits are constantly being discovered and cannot be defended against.
D) People are always the weakest link. Untrained users, careless users, and inside attackers are always a risk.

Question 21

Which of these types of Virus primarily attack Windows systems?

A) Boot Sector
B) System level viruses
C) Multi-partite viruses
D) Macro viruses

Question 22

What is generally considered to be the first Worm?

A) Elk Cloner
B) Morris
C) Strange Brew
D) FU

Question 23

Which of the following viruses had five infection methods and spread around the world in an estimated 22 minutes?

A) Blaster
B) Slammer
C) Code Red
D) Nimda

Question 24

Dora is examining her log files and notices several access attempts with the following string:
GET/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u688%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u900%u8190%u00c3%u0003%u8b00%u531b%u5 3ff%u0078%u0000%u00=a HTTP/1.0
She opens a browser to visit her own website and notices the front page had been defaced to say the following:
"HELLO! Welcome to http://www.worm.com! Hacked By Chinese!"
What may have happened?

A) Code Red got to her web server
B) An attacker used a fuzzer to overflow the query string
C) Class case of Michelangelo
D) The Nachi worm found her site and successfully exploited it.

Question 25

Microsoft knowledge base bulletin MS03-026 describes an RPC (Port 135) vulnerability that has been exploited time and again even though a patch exists. Which of the following worms exploited this vulnerability?

A) Pretty Park
B) Storm
C) Nachi / Welchia
D) I Love You

Question 26

What are the six steps of the virus lifecycle?

A) Design, Replication, Infection, Detection, Incorporation, Elimination
B) Design, Replication, Monitoring, Detection, Incorporation, Elimination
C) Design, Replication, Launch, Detection, Elimination, Incorporation
D) Design, Replication, Launch, Detection, Incorporation, Elimination

Question 27

Kelly sent an email out to the entire staff warning of a new vulnerability in Outlook that would expose the entire contact list. She explains that several versions of the email have been found, but they all contain the words "Sales Lead" or "Service Request" in the subject line. These emails must be deleted without being opened for the next 72 hours while a patch is released.
What statement below is not true?

A) Kelly is being helpful. Coworkers watching out for events like this and helping one another is critical to any working security program.
B) This looks like a hoax. If Kelly is even a real person she should be fired on the spot, since hoaxes are considered as dangerous as actual viruses.
C) Hoaxes are considered as dangerous as actual viruses and this could be an indication that training is in order for more people than just Kelly
D) An investigation should be conducted to find out if Kelly was attempting a hoax or was herself social engineered.

Question 28

Melissa receives an email that comes from a random email address. She has many friends that use their online "handles" like [e-mail] for instance so she isn't really surprised by that. There is an attachment on the email called "Iloveyou.txt" which looks intriguing even if she doesn't remember knowing this person.
What is about to happen?

A) She will open the attachment and it will be from a long lost partner she has been hoping to get back in touch with for years.
B) The file is really named "iloveyou.txt.vbs" and is a well known classic trick to spread a macro virus
C) Her boss sent her this as a practical joke to see if she would open it, but its harmless
D) A Windows will pop open to a command shell and a lot of noise will come from her speakers. The shell will say "Will you marry me?" the email was from her finacee.

Question 29

What is the term used to describe the space in memeory that stores a set of instructions that are meant to be running temporarily?

A) Stack
B) Page
C) Heap
D) Pile

Question 30

What are the terms used to describe the loading and unloading of a stack of instructions?

A) Load / Unload
B) Push / Pop
C) Get / Put
D) Retrieve / Return

Question 31

Which if the following are dangerous functions in C? (Choose four)

A) strcpy
B) strcat
C) wcscpy
D) fgets
E) malloc

Question 32

Four bytes are used by programmers to terminate string operations. They can also check these bytes when a function returns to see if an attempt has been made to overwite them, if so, an alert can be generated and a message sent to syslog. These are called the "Canary Bytes".
If a message does show up in syslog indicating a problem, what happened?

