CompTIA A+ Certification All-in-One Exam Guide

EXAM TIP Know the various types of malware, including viruses, worms,
Trojan horses, rootkits, spyware, and ransomware.
A Bot on the Net Full of Zombies Another type of malware I want to talk
about is the botnet (“bot” as in robot, get it!). A botnet, as “net” in its name
implies, isn’t a single type of malware, but a network of infected computers
(zombies) under the control of a single person or group, with sizes easily
growing into the millions of zombies for the largest networks.
With that many machines under their control, botnet operators have
command of massive computing and network resources. One of the most
common uses of botnets is sending spam. If you’ve ever wondered how
spammers pay for all that bandwidth, they don’t! They use the bandwidth of
millions of zombie machines spread all around the world, from grandma’s e-
mail machine to hacked Web servers.
Spam is but one use of a botnet. The criminals who run these networks
also use all that collective power to attack companies and governments and
demand a ransom to call off the attack.
Attack Methods and Sources
As bad as all this malware is, it doesn’t seep onto a computer via osmosis; it
needs what security people call an attack vector—the route the malware takes
to get into and infect the system. As a good CompTIA A+ tech, you need to
know where the vulnerabilities lie so you can make sure your computers are
protected.
As with everything else in computing, there are multiple ways to try and
get malware into a system, everything from the first floppy boot sector virus
all the way up to modern Internet worms and drive-by downloads.
Zero-Day Attacks A zero-day attack is an attack on a vulnerability that
wasn’t already known to the software developers. It gets the name because
the developer of the flawed software has had zero days to fix the
vulnerability. Microsoft, Apple, and other software developers regularly post
patches to fix flaws as they’re discovered.
Spoofing Spoofing is the process of pretending to be someone or something
you are not by placing false information into your packets. Any data sent on a