INFORMATION SECURITY AND AUDIT
SOLVED PRACTICE QUESTIONS

MALICIOUS LOGIC 

Malicious logic refers to software or scripts that are intentionally created to cause harm, steal information, or perform unauthorized actions on a system. These can take many forms, including viruses, worms, Trojan horses, spyware, and ransomware.

Example of Malicious Logic: A Trojan Horse

A common example of malicious logic is a Trojan horse. A Trojan horse is a type of malware that disguises itself as a legitimate file or program to trick users into installing it. Once installed, it can perform a variety of malicious actions without the user's consent or knowledge.

Scenario:

Imagine a user receives an email with an attachment claiming to be a free, updated version of a popular software. The user, believing it to be legitimate, downloads and installs the software. However, this software is a Trojan horse.

Example Code:

The provided shell script demonstrates a sequence of commands that can be used to create a potentially malicious situation by escalating privileges and removing a crucial system utility.

cp /bin/sh /tmp/.xyzzy
chmod u+s,o+x /tmp/.xyzzy
rm ./ls
ls $*

Fisrt Line:

This command copies the system shell (/bin/sh) to a hidden file (.xyzzy) in the /tmp directory. Hidden files in Unix systems start with a dot (.).

Second Line:

chmod u+s: This sets the SetUID bit on the copied shell. When the SetUID bit is set on an executable, it runs with the privileges of the file owner (in this case, the root user) rather than the user who is running the executable.

o+x: This makes the hidden shell executable by others.

Third Line:

This command removes the ls command from the current directory, assuming ls is present there. This could be part of a strategy to hide the presence of certain files or directories.

Fourth Line:

This command attempts to run ls with any arguments passed to the script. However, if the previous rm command successfully removed ls from the current directory, this will fail unless ls is available elsewhere in the system’s PATH.