A) An overflow has been attempted
B) A overflow was succesful
C) The stack has crashed
D) The host based IDS caught the event

Question 33

The terms overflow and overrun mean the same thing?

Question 34

If you have the following pseudo code, what is the most accurate natural language description?
If (i >= 300) then exit

A) If we have written 300 characters to the buffer variable, the function should stop because it cannot hold any more data
B) If we have written more than 300 characters to the buffer variable, the function should stop because it cannot hold any more data
C) If we have written less than 300 characters to the buffer variable, the function should stop because it cannot hold any more data
D) If we have written less than or equal to 300 characters to the buffer variable, the function should stop because it cannot hold any more data

Question 35

It is hard to be precise with the offset value that gets placed into the return register when an overflow is deliberate, as in during an attack. A NOOP sled cane be placed at the beginning of the shell code to create some margin for error. Which of the following looks like a sled?

A) 0xA4\0x23\0xFE\0x65\0xA5\0x65\0xAE\0x5B
B) 0xFF\0xFF\0xFF\0xFF\0xFF\0xFF\0xFF\0xFF\
C) 0x00\0x0D\0x0A\0xFF\0x00\0x0D\0x0A\0xFF\
D) 0x90\0x90\0x90\0x90\0x90\0x90\0x90\0x90\

Question 36

Which of the following registers will be over written in a buffer overflow exploit?

A) EIP
B) ESP
C) ERP
D) EXP

Question 37

The following four bytes represent what?
NULL (0x00), CR (0x0D), LF (0x0A), EOF (0XFF)

A) Bytecode
B) Shellcode
C) NOP Sled
D) Canary bytes

Question 38

Which of the following languages is less vulnerable to buffer overflow attacks?

A) ActiveX
B) Assembly
C) Java
D) C++

Question 39

You just embedded an Active X control in your webpage that has malicious code that logs keystrokes. It exploits a well known buffer overflow exploit in Internet Explorer. If a casual home user drops by to visit your site and accepts the plugin, what privilege will you likely have on the affected host?

A) Whatever the user was when they visited the page
B) IUSR_[computer name]
C) System or Administrator
D) Internet_Explorer

Question 40

You just attacked a IIS server and managed to exploit a buffer overflow in the .printer ISAPI. Turns out there are serveral tools to choose from. Which of the following tools does not perform this attack?

A) Jill.c
B) iishack2000.c
C) iis5hack.zip
D) john the printer

Question 41

There is a "Chunked Encoding Transfer Heap Overflow" vulnerability in IIS. You telnet into port 80 of a possible target and enter the following commands:

A)POST /iisstart.asp HTTP/1.1
B)Accept: */*
C)Host: acme.com
D)Content

Question 42

You are looking at some code and notice something that concerns you. What is the dangerous function in the code below?
Void myMethod(char * pStr)
{
Char pBuff[10];
Int nCount = 0;
Strcpy(pBuff, pStr);
}
Void foo()
{
}

A) void foo()
B) myMethod
C) strcpy
D) fgets

Question 43

When succesfully executing a buffer overflow, what level of privilege will the attacker have?

A) Buffer overflows always have system
B) Buffer overflows always have root, or admin
C) The same context of the service or application that was running
D) Its indetermined, depends on the exploit

Question 44

Sergio wants to get back at his competitor for winning the gold medal in a town fair BBQ contest. He pays his nephew to attack their website. The competitor doesn't realize this until they notice it is not accessible, there is an error message about the authentication system, and a simple reboot is enough to
Fix it.
What type of attack is this most likely? (Choose the best description)

A) Distributed Denial of Service that relies on accidental traffic
B) Denial of Service based on a well known LSASS vulnerability
C) Distributed Denial of Service that overloads resources
D) Denial of Service that requires human interaction to restore service

Question 45

Clive notices that one of his hosts keeps getting DoS'd. A quick view of the traffic on the wire shows a lot of traffic that has both the destinate and host address the same as the victim. What type of attack is this?

A) Land
B) Fraggle
C) Smurf
D) Ping of Death

Question 46

Which is the best description of an unnamed attack?

