What technique has Michael used to disguise this keylogging software?

Michael is a junior security analyst working for the National Security Agency (NSA) working primarily on breaking terrorist encrypted messages. The NSA has a number of methods they use to decipher encrypted messages including Government Access to Keys (GAK) and inside informants. The NSA holds secret backdoor keys to many of the encryption algorithms used on the Internet. The problem for the NSA, and Michael, is that terrorist organizations are starting to use custom-built algorithms or obscure algorithms purchased from corrupt governments. For this reason, Michael and other security analysts like him have been forced to find different methods of deciphering terrorist messages. One method that Michael thought of using was to hide malicious code inside seemingly harmless programs. Michael first monitors sites and bulletin boards used by known terrorists, and then he is able to glean email addresses to some of these suspected terrorists. Michael then inserts a stealth keylogger into a mapping program file readme.txt and then sends that as an attachment to the terrorist. This keylogger takes screenshots every 2 minutes

and also logs all keyboard activity into a hidden file on the terrorist’s computer. Then, the keylogger emails those files to Michael twice a day with a built in SMTP server. What technique has Michael used to disguise this keylogging software?

Michael is a junior security analyst working for the National Security Agency (NSA) working primarily on breaking terrorist encrypted messages. The NSA has a number of methods they use to decipher encrypted messages including Government Access to Keys (GAK) and inside informants. The NSA holds secret backdoor keys to many of the encryption algorithms used on the Internet. The problem for the NSA, and Michael, is that terrorist organizations are starting to use custom-built algorithms or obscure algorithms purchased from corrupt governments. For this reason, Michael and other security analysts like him have been forced to find different methods of deciphering terrorist messages. One method that Michael thought of using was to hide malicious code inside seemingly harmless programs. Michael first monitors sites and bulletin boards used by known terrorists, and then he is able to glean email addresses to some of these suspected terrorists. Michael then inserts a stealth keylogger into a mapping program file readme.txt and then sends that as an attachment to the terrorist. This keylogger takes screenshots every 2 minutes

and also logs all keyboard activity into a hidden file on the terrorist’s computer. Then, the keylogger emails those files to Michael twice a day with a built in SMTP server. What technique has Michael used to disguise this keylogging software?

A.
Steganography

B.
Wrapping

C.
ADS

D.
Hidden Channels

Show Hint

Leave a Reply 2

Your email address will not be published. Required fields are marked *

Anonymous

Anonymous

A more accurate answer would be that this describes a trojan. Steganography or “concealed writing” is not what is described here. Stego is not used for hiding programs (malcode) as described in this scenario. ADS would be the closest of these choices since you can attach a program hidden behind what looks like a standard file…but this question still most closely resembles a trojan.

Reply

Fahad

Fahad

ADS is for sure not the answer, since ADS is not usually copied or transferred with the file. And it is something the OS will keep locally for that file, once you move the file to another system that ADS is gone.

I believe the answer is a mix between stego and wrapping!

Reply