Malware Threats, Sniffing, and Social Engineering
Malware Threats
Categories
Viruses require a host file and user action to spread; worms self-propagate over networks without a host; trojans masquerade as legitimate software and do not self-replicate; rootkits hide themselves at user or kernel level; ransomware encrypts and extorts; spyware/adware/keyloggers collect data; botnets provide remote command infrastructure; logic bombs trigger on a condition; fileless malware lives in memory or the registry using PowerShell/WMI; and backdoors/RATs give persistent remote control.
Know virus subtypes: boot sector, file infector, macro, multipartite, polymorphic (changes its decryptor on each infection), metamorphic (rewrites its whole body), stealth (intercepts system calls to hide), armored, cavity, and resident versus non-resident.
Components and delivery
A dropper installs the payload; a downloader fetches it later; a packer/crypter obfuscates to evade antivirus; wrappers and binders attach malware to a legitimate executable. Delivery is via phishing attachments, drive-by downloads, malicious macros, USB media, or supply-chain compromise.
Analysis
Static analysis inspects the binary without running it - hashes, strings, PE headers, imports, packer signatures, VirusTotal. Dynamic analysis runs it in a sandbox (Cuckoo, CAPE) or an isolated VM while monitoring with Process Monitor, Regshot, and Wireshark for file, registry, and network behavior. Malware detects sandboxes via timing checks, VM artifacts, and user-interaction checks, so behavior may differ from production.
Worked example
A sample has no matching antivirus signature but writes a Run-key and beacons to an IP every 60 seconds. Signature evasion proves nothing; the behavioural indicators (persistence plus command-and-control traffic) justify a malware classification. Rule of thumb: hash-based detection catches known code, behaviour-based detection catches intent.
Defenses
Anti-malware with behavioral engines, patching, application allow-listing, email filtering, least privilege, and tested offline backups against ransomware.
Sniffing and Social Engineering
Sniffing
Passive sniffing only listens; active sniffing injects traffic to force packets to the attacker. On a hub, all traffic is visible; on a switch, you must actively redirect it. Core techniques: ARP poisoning (send forged ARP replies so two hosts map the attacker's MAC to each other's IP, enabling MITM), MAC flooding (overflow the CAM table so the switch fails open and floods frames), DHCP starvation/rogue DHCP, DNS spoofing, VLAN hopping, and SSL stripping (downgrade HTTPS to HTTP). Tools: Wireshark, tcpdump, arpspoof, Ettercap, Bettercap, macof, Cain & Abel. Port mirroring (SPAN) and network taps are the legitimate capture methods.
Countermeasures: dynamic ARP inspection, DHCP snooping, port security, static ARP entries, encryption (TLS/VPN), and 802.1X. Trap: sniffing on a switched network with no poisoning usually captures nothing but broadcast traffic; also, a passive sniffer cannot modify traffic, so SSL stripping is active.
Social engineering
Human-focused attacks: phishing, spear phishing, whaling, vishing, smishing, pharming, pretexting, baiting, quid pro quo, tailgating, shoulder surfing, dumpster diving, watering-hole, and impersonation. These are classified as human-based, computer-based, or mobile-based, and generally as non-technical - although pretexting often borrows technical detail. Defenses are policy-driven: security awareness training, verification procedures, clean-desk policy, visitor controls, email filtering, and simulated phishing campaigns.
Worked example
You must capture traffic between a workstation and a server on a switched LAN. Rule of thumb: switch equals active. Run ARP poisoning so both sides send frames to your MAC, enable IP forwarding (echo 1 > /proc/sys/net/ipv4/ip_forward) to avoid a DoS, and capture in Wireshark - then enable DAI in the report as remediation.