Question 1

Which of the following is the best definition of a Trojan horse?
A) Unauthorized software that performs unwanted functions
B) Authorized software that has been embedded with malicious code that performs unwanted functions
C) Unauthorized features in an application that perform authorized but hidden functions
D) Authorized software that includes rootkit functionality to protect it from being detected as a false positive

Accepted Answer

A Trojan horse is a form of social engineering. The victim thinks they are installing authorized or "safe" code. It has however been modified to provide malicious capabilities such as keylogging.

Question 2

In terms of information security and malware classification, a RAT is a:
A) Remote Authentication Terminal
B) Someone that reports the activities of a coworker to management
C) Remote Access Tool
D) The Reveal - Access - Target, model of malicious activity

Accepted Answer

This class of tool includes such classics as Netbus, Back Orifice, and SubSeven. Modern RATs have evolved into commercial programs as well.

Question 3

Tayzia notices that her IDS logs are showing repeated access attempts to the $ EXTERNAL_NET toward a range of ports 6662-6667. Luckily, the connections were unsuccessful, what is the bad news?
A) Tayzia will have to work overtime (unpaid, this is IT after all) trying to figure out where all the MP3s are being hid on the network.
B) Clearly someone is using BitTorrent to download the first season of "Star Trek: Deep Space Nine"
C) Something on her network is trying to access IRC, and it might be an infected host.
D) These are common administrative ports for Citrix or Oracle or something. She doesn't remember because during that discussion in her training class she was answering an email instead of listening. Either way, there is no need to investigate; it is probably just a false positive.

Accepted Answer

Internet Relay Chat is a common place for the Command and Control Centers of botnets. It is also where the DCC (Direct Client to Client) protocol is used to transfer files. People visiting chat rooms are duped into accepting these files and can be Trojan horses.

Question 4

Which of the following keys can be configured to "autostart" an application when a Windows system boots up?
A) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
B) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunStart
C) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Startup
D) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\StartOnBoot

Accepted Answer

A malicious application that intends to restart on every reboot of the host has many options in the Windows environment. In Linux, the "rc" scripts can be modified and the changes could possibly go unnoticed.

Question 5

Larry notices in his log file that a lot of TCP traffic with the UPF flags set are targeting various internal hosts on port 31337. He suspects this traffic is unusual but does not quite know what to make of it. Knowing you just passed your CEH exam, Larry decides to ask what you think.
What would be a possible conclusion?
A) UPF scans are common license tracking mechanisms and should always be ignored. The port belongs to an old tool no one uses anymore and therefore poses no threat.
B) Larry should download the 27001 spec and pour through it word for word until it tells him what to do
C) Larry should run "Zombie P0wn3r" a tool he got from the last Defcon security conference he attended that was guaranteed to wipe out all malicious servers.
D) The traffic is being sent from a tool, and based on port 31337, the assumption could be this is this is a Back Orifice scan.

Accepted Answer

The URG,PSH,FIN flags all set at once look like an Xmas scan. Regardless of what sent it, this combination would not happen during natural protocol behavior and is therefore created by a hacking tool.

Question 6

Which command line tool can be used to detect all ports currently available on a system?
A) netstat -an
B) nbtstat -an
C) netports -all
D) Ipconfig --open-ports

Accepted Answer

Netstat is for network statistics, the -an options say "all connections and listening ports, show numeric values" Thisis a way to determine of ports are open on a host that shouldn't be.

Question 7

Greg is using his laptop computer one day and the screen suddenly flips upside down. He remembers
His old computer used to change resolution suddenly and for no reason and that his co-worker told him it was a virus along with a horror story about identity theft.
What should Greg do now?
A) Assume it is a virus again and go buy a new computer
B) Call Microsoft and demand they fix their stinking operating system because he is tired of this garbage
C) Check to see if his laptop has a keyboard shortcut for rotating the display, he may have accidently hit
It)
D) Download every freeware scanner he can find and spend the next three days looking for the malicious code.

