Suppose a group of attackers attacked Nova Scotia Health Authority (NSHA) and injected malware to the NSHA network through a compromised host, where the injected malware propagated over the entire network after an employee accidentally opened an infected file in his computer connected to the NSHA network. What type of malware (e.g., virus vs. worm) did the attackers deploy? Justify your answer.

Suppose a group of attackers attacked Nova Scotia Health Authority (NSHA) and injected malware to the NSHA network through a compromised host, where the injected malware propagated over the entire network after an employee accidentally opened an infected file in his computer connected to the NSHA network. What type of malware (e.g., virus vs. worm) did the attackers deploy? Justify your answer.

Database System Concepts

7th Edition

ISBN:9780078022159

Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Chapter1: Introduction

Section: Chapter Questions

Problem 1PE

See similar textbooks

Similar questions

Can you please help with these questions: What is the difference in detail captured between NetFlow, firewall logs, and raw packet captures? Which would be more useful in investigating malware? Which types of network logs/capture would take more storage space? What kinds of things could firewall and NetFlow logs be useful for over raw packet captures?.
Given have a firewall between the Internet (represented by a cloud) and your network router. And some active attacks are added from the list of active attacks; os exploits, viruses, trojans, etc. Please refer to the diagram attached. Are these attacks able to get to your network? Do you feel your system is secure? What’s wrong with this scenario? please don't copy the solution on Bartleby. it does not answer the question
When a web client requests access to protected resources on a web server, native authentication and authorization services are executed step-by-step. Which two arguments in favor of layered protocols are the most compelling? Provide evidence to back up your claim.
Consider a distributed denial of service (DDOS) attack, Assume the attacker has compromised a number of broadband connected computers to use as zombie systems. If the ISP provides a maximum uplink data rate of 512 Kbps in ADSL, what is the maximum number of 512-byte ICMP echo request (ping) packets a single zombie computer can send per second? How many such zombie systems would the attacker need to flood a target server in an organization that has: A. Fast Ethernet. B. Gigabit Ethernet.
Consider a distributed denial of service (DDOS) attack, Assume the attacker has compromised a number of broadband connected computers to use as zombie systems. If the ISP provides a maximum uplink data rate of 7.5 Mbps in cable service, what is the maximum number of 256-byte ICMP echo request (ping) packets a single zombie computer can send per second? How many such zombie systems would the attacker need to flood a target server in an organization that has: A. Fast Ethernet. B. Gigabit Ethernet.
Course: Data communication and communication Networks Answer the following questions related to SYN cookies. a. Why is it necessary for the server to use a special initial sequence number in the SYNACK? b. Suppose an attacker knows that a target host uses SYN cookies. Can the attacker create half-open or fully open connections by simply sending an ACK packet to the target? Why or why not? c. Suppose an attacker collects a large amount of initial sequence numbers sent by the server. Can the attacker cause the server to create many fully open connections by sending ACKs with those initial sequence numbers? Why?
One of the ways in which a network might be infiltrated and an intrusion can take place is if malicious traffic is redirected from one virtual local area network (VLAN) to another. Determine the strategy that was employed by the attacker in their assault. In order to avoid anything like this from occurring, what are all of the precautionary measures that you may take?
A Smurf attack could be described using which of the following statements? Very large email attachments are sent to the victim’s email address Continually polling all possible Transmission Control Protocol and User Datagram Protocol ports to prevent legitimate connections Sending numerous SYN packets to a server and not replying to the resultant SYN/ACK packets An ICMP Type 8 (ECHO) packet with a spoofed source address is sent to the broadcast address of a large network; each member of that large network responds with an echo response packet to the spoofed source address, which floods the victim
______ often begins with some sort of spoofing attack used to compromise a traffic-direction component on the network, but it can also rely on malware or other methods. A. Redirection B. Reflection C. Amplification
Consider the following threats to Web security and describe how each is countered by a particular feature of TLS. A. Password Sniffing: Passwords in HTTP or other application traffic are eavesdropped. B. IP Spoofing: Uses forged IP addresses to fool a host into accepting bogus data. C. IP Hijacking: An active, authenticated connection between two hosts is disrupted, and the attacker takes the place of one of the hosts. D. SYN Flooding: An attacker sends TCP SYN messages to request a connection, but does not respond to the final message to establish the connection fully. The attacked TCP module typically leaves the “half-open connection” around for a few minutes. Repeated SYN messages can clog the TCP module.
The network may have been compromised by malicious traffic that was relayed from one virtual local area network (VLAN) to another. Determine the pattern of assault that the attacker prefers to use. I would appreciate it if you could explain any preventative measures you may have taken in case this happens again.