Disclaimer:
Educational Use Only:
The website links provided are to be used strictly for educational and knowledge-gaining purposes only.
No Misuse:
Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.
Respect for Websites and Businesses:
Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.
Acknowledge Value of Knowledge:
Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.
No Endorsement:
The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.
User Responsibility:
By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.
- What is the term for malware that uses cryptography to extort victims by encrypting their data?
a. Rootkit
b. Cryptovirology
c. Botnet
d. Spyware
Answer: b. Cryptovirology — cryptovirology is the study and practice of using cryptographic tools in malicious software, such as extortion via encryption. (arXiv) - Ransomware is an example of which broader class of malware?
a. Logic bomb
b. Adware
c. Cryptomalware
d. Keylogger
Answer: c. Cryptomalware — ransomware is a class of cryptomalware, since it encrypts victim files and demands ransom. (Wikipedia) - In a typical cryptoviral extortion attack, what cryptographic technique is used to encrypt the victim’s symmetric key?
a. Symmetric key encryption
b. Hashing
c. Asymmetric (public key) encryption
d. Steganography
Answer: c. Asymmetric (public key) encryption — the attacker embeds a public key in the malware to encrypt the symmetric key, making decryption impossible without the private key. (Wikipedia) - Which of these is the correct order of steps in a cryptoviral extortion scheme?
a. Attacker sends private key → victim encrypts → victim pays
b. Attacker generates key pair → victim encrypts → attacker decrypts
c. Victim generates key pair → attacker encrypts → victim decrypts
d. Attacker downloads victim files → attacker holds them
Answer: b. Attacker generates key pair → victim encrypts → attacker decrypts — the attacker’s public key is embedded, victim’s data is encrypted with a symmetric key, and that symmetric key is encrypted with the attacker’s public key and sent back for decryption. (Wikipedia) - What is a feature of cryptomalware that distinguishes it from ordinary malware?
a. It replicates itself
b. It uses lightweight code
c. It encrypts data for extortion
d. It only attacks network devices
Answer: c. It encrypts data for extortion — cryptomalware’s defining trait is encryption of victim data as part of an extortion demand. (arXiv) - Which cryptocurrency is most commonly used to receive ransom payments in ransomware attacks?
a. Litecoin
b. Monero
c. Bitcoin
d. Ripple
Answer: c. Bitcoin — due to its anonymity and wide acceptance, Bitcoin is common for ransom payments. (Wikipedia) - What is “Ransomware-as-a-Service” (RaaS)?
a. A legitimate backup service
b. A tool for decryption
c. A business model where ransomware is offered to actors
d. A security framework
Answer: c. A business model where ransomware is offered to actors — RaaS allows less technical attackers to deploy ransomware by renting the infrastructure. (Wikipedia) - Which of these is a defense measure against cryptomalware?
a. Disabling firewalls
b. Maintaining offline backups
c. Removing all encryption tools
d. Using default passwords
Answer: b. Maintaining offline backups — offline, immutable backups allow recovery without paying ransom. (Wikipedia) - What is a “double extortion” ransomware attack?
a. Encrypting data twice
b. Encrypting data and threatening to publish it
c. Demanding twice the ransom
d. Targeting two systems simultaneously
Answer: b. Encrypting data and threatening to publish it — attackers both encrypt data and steal it, threatening disclosure. (Implied in modern ransomware evolutions) (Wikipedia) - Which historical malware is considered among the first extortion trojans?
a. CryptoLocker
b. WannaCry
c. AIDS Trojan
d. Stuxnet
Answer: c. AIDS Trojan — the 1989 AIDS Trojan (PC Cyborg) is often cited as the first known extortion malware. (Wikipedia) - What role does symmetric encryption play in ransomware?
a. Encrypts the victim’s entire data
b. Encrypts the attacker’s ransom demand
c. Used only in command control
d. Doesn’t play a role
Answer: a. Encrypts the victim’s entire data — ransomware typically uses a fast symmetric cipher to encrypt files and then uses asymmetric encryption to protect the symmetric key. (Wikipedia) - Why do cryptomalware authors use hybrid encryption (symmetric + asymmetric)?
a. For speed and security
b. Because asymmetric alone is faster
c. Because symmetric is insecure
d. To avoid needing keys
Answer: a. For speed and security — symmetric is fast for bulk encryption; asymmetric secures the symmetric key for transfer. (Wikipedia) - What is “key zeroization” in the context of cryptomalware?
a. Wiping the public key
b. Wiping the symmetric key after encryption
c. Resetting user passwords
d. Deleting encrypted files
Answer: b. Wiping the symmetric key after encryption — malware often erases the plaintext symmetric key after use so the victim can’t recover data without paying. (Wikipedia) - Which of these behavior-based detections is useful against cryptomalware?
a. Signature matching
b. File entropy increase
c. Port scanning
d. DNS resolution
Answer: b. File entropy increase — cryptomalware tends to increase randomness (entropy) in file contents (i.e. encryption), which anomaly detectors can detect. (arXiv) - Malware using TLS channels complicates detection by obscuring traffic. What technique can still help detect it?
