Separate the types that steal information (spyware and keyloggers) from the types that secure a way in or control (backdoors and RATs) by what each is for
Explain how a macro virus is set off when someone opens a document
Explain, from where its body lives, why fileless malware is hard to catch by scanning files
Spyware (スパイウェア) is information-gathering malware that gets onto a device without the user knowing, quietly collects personal data and activity records, and sends them out.
Installed unnoticed
Gathers data on the device
Sends it to an outside attacker
It keeps sending what it has gathered out over the network.
3 / 3
It often arrives in ways the user does not notice, such as being bundled with free software or installed through a fake prompt. What it collects varies widely, including browsing history and the contacts stored on the device.
AnalogyIt is like a private detective hired to note someone's every move from the shadows and report back. The person being watched has no idea it is happening.
How to rememberA spy's job is not sabotage but bringing information home. Tie the name to that.
Exam points
ExamThe aim of spyware (スパイウェア) is to gather and carry off personal data and usage details without the user noticing.
ExamCollecting and carrying off data such as input recorded by another program is also part of what spyware does.
Mix-upSpyware gathers and carries off information, while a bot (ボット) takes part in coordinated attacks and similar actions on outside commands. They behave differently once a device is infected.
A keylogger (キーロガー) is malware that records the characters typed on a keyboard, in order, and lets the attacker obtain that record.
Even input that the screen masks, such as a password, is captured the moment each key is pressed, so it can still be stolen. Countermeasures include on-screen keyboards where you pick characters with the mouse, and one-time passwords that work only once.
How to rememberSplit it into "key" and "logger". A logger keeps a log, and "log" comes from a ship's log book.
Exam points
ExamA keylogger (キーロガー) runs inside the user's device. Once the recorded keystrokes reach the attacker, whatever was typed has been stolen.
ExamA keylogger counts as a kind of malware (マルウェア), the umbrella term for malicious software.
Mix-upShoulder surfing (ショルダーハッキング), peeking at a screen or keystrokes over someone's shoulder, steals with human eyes. It is a different thing from a keylogger, which records keystrokes with a program.
A backdoor (バックドア) is a secret entrance an attacker sets up to get into a system without passing normal authentication.
First break-in succeeds
Plants a back way in
Re-enters without authentication
From then on the attacker skips the normal login and comes and goes through the backdoor again and again.
3 / 3
It is often built by an attacker who has already broken in and wants an easier way back, by planting a program or changing settings. The entrance itself is inconspicuous, so it may be used again and again without anyone noticing.
AnalogyIt is like a burglar who, on the first break-in, cuts a spare key for the back door. After that they can come and go without the front-door key.
How to remember"Back door" means just that. Remember it literally as an entrance that avoids the front door, the normal login.
Exam points
ExamA backdoor (バックドア) is a route left by an intruder to make getting back in easier, bypassing the normal procedure.
ExamPlanting a backdoor and using it to get in without authorization is one form of cyberattack (サイバー攻撃), an attack on information systems over a network.
A RAT (Remote Access Trojan) is malware that lets an attacker control an infected device remotely (遠隔操作).
The attacker sends commands over the network to pull data off the device or make it run any instruction, using it as if it were a machine on their own desk. It is common in targeted attacks (標的型攻撃) that go after a specific organization or person to steal information. As "Trojan" in the name suggests, it typically arrives disguised as a harmless file.
AnalogyIt is like a remote-controlled robot left in someone else's house. Before the owner notices, someone outside can tell it to move around the rooms.
How to rememberRAT also spells the English word for a rat. Picture it moving in and scurrying around the device in secret.
Exam points
ExamIn targeted attacks (標的型攻撃), a RAT is used to control the target device from outside and obtain important information illegitimately.
Mix-upA backdoor (バックドア) is a route for getting in, while a RAT is a program that controls a device once inside. A RAT can also double as a backdoor.
A macro virus (マクロウイルス) is a virus that abuses the macro feature of word processors and spreadsheet programs, hiding in document files and running from there.
A document with macros arrives
The document is opened
The macro runs
Malicious actions and spreading infection
The macro does something malicious and spreads the infection to other documents.
4 / 4
A macro is a small program written into a document to automate repetitive tasks. A macro virus springs into action when a document containing such a macro is opened and the macro runs, infecting other documents or doing something malicious. Because it arrives as a familiar document rather than an executable program, recipients are less likely to be suspicious of it.
AnalogyIt is like an envelope that looks like ordinary paperwork but hides a device that goes off when you open it.
How to rememberAn ordinary virus lives in a program, a macro virus lives in a document. Remember them by where they live.
Exam points
ExamA macro virus (マクロウイルス) infects data files such as documents made with word processors or spreadsheet programs.
ExamA macro virus is set off by the act of opening a document, so opening a document file you received can itself be the way infection gets in.
Fileless malware (ファイルレスマルウェア) is malware that runs through processing in memory and tools that come with the OS, without saving its body to disk as an executable file.
Conventional malware
Fileless malware
Where the body lives
A file on disk
In memory
How it runs
Runs an executable it brought in
Also uses tools built into the OS
Clues for file scanning
Leaves files to scan
Rarely leaves a file to go on
Unlike the conventional kind, which runs a file written to storage, it loads its code into memory and runs it directly. Security software that looks for suspicious files struggles to find it, and its traces tend to vanish when the power goes off, which makes later investigation hard too. That is why file scanning is combined with defenses that watch how programs behave and flag anything abnormal.
AnalogyIt is like a burglar who also uses the tools lying around the house and leaves none of their own behind. With almost nothing left in the house, there is little to go on afterward.
How to remember"-less" means "without", as in paperless and cashless. Here it means without a file.
Exam points
Mix-upFileless malware (ファイルレスマルウェア) easily slips past checks that rely on saved files, which sets it apart from conventional malware (マルウェア) that keeps its body on disk.
Key points
Spyware aims not at destruction but at continually carrying information off without the user noticing.
A backdoor is the back way in that an attacker leaves after one break-in so they can return.
A RAT is a tool for controlling an infected device from outside, used in targeted attacks to steal information.
A macro virus arrives as a document and starts running when the opened document's macro is executed.
Fileless malware leaves no body on disk, so it tends to slip past defenses that scan files.