Accepted Answer

It is easy to get so focused on malicious security issues and forget the basics. Don't always assume the worst; apply proper troubleshooting and diagnostics.

Question 8

Kumar wants to maintain access a remote machine. He knows he can "drop a shell" that will be usable across his firewall using port 80. Which of the following tools will give him this capability?
A) Monkey shell
B) STunnel
C) HTTrack
D) Loki

Accepted Answer

The term "drop a shell" or "shovel a shell" can be used to describe a connection that returns shell stream back through a firewall that would block the connection in the forward direction. Monkey shell sends the data within XML traffic which disguises it as normal web traffic.

Question 9

A tool that can combine two executables together is called ______?
A) Wrapper
B) Masher
C) Squisher
D) Flux Capacitor

Accepted Answer

The terms "Wrapper" or "Binder" might be used to describe this process. A tool such as "elitewrap" makes creating Trojan horses easy.

Question 10

Willard wants to use the tool "Qfecheck" to scan his network to see if the latest updates are yet installed. In order to make sure it runs correctly permission on what reqistry will have to be set properly?
A) HKEY_LOCAL_MACHINE\SOFTWARE\Services\Microsoft\Updates
B) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServicePacks
C) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Patches
D) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates

Accepted Answer

For more information on using this tool visit: http://support.microsoft.com/kb/282784

Question 11

Krya is an intern that has been planted to commit economic espionage. It is too dangerous to risk physical access twice to the CEOs computer. She wants it to collect information and email the data once a day in an encrypted zip file. What sort of tool would she need to use.
A) RPC-SMTP Trojan
B) VNC remote desktop
C) Hardware keylogger
D) Screenshot spytool

Accepted Answer

A hardware keylogger is visually detectable and requires at least two physical access opportunities (install and retrieval). A screenshot tool can take period screenshots that show all activity on the host including sensitive files.

Question 12

A tool that is part of the "sysinternals" collection can scan the Windows registry and help detect unusual events. What is the name of this tool?
A) Regmon
B) Rootkit Revealer
C) Registry Revealer
D) Registry Baseliner

Accepted Answer

This tool was used in the famous "Sony Rootkit" discovery. For information visit the information page at:
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx

Question 13

Code that has been posted online and given away for free such as libraries can themselves be backdoored and propagate the security hole whenever they are used in other applications. What is the name for this type of risk?
A) Rootkit
B) Trojan horse
C) Shrink-wrap code
D) Illicit Server

Accepted Answer

It is important to obtain code only from trusted sources, since that is hard to do, the better step is to use only source code that you can inspect first before using.

Question 14

Which of the following virus types is capable of eluding signature detection by reordering its code at the machine level?
A) Multipartite
B) Metamorphic
C) Polymorphic
D) Stealth Virus

Accepted Answer

Metamorphic viruses change code, polymorphic viruses encrypt themselves.

Question 15

What are the three phases of a viral outbreak?
A) Release, Detection, Removal
B) Invention, release, detection
C) Infection, Spreading, Attack
D) Spreading, Attack, Infection

Accepted Answer

The question wasn't asking about incident response or monitoring. It was referring to the actual outbreak itself. Vulnerabilites are exploited resulting in the infection, the virus then spreads to other hosts, and once it makes a home drops it inflicts its damage.

Question 16

Which type of virus hides itself in the unparsed areas of a binary file?
A) Cavity Virus
B) Polymorphic Virus
C) Metamorphic Virus
D) File descriptor Virus

Accepted Answer

A cavity virus hides inside of binary files and can perform the attack from that location. Stealth viruses store themselves inside of files, but remove themselves to run, then hide again.

Question 17

What type of scan best detects a virus or worm based on behavior characteristics when the signature
Based approach will not work?
A) Heuristic
B) Anomaly
C) Host based
D) PUP Analysis

Accepted Answer

"Heuristics" deal with problem solving, learning, and deduction. It is experienced based. A heuristic scanner looks for smaller samples of a larger behavioral problem and attempts to alert the user before the viral or malicious activity has a chance to complete its exploit.