a. Deep packet inspection
b. Observable TLS features (fingerprinting)
c. Plaintext analysis
d. Removing encryption
Answer: b. Observable TLS features (fingerprinting) — differences in TLS behavior (ciphers, certificate use) can distinguish malware traffic. (arXiv) - What is a limitation of signature-based antivirus against cryptomalware?
a. It is too slow
b. It can’t detect zero-day or new variants
c. It requires symmetric keys
d. It over-encrypts files
Answer: b. It can’t detect zero-day or new variants — signature-based methods rely on known patterns. (arXiv) - Which cryptographic primitive, if broken, would most directly undermine ransomware’s effectiveness?
a. Hash functions
b. Stream ciphers
c. Public-key cryptography
d. Random number generators
Answer: c. Public-key cryptography — if the asymmetric scheme is broken, the attacker’s private key can be recovered and all victims could decrypt without paying. (Wikipedia) - Why might a cryptomalware author choose Elliptic Curve Cryptography (ECC) over RSA?
a. ECC is slower
b. ECC gives smaller keys with comparable strength
c. ECC is weaker
d. ECC is harder to implement
Answer: b. ECC gives smaller keys with comparable strength — thus reducing payload size and computational cost. (A property of ECC vs RSA) - What is a “decryptor stub” in ransomware?
a. Code to partially decrypt files
b. Code included to help victim decrypt after payment
c. Code to delete backups
d. Code to spread malware
Answer: b. Code included to help victim decrypt after payment — many ransomware include a stub or client component to handle decryption. - If a victim refuses to pay, some ransomware include a “deadline timer.” What is its purpose?
a. To automatically decrypt files
b. To increase ransom over time or delete data
c. To turn off the computer
d. To notify law enforcement
Answer: b. To increase ransom over time or delete data — deadline timers incentivize victims to pay quickly. - Which one is a form of “crypto-locker” style malware?
a. Keylogger
b. CryptoLocker
c. WannaCry
d. Zeus
Answer: b. CryptoLocker — a famous ransomware that encrypted files and demanded Bitcoin payments. (Wikipedia) - In ransomware, what is often the first vector of infection?
a. Phishing email attachment
b. Direct SSH attack
c. Physical access
d. DNS hijack
Answer: a. Phishing email attachment — common method of delivering ransomware as a trojan disguised file. (Wikipedia) - Why do attackers sometimes remove Volume Shadow Copies in Windows during ransomware execution?
a. To speed up encryption
b. To force reliance on the ransom for recovery
c. To reduce file size
d. To help victims recover
Answer: b. To force reliance on the ransom for recovery — by deleting backups, victims can’t easily restore files themselves. (Wikipedia) - Which of these is a limitation in recovering files without paying ransom?
a. Weak encryption
b. Leaked decryption keys
c. Strong cryptography
d. Existence of backups
Answer: c. Strong cryptography — if encryption is properly implemented, decryption without the key is computationally infeasible. (Wikipedia) - The “No More Ransom” initiative aims to help victims do what?
a. Prevent attacks
b. Pay ransom safely
c. Recover files without paying
d. Trace attackers
Answer: c. Recover files without paying — the initiative offers free decryption tools and support. (Wikipedia) - Which of these is a countermeasure to reduce impact of cryptomalware in an enterprise?
a. Disabling updates
b. Least privilege access
c. Using same passwords everywhere
d. Sharing credentials
Answer: b. Least privilege access — limits malware’s reach and damage. - What is a “sandbox” used for in malware defense?
a. Encrypting files
b. Isolating and analyzing suspicious programs
c. Spreading malware
d. Hosting command servers
Answer: b. Isolating and analyzing suspicious programs — sandboxes allow dynamic analysis safely. - Which operational tactic helps defenders detect ransomware early?
a. Turning off logging
b. Monitoring unusual file I/O and encryption rates
c. Allowing all traffic
d. Disabling alerts
Answer: b. Monitoring unusual file I/O and encryption rates — ransomware often shows abnormal file access and write patterns. - What does “bleichenbacher attack” threaten in cryptography?
a. Hash collision
b. Side-channel timing attacks on RSA decryption
c. Key exchange
d. Symmetric encryption
Answer: b. Side-channel timing attacks on RSA decryption — relevant to cryptographic schemes’ robustness, potentially undermining security. - Which term describes malware that conceals its presence and avoids detection?
a. Ransomware
b. Polymorphic malware
c. Stealth/obfuscated malware
d. Worm
Answer: c. Stealth/obfuscated malware — obfuscation or stealth techniques help avoid detection, often used with cryptomalware. - Why might malware authors randomize filenames and file extensions after encryption?
a. To confuse users
b. To evade detection
c. To speed encryption
d. To allow manual recovery
Answer: b. To evade detection — randomizing names/extentions can avoid signature and heuristic detection. - What is a “kill switch” in ransomware like WannaCry?