A) A 0-day attack that researchers have not yet identified
B) An attack that have not been identified by the IDS
C) Reducing offset values to cause a short packet on reassembly
D) Increasing offset values to cause a long packet on reassembly

Question 47

Mary notices her machine has internet access for about 10 minutes then it seems to slow down. She reboots, everything is fine for ten minutes again. What is the most likely problem?

A) Her internet filter is metering her usage and throttling her down
B) Her ISP sucks
C) The website she is visiting is down
D) Her host is vulnerable to slammer.

Question 48

Tony wants to clear his afternoon to play a video game. He needs to manufacture an emergency and tell his boss that the servers are vulnerable to an "Evil Bit" attack, and it will take all afternoon to fix them. This sounds bad, so the boss tells him to get right on it.
What is Tony really talking about?

A) He is referring to a character in his video game, but the boss doesn't realize this
B) He just gave the boss a simple explanation for a real attack knowing he wouldn't understand the right
One
C) The high order bit in the fragment offset field is set, but it is supposed to be reserved with a value 0, and most IP stacks have not been updated to understand it. It crashes the system
D) This is an IT inside Joke

Question 49

Which if the following tool is not a demonstration of an Asymmetric attack (or a tool)?

A) Tribe Flood Network
B) Trinoo
C) C2myazz
D) Stacheldraht

Question 50

A host is bombarded with packets intended to exploit stateful network protocols. Every time it gets a packet, it allocates memory for the expected connection. The connection is never fully established by the sender.
What form of attack is this?

A) SYN Flood
B) Smurf
C) Ping of Death
D) Stachledraught

Question 51

Which of the following tools means "Barbed Wire" in German?

A) Zertifizierte
B) Stacheldraht
C) Barbenkwier
D) Zschwiedlfenken

Question 52

Knowing her company is about to spend 45% of their marketing budget for the year on one commercial during the Super Bowl, Contessa decides to test the load of the servers. This way, capacity problems won't cause the site to go down if the commercial is successful.
What tool can she use?

A) UDP Flood
B) Jolt2
C) Blast
D) MStream

Question 53

What is a possible countermeasure for SYN floods?

A) SPI Firewall
B) SYN Cookies
C) Block all flags with the SYN flag set, in or out
D) Disable outgoing SYN traffic

Question 54

Which of the following tools is known for having a menu of choices available to the attacker?

A) TFN2K
B) Targa
C) Kismet
D) Wikto

Question 55

Blair and Lee work in the NOCs (Network Operation Center)s of two different ISPs. They are on the late shift and bored. Blair sends a series of packets that are 65537 bytes in length trying to irritate Lee.
What is he doing?

A) Ping of Death
B) Invite of Death
C) Generate false positives on the IDS that Lee will have to explain
D) Nothing, packets can be up to 2^32 in size because the Datagram length field is 15 bits and the 16th bit is a multiplier.

Question 56

Sterling sends a flood of UDP traffic toward port 19 on an old UNIX mainframe, spoofing the broadcast address of the subnet and source port 7.
What is he trying to do?

A) Smurf attack
B) Fraggle attack
C) FrickaFrack Attack
D) SmallService Attack

Question 57

Gary assembles an ACL for his Cisco router that looks something like this:
Access-list 111 deny ip 10.0.0.0 0.255.255.255 any
Access-list 111 deny ip 172.16.0.0 0.15.255.255 any
Access-list 111 deny ip 192.168.0.0 0.0.255.255 any
Access-list 111 deny ip 127.0.0.1 0.255.255.255 any
Access-list 111 deny ip 224.0.0.0 31.255.255.255 any
Access-list 111 deny ip host 0.0.0.0 any
The list is applied to an outside interface. What is this list trying to accomplish?

A) Defining private IPs
B) Defining internal networks
C) Anti-NAT attacks
D) Anti-spoofing

Question 58

Landon sends a "Chernobyl Packet" into a network. What does this mean?

A) A packet that causes a kernel panic
B) A packet that causes a broadcast storm
C) A packet than contains a virus
D) A packet that causes a BSOD