CompTIA Security+ :Viruses,Threats and Compromise Indicators

Explore the 2024 cyber security forecast within the CompTIA Security+ framework, highlighting viruses, threats, and compromise indicators.

Explore how computer viruses and malware drive economic damage through system failures, data corruption, and rising maintenance costs, and why no antivirus catches all threats while researchers pursue evolving solutions.

Define malware as malicious software designed to damage devices or grant unauthorized access. Note its forms, including viruses, Trojan horses, logic bombs, ransomware, and spyware.

Discover how polymorphic malware changes features to evade detection and signature-based approaches, with Storm Warm and Cryptowall examples 97% prevalence; adopt updating software, avoid suspicious links, and use behavior-based detection.

Viruses are malicious code that replicate by attaching to legitimate programs or documents with macros, spread to machines, and cause popups or crashes; defend systems with antivirus and regular scans.

Crypto malware encrypts targeted files and demands cryptocurrency ransom for a decryption key, while ransomware encrypts entire systems. Prevent with patches, trusted antivirus, application control, and regular backups.

Armored viruses employ tricks to hinder tracing, disassembly, and understanding of the code, with whale virus as a large, misleading example. They mislead antivirus software by disguising location, delaying countermeasures.

Spread across networks without a host program, worms replicate and infect inadequately protected systems, while viruses attach to files, remain dormant until activation, and modify or corrupt them.

Explore the Trojan horse as a deceptive malware that looks legitimate, tricks users into executing it, and damages data and devices, including Android switcher variants.

Rootkits gain admin access via phishing and social engineering to remotely control a computer, loading at kernel, firmware, memory, or boot levels and showing signs like antivirus failures.

Keyloggers, software or hardware, log keystrokes for surveillance and theft of passwords and data. They spread via attachments or infected sites and show signs like lag and error screens.

Adware hijacks browsers, displays pop-ups and drive-by downloads. Protect systems with ad blockers, trusted devices, antivirus, and removal tools.

Spyware infiltrates devices to monitor activity and steal data, fueling cybercrime and identity theft. It includes adware, trojans, and cookies; prevention relies on cautious downloads and antivirus.

Define bots and botnets, distinguishing good bots from malicious ones. Show how botnets propagate, log keystrokes, steal passwords, enable fraud and DDoS, and outline defenses like firewalls, anti-malware, and updates.

Explore remote access trojans (rats), their keylogger and packet sniffer capabilities, and how attackers gain full control, steal credentials, and evade detection through social engineering and packed binaries.

A logic bomb is a malware activated by a date, time, or event, wiping data including the master boot record from banks, media firms, and ATMs.

Explore backdoors in software and systems, including legitimate maintenance portals and attacker implants such as remote access trojans, and examine NSA-led efforts and encryption algorithm weaknesses discussed in the lecture.

Identify indicators of compromise by collecting and analyzing symptoms, such as anomalous network traffic, suspicious file changes, atypical logins, and unusual DNS requests.

Explore malware types such as viruses, ransomware, worms, trojans, rootkits, and keyloggers, and compare spyware to keyloggers while identifying indicators of compromise on compromised machines.