a. A feature to instantly encrypt data
b. A mechanism that stops the malware if a condition is met
c. A backup recovery tool
d. A password reset tool
Answer: b. A mechanism that stops the malware if a condition is met — WannaCry had a domain-based kill switch. - Which cyber law or regulation might criminalize ransom payments or ransomware deployment?
a. GDPR
b. DMCA
c. Computer Fraud and Abuse Act
d. DMZ
Answer: c. Computer Fraud and Abuse Act — it criminalizes unauthorized access, extortion, etc., which covers ransomware operations. - In cryptovirology theory, what is an “originator-concealing attack”?
a. Attack that reveals attacker
b. Attack that hides the originator’s identity
c. Attack that uses visible signatures
d. Attack that uses weak crypto
Answer: b. Attack that hides the originator’s identity — cryptovirology aims to ensure the attacker cannot be provably traced. (arXiv) - What is the risk of giving attackers the decryption key after payment?
a. They will decrypt too fast
b. They may reuse the key to extort again
c. They lose reputation
d. They switch to better crypto
Answer: b. They may reuse the key to extort again — or use it for future attacks. - What is “crypto-ransomware” sometimes used synonymously with?
a. Spyware
b. Keylogger
c. Ransomware
d. Worm
Answer: c. Ransomware — “crypto-ransomware” is used to emphasize the encryption-based extortion. - How can network segmentation help against cryptomalware?
a. By making all systems joined
b. By limiting spread of malware across segments
c. By disabling firewalls
d. By allowing unrestricted access
Answer: b. By limiting spread of malware across segments — segmentation isolates damage. - Which of these metrics could an anomaly-based detector use to spot cryptomalware?
a. Packet count only
b. CPU usage only
c. Sudden large file writes and high CPU during encryption
d. Disk idle times only
Answer: c. Sudden large file writes and high CPU during encryption — typical indicators of cryptomalware activity - Why is proper key management critical even in legitimate encryption systems?
a. To allow attackers in
b. To prevent misuse or key leakage
c. To slow encryption
d. To confuse users
Answer: b. To prevent misuse or key leakage — similar principles apply: weak key handling undermines security - What is “fileless” cryptomalware?
a. Malware that doesn’t encrypt
b. Malware that resides only in memory without writing to disk
c. Malware stored in files
d. Malware that uses only rootkits
Answer: b. Malware that resides only in memory without writing to disk — making detection harder - What role do domain generation algorithms (DGAs) play in ransomware?
a. Generating encryption keys
b. Generating numerous domains for C2 contact
c. Deleting files
d. Encrypting ransomware code
Answer: b. Generating numerous domains for C2 contact — helps malware resilience and evasion - What is “blinding” in cryptography context relevant to cryptomalware?
a. Obscuring user interface
b. A technique to prevent side-channel analysis
c. Encrypting files twice
d. Removing encryption
Answer: b. A technique to prevent side-channel analysis — sometimes used to harden cryptographic operations - Which kind of attack involves using one known encrypted file and plaintext pair to help decrypt other files?
a. Brute force
b. Known-plaintext attack
c. Chosen ciphertext
d. Replay attack
Answer: b. Known-plaintext attack — occasionally used against weak ransomware schemes. - Why would attackers embed anti-debugging or anti-analysis code in cryptomalware?
a. To slow execution
b. To make reverse engineering harder
c. To help defenders
d. To raise ransom
Answer: b. To make reverse engineering harder — hamper forensic or reverse analysis - If a ransomware strain mistakenly used the same symmetric key across multiple victims, what risk emerges?
a. Keys never break
b. Attackers lose control
c. Decryption tool can work for all victims
d. Payment increases
Answer: c. Decryption tool can work for all victims — a design flaw enabling mass recovery - What is “cryptojacking” and how does it differ from cryptomalware?
a. Theft of cryptographic keys
b. Using victim’s CPU to mine cryptocurrency, not encrypt data
c. Malware that encrypts files
d. Malware that hijacks keys
Answer: b. Using victim’s CPU to mine cryptocurrency, not encrypt data — cryptojacking doesn’t extort by encryption. - Which factor makes tracing ransom payments challenging?
a. Use of fiat currency
b. Use of cryptocurrencies with anonymity
c. Use of credit cards
d. Use of checks
Answer: b. Use of cryptocurrencies with anonymity — e.g. Bitcoin, Monero. - How can timely patching reduce risk of cryptomalware?
a. It slows CPU
b. It closes known vulnerabilities used for initial access
c. It disables encryption
d. It increases file size
Answer: b. It closes known vulnerabilities used for initial access — reduces attack surface - What is a “cold backup” in ransomware mitigation?
a. Backup on same system
b. Backup connected live
c. Offline, disconnected backup
d. Backup in memory
Answer: c. Offline, disconnected backup — immune to ransomware access - Why is user education critical in preventing cryptomalware attacks?
a. Users write malware
b. Users choose encryption algorithms
c. Many attacks start via phishing and user action
d. Users manage private keys
Answer: c. Many attacks start via phishing and user action — training reduces click-through to malicious attachments
