Cisco !#&? be a network ninja


To the top Chapter 2.1.1 Chapter 2.1.2 Chapter 2.1.3

Introduction to Cybersecurity

One course of Cisco's "Skills for all"

On completing this course, you will be able to:

Module 2 - Attacks, Concepts and Techniques

Welcome to this module, which will explore the different methods that cybercriminals use to launch an attack

Understanding what these are and how they work is the best way to protect ourselves. So, let’s make sure you know what you’re up against.

Chapter 2.1 - Analyzing a Cyber Attack

2.1.1 Types of Malware

Cybercriminals use many different types of malicious software, or malware, to carry out their activities. Malware is any code that can be used to steal data, bypass access controls, or cause harm to or compromise a system. Knowing what the different types are and how they spread is key to containing and removing them.

Spyware

Designed to track and spy on you, spyware monitors your online activity and can log every key you press on your keyboard, as well as capture almost any of your data, including sensitive personal information such as your online banking details. Spyware does this by modifying the security settings on your devices.

It often bundles itself with legitimate software or Trojan horses.

Adware

Adware is often installed with some versions of software and is designed to automatically deliver advertisements to a user, most often on a web browser. You know it when you see it! It’s hard to ignore when you’re faced with constant pop-up ads on your screen.

It is common for adware to come with spyware.

Backdoor

This type of malware is used to gain unauthorized access by bypassing the normal authentication procedures to access a system. As a result, hackers can gain remote access to resources within an application and issue remote system commands.

A backdoor works in the background and is difficult to detect.

Ramsomware

This malware is designed to hold a computer system or the data it contains captive until a payment is made. Ransomware usually works by encrypting your data so that you can’t access it.

Some versions of ransomware can take advantage of specific system vulnerabilities to lock it down. Ransomware is often spread through phishing emails that encourage you to download a malicious attachment or through a software vulnerability.

Scareware

This is a type of malware that uses 'scare’ tactics to trick you into taking a specific action. Scareware mainly consists of operating system style windows that pop up to warn you that your system is at risk and needs to run a specific program for it to return to normal operation.

If you agree to execute the specific program, your system will become infected with malware.

Rootkit

This malware is designed to modify the operating system to create a backdoor, which attackers can then use to access your computer remotely. Most rootkits take advantage of software vulnerabilities to gain access to resources that normally shouldn’t be accessible (privilege escalation) and modify system files.

Rootkits can also modify system forensics and monitoring tools, making them very hard to detect. In most cases, a computer infected by a rootkit has to be wiped and any required software reinstalled.

Virus

A virus is a type of computer program that, when executed, replicates and attaches itself to other executable files, such as a document, by inserting its own code. Most viruses require end-user interaction to initiate activation and can be written to act on a specific date or time.

Viruses can be relatively harmless, such as those that display a funny image. Or they can be destructive, such as those that modify or delete data.

Viruses can also be programmed to mutate in order to avoid detection. Most viruses are spread by USB drives, optical disks, network shares or email.

Trojan horse

This malware carries out malicious operations by masking its true intent. It might appear legitimate but is, in fact, very dangerous. Trojans exploit your user privileges and are most often found in image files, audio files or games.

Unlike viruses, Trojans do not self-replicate but act as a decoy to sneak malicious software past unsuspecting users.

Worms

This is a type of malware that replicates itself in order to spread from one computer to another. Unlike a virus, which requires a host program to run, worms can run by themselves. Other than the initial infection of the host, they do not require user participation and can spread very quickly over the network.

Worms share similar patterns: They exploit system vulnerabilities, they have a way to propagate themselves, and they all contain malicious code (payload) to cause damage to computer systems or networks.

Worms are responsible for some of the most devastating attacks on the Internet. In 2001, the Code Red worm had infected over 300,000 servers in just 19 hours.

2.1.2 Symptoms of Malware

So now you know about the different kinds of malware. But what do you think their symptoms might be?

Regardless of the type of malware a system has been infected with, there are some common symptoms to look out for. These include:

  • an increase in central processing unit (CPU) usage, which slows down your device
  • your computer freezing or crashing often
  • a decrease in your web browsing speed
  • unexplainable problems with your network connections
  • modified or deleted files
  • the presence of unknown files, programs or desktop icons
  • unknown processes running
  • programs turning off or reconfiguring themselves
  • emails being sent without your knowledge or consent.

This is exactly what could be happening at @Apollo!

Based on what you now know, do you think you could spot the different types of malware from their descriptions?

2.1.3 What Do You Think?

Match each of the descriptions to the correct malware type by selecting an answer from each dropdown.

Malware designed to track your online activity and capture your data

Software that automatically delivers advertisements

Malware that holds a computer system captive until a payment is made to the attacker

Malicious code that attaches to legitimate programs and usually spreads by USB drives, optical media, network shares or email

Malicious code that replicates itself independently by exploiting vulnerabilities in networks

Skills for all