Question 18

Applications that clean viruses from systems are sometimes called "Virus Scrubbers". One drawback is that they are only as good as their last signature update, and even at that, many types of malware could be undetectable if there is no signature.
Another approach is to detect corrupt files, or at the very least, files that have been modified that shouldn't be. What type of tool performs this technique?
A) Rootkit Revealers
B) Firewalls and Virtual Private Networks
C) Anti-Phishing, Anti-Malware etc
D) File Integrity Verification tools

Accepted Answer

FIV tools might also be called SIVs (System Integrity Verifier)s. They create a database of the hashes of critical system files, then monitor them for changes. They also track MAC times (Modify, Access, Change).

Question 19

A virus that XORs a keystream with the shellcode, uses loader code to decrypt the shellcode, then executes the decrypted code is called:
A) Metamorphic Virus
B) Polymorphic Virus
C) XOR Virus
D) Stealth Virus

Accepted Answer

The question contains a brief description of how the polymorphic virus works. The XOR process is used because it is fast and easy "bit oriented" encryption.

Question 20

Chandler is having a conversation with Benjamin, the present IT administrator. Benjamin is convinced his network is rock solid secure and impenetrable. He has each and every technology based countermeasure installed. Chandler mentions there is always a weak link, and that somehow, someway
A weakness will be present somewhere.
What principle of defense is Chandler talking about?
A) Viruses such as Polymorphic and Metamorphic are too sophisticated to be stopped.
B) Nuisances such as Spam will never go away and the attackers are always one step ahead.
C) "Zero-day" exploits are constantly being discovered and cannot be defended against.
D) People are always the weakest link. Untrained users, careless users, and inside attackers are always a risk.

Accepted Answer

It is arguable that all of these principles are risks that can be minimized or mitigated to a degree. Attacks that are not stopped can usually be detected and the damage can be contained. The best answer in this case is the one element that security professionals will have the least control over; what people do every day.

Quiz 3: Malicious Code

Which of the following is the best definition of a Trojan horse?

In terms of information security and malware classification, a RAT is a:

Tayzia notices that her IDS logs are showing repeated access attempts to the $ EXTERNAL_NET toward a range of ports 6662-6667. Luckily, the connections were unsuccessful, what is the bad news?

Which of the following keys can be configured to "autostart" an application when a Windows system boots up?

Which command line tool can be used to detect all ports currently available on a system?

Greg is using his laptop computer one day and the screen suddenly flips upside down. He remembers His old computer used to change resolution suddenly and for no reason and that his co-worker told him it was a virus along with a horror story about identity theft. What should Greg do now?

Kumar wants to maintain access a remote machine. He knows he can "drop a shell" that will be usable across his firewall using port 80. Which of the following tools will give him this capability?

A tool that can combine two executables together is called ______?

Willard wants to use the tool "Qfecheck" to scan his network to see if the latest updates are yet installed. In order to make sure it runs correctly permission on what reqistry will have to be set properly?

Krya is an intern that has been planted to commit economic espionage. It is too dangerous to risk physical access twice to the CEOs computer. She wants it to collect information and email the data once a day in an encrypted zip file. What sort of tool would she need to use.

A tool that is part of the "sysinternals" collection can scan the Windows registry and help detect unusual events. What is the name of this tool?

Code that has been posted online and given away for free such as libraries can themselves be backdoored and propagate the security hole whenever they are used in other applications. What is the name for this type of risk?

Which of the following virus types is capable of eluding signature detection by reordering its code at the machine level?

What are the three phases of a viral outbreak?

Which type of virus hides itself in the unparsed areas of a binary file?

What type of scan best detects a virus or worm based on behavior characteristics when the signature Based approach will not work?

A virus that XORs a keystream with the shellcode, uses loader code to decrypt the shellcode, then executes the decrypted code is called: