第8单元：恶意软件和取证 8.1恶意软件和取证 Rootkit，后门，间谍软件，广告软件和PUP...

>> Other malware that you should be familiar with includes a rootkit,
which is a set of programs and code that allows a persistent
or permanent undetectable presence on a computer.

A rootkit can sanitize logs and repair timestamps, hiding actions of the hackers.

A rootkit can also mask files, processes, and network connections
and enable privileged access to the computer.

It also conceals installed malware.

For instance, when you AV, antivirus software, is ready to check a location
where malware is resident, the rootkit will tell the AV software
"You checked it already and it's clean.

Move on to somewhere else.
"
Rootkits also install another piece of malware called a backdoor.

After hackers exploit vulnerabilities to get into your system or network,
they want to come back later with less effort.

Backdoors allow hackers to do so, bypassing the normal authentication process
through software left after the initial penetration.

It's like breaking into a physical location and propping open a back window or a back door
that isn't monitored to get back in another time.

Spyware covertly monitors user's activities and reports personal user data
to a third party that expects financial gain.

Spyware also includes the sale of personal data, the redirecting of web activity to ad sites,
and the presentation of targeted ads and pop-ups
through a related piece of malware called adware.

Adware automatically plays or displays advertisements
or downloads promotional material.

It's often bundled with a product or package and it's common in shareware,
free software that might require subsequent payment after a trial run.

A few years ago, McAfee, the security company coined a new term,
PUP, potentially unwanted program.

Often companies will include some extra to a program that users download,
which would directly fall under the spyware and adware categories.

These programs used to be called Trojan horses for that very reason.

However, the companies that made these programs did in fact mention the extras
in the EULA, end-user license agreement.

They objected to the terms Trojan horse, spyware,
and adware since they weren't hiding anything.

But think about it, how many users actually read those EULA's?
Not much.
For that reason and to avoid any legal issues, the term PUP,
potentially unwanted program, was coined as a lesser way of saying Trojan horse
that includes spyware and adware with your download.

转载于:https://www.cnblogs.com/sec875/articles/10452708.html