Title: 4.2 Key Terms
Course: Information and Communication Technology: Module B > Section: Section 4 - Security Basics

4.2.1 Defining Terms

There a many terms associated with security and a lot of confusion over different attack methods. Worm or Virus? Adware or Spyware? Rootkit or Trojan? There is much confusion over different defenses: Antivirus or Antimalware? Firewalls? Patches? Users are asked to make security decisions and perform technical procedures without knowing what effect they will have. Should I grant permission to open this port? Should this file be quarantined or not? Should I install this add-in? Here are some of the terms you should know to help make smart decisions easier:

- Virus – A program with malicious intent. A virus secretly attaches itself and then executes a malicious payload when a document opens or a program launches. A virus relies on actions by users to spread itself to another computer.
- Worm –  A program with malicious intent created to enter a computer system via an application or operating system vulnerability. Once a worm has exploited the vulnerability on one computer system, its goal is to further infect other computers with similar vulnerabilitiess. It may even send out e-mails from a infected user’s address book to further infect other computers. A worm moves from computer to computer without user interactions once the original computer is infected and requires no user interaction to begin execution.
- Trojan horse – A malicious program that masquerades as performing a reasonable or helpful activity while actually performing a malicious activity.  It may also perform the helpful activity, but its purpose is malicious. A Trojan program usually has code within it that attacks the computer system upon which it runs.
- Rootkit - This malicious software is run each time a computer system boots.  Detection software normally is activated after the operating system is running, and since Rootkits run before the operating system is fully up, they are extremely difficult to detect and remove. A rootkit can modify the operating system such that it can hide running processes and programs that may do malicious operations on an ongoing basis. Rootkits are able to intercept data from network connections and the keyboard.

4.2.2 Defning Terms

Terms continued:

- Backdoor - Essentially, this is a means of skipping the normal authentication process to get into a computer system for malicious purposes.  Because normal authentication is skipped malicious attackers have easy entry.
- Zombie – An infected “robot” computer and Botnet - Thousands of zombies manipulated under remote control. Zombies and botnets are one of the more common types of malware today carried by Trojan horses, worms, and viruses. These programs put the infected computer under remote control of an attacker without the user’s knowledge.

Attackers may use an Internet Relay Chat (IRC)to remotely control zombies. An IRC is an open communication protocol used for real-time “chatting” with other IRC users over Internet. Once a computer is infected it is joined to a specific IRC channel on an IRC server and awaits instructions, allowing an attacker to remotely control the zombie. Once under the control of a bot herder, botnets can be used for many different malicious purposes. Once infected, a zombie may:
  - Prevent users from accessing normal services like the Internet or task manager.
  - Send extremely large numbers of requests such that a resource is overloaded, disabled or stopped.
  - Denial-of-Service or Distributed DoS is an attack launched from many computers to make a machine or network resource unavailable to its intended users.
  - Ping of Death is a series of abnormally formed pings sent over and over again with the purpose of diabling the receiving website or computer system.
  - E-mail Bomb is meant to keep normal users of an email server from accessing their email because their email server is consumed with handling massive amounts of useless email generated as part the email bomb attack.

4.2.3 Defining Terms

Terms continued:

- Malware - This is a general term for all sorts of malcious software such as computer viruses, worms, trojan horses, spyware, etc.  Malware is created by attackers for a variety of reasons.  These reasons range from creating nuisances on the user's computer to gaining access to personal or organizational sensitive information to destroying the operation of the computer to installing a backdoor for future malicious use, and other purposes yet to be determined.  The software may be a full program, may be embedded in another program that seems harmless, may be a script, etc. Malware has caused the rise of a booming business in software to clean and prevent new malware from being installed on computers.  Personal and organizational users typically no longer try to operate their computers without these anti-malware pieces of software installed.
- Adware – Software that delivers advertisements to the user to produce revenue for the author of the adware. The adware may simply advertise a particular good or service or if may be designed to analyze the user's use of the Internet including sites visited, purchased made, etc.  Behavioral results may then be transmitted to the author or another entity through the Internet.
- Spyware - Software that captures information on users or organizations without consent and transmits that information to another person or organization in the Internet.  Information may include social security numbers, bank account numbers, passwords, etc.  Spyware can also make changes in a computer's configuration without user consent.  Some changes are annoying, such as slowing computer response; others are more malicious, such as opening backdoors for further malicious exploitation.
- Grayware –  Grayware, though not viruses or malware in the true sense, are programs that typically enable real-time communications, including applications that may keep track of weather or stocks, as well as many add-ons for applications like Facebook and Twitter. While these applications may seem innocent, they do add significant   security, confidentiality, and legal risks to an individual user and to an organization.

4.2.4 Defining Terms

Term Continued:

- Social Engineering - Getting people to disclose confidential information they would not otherwise disclose.  This psychological intervention is  a type of intrusion that involves misleading people such that they voluntarily break normal security procedures to expose confidential information.  Some say that as attacks become more sophisticated, the software to overcome them can also become more sophisticated, but often user security awareness does not keep up with the rapid advances in all sorts of attacks.  Prevention of attacks through human social engineering mistakes requires educating people about the value of information, training them to protect it, and increasing people's awareness of how social engineers operate. Click here to find out more.
- Pretexting - The act of creating and using a devised scenario to engage a potential victim into divulging information or performing an action. It usually involves some prior research or setup to impersonate a legitimate person or business. They may know something like your date of birth or Social Security Number so they appear to be who they say they are.
- Phishing - This is another method of obtaining private information from a user through trickery.  Typically the user is sent an email that appears to be normal and from a genuine source, requesting confidential user information be verified.  Often, valid company logos are used, and often dire consequences are threatened if the user does not provide verification.  If the user responds, connection is typically made to a fraudulent website that will request confidential information, information that should not be provided.  The reasonable user should not respond but rather should contact the business directly through normal means such as telephone or the normal business website to determine whether or not the email requesting confidential information is valid.

Please complete assignment 4.2.1 in the lab manual.