Review Questions 6.1 6.2 6.3 6.4 6.5 6.6 6.7 6.8 6.9 What are three broad mechanisms that malware can use to propagate? What are four broad categories of payloads that malware may carry? What characteristics of an advanced persistent threat give it that name? What are typical phases of operation of a virus or worm? What mechanisms can a virus use to conceal itself? What is the difference between machine executable and macro viruses? What means can a worm use to access remote systems to propagate? What is a "drive-by-download" and how does it differ from a worm? How does a Trojan enable malware to propagate? How common are Trojans on com- puter systems? Or on mobile platforms? 6.10 What is a "logic bomb? 6.11 What is the difference between a backdoor, a bot, a keylogger, spyware, and a rootkit? Can they all be present in the same malware? What is the difference between a "phishing" attack and a "spear-phishing" attack, par- ticularly in terms of who the target may be? 6.12 6.13 List some the different levels in a system that a rootkit may use. 6.14 Describe some malware countermeasure elements 6.15 List three places malware mitigation mechanisms may be located 6.16 Briefly describe the four generations of anti-virus software