5.3 Malicious Code and Software Attacks

Types of Malicious Code

Malware is software designed to damage, disrupt, or gain unauthorized access to systems. Common types include viruses (attach to files, need a host to spread), worms (self-replicate across networks without a host), trojans (disguise as legitimate software), ransomware (encrypts data for payment), and spyware/keyloggers (secretly collect user data).

Software Attack Techniques

Attackers exploit weak code through methods like SQL injection (inserting malicious SQL into input fields to manipulate databases), cross-site scripting (XSS) (injecting scripts into web pages viewed by others), and buffer overflow (overwriting memory beyond an allocated buffer to crash or hijack a program). These attacks exploit unvalidated input or poor memory management.

Defending Against Attacks

Preventing these attacks requires input validation and sanitization, using parameterized queries to stop SQL injection, escaping output to prevent XSS, and secure coding practices like bounds checking to avoid buffer overflows. Regular software updates/patches close known vulnerabilities before attackers can exploit them.

Key terms

Virus

Malware that attaches to a host file and spreads when the infected file is run.

Worm

Self-replicating malware that spreads across networks without needing a host file.

SQL Injection

An attack that inserts malicious SQL code into input fields to manipulate or access a database.

Buffer Overflow

An attack exploiting a program that writes more data to memory than the buffer can hold, potentially crashing the system or running malicious code.

Cross-Site Scripting (XSS)

An attack that injects malicious scripts into web pages so they execute in other users' browsers.

Try an AP-style question

What attack is this?

1. Cross-site scripting
2. Phishing
3. Buffer overflow
4. SQL injection