Friday 3 April 2020


Rootkit and Keyloggers


A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the existence of other software.

The highest management level of windows operating system is administrator, similarly in Linux OS, it is called root. Rootkit is a set of software that can modify the kernel of the OS,

 
Rootkit works at the lowest level and hence it’s very difficult to detect it. It is not visible in task bar and we cannot find it in task bar because it does not run as a part of operating system, so it becomes difficult for the antivirus to detect it.

 
The attacker always tries to send software and merge it with rootkit. So it’s impossible to remove it even after you detect it because it will not allow you to remove it.

 



                          






Types of Rootkit:


User mode rootkit:

User mode rootkit attacks at the user level or the upper level – OS model. Since it works on the upper level, it will target software and other softwares or files like word, notepad etc.

Kernel Mode Rootkit:

Such software is used to target core setting of kernel model. From such software, attacker can change the registry setting and more in your computer. It is difficult to identify and handle the software because it is not a part of the OS, and difficult to detect by the antivirus.


Boot loader Rootkit:

This software affects the boot sector of computer. It affects MBR (Master boot record) or VBR (volume boot record). MBR is at the very beginning of partitioned computer mass storage devices like fixed disks or removable drives.
 

Memory rootkit:

Memory rootkit affects the RAM of your machine. As a result, it slows down the machine, consumes more memory and due to this, the other memory gets very less memory for execution and ultimately, the machine gets very slow.

Firmware rootkit:

First we need to understand firmware, then only we can understand Firmware rootkit.
Firmware is a computer program that is "embedded" in a hardware device and is an essential part of the hardware. In computing, firmware is a specific class of computer software that provides the low-level control for a device's specific hardware. Firmware can either provide a standardized operating environment for more complex device software (allowing more hardware-independence), or, for less complex devices, act as the device's complete operating system, performing all control, monitoring and data manipulation functions. So if someone affects firmware, then whole system of a machine will get affected.

 Firmware rootkit affects router, network card, hard drive and bios (Basic Input output system) . It’s difficult to find it and remove it because firmware is not usually inspected for code integrity, and the rootkit takes advantage out of it.


Virtual Rootkit

The rootkit designed for virtual machine is called Virtual Rootkit

How to remove Rootkit:

It’s very difficult to remove rootkit. Sometimes we need separate software to remove it. Nowadays, advance antivirus or anti-malware tools are also capable to remove rootkit.


Keyloggers


Keyloggers is a computer program that records every keystroke made by a computer user, especially, in order to gain fraudulent access to passwords and other confidential information. When you type anything it records everything. No matter what happens, it even records the space bar or the back space.

A keylogger can be either software or hardware.

Software keylogger:

Software Keylogger works in background and is difficult to notice by a normal user. In the background, it records everything. Software-based keyloggers are computer programs designed to work on the target computer's software.

Keyloggers has its uses as well, as many software and operating systems use it for trouble shooting for computer and network. Even Windows 10 OS uses keyloggers to improve typing performance.

Hardware keylogger:

These are the hardware independent of any software; it can be added externally like a pen drive which will capture all the activity in the computer.

Hardware Keylogger has two main parts:

The Micro controller interprets the key inputs and processes it for storage.

Memory: It uses non-volatile memory like flash memory to store the data irrespective of availability of power.

How to protect your machine from these:

1. We can use anti-keylogger software to protect our machine. This software work on          Signature-based or heuristic analysis.

2.We can set firewall rules to track what files are transferred from the computer and accordingly, we can make rules for that.

3.These days we are using advance antivirus (EDR (Endpoint Detection and Response) and XDR (Extended Detection and Response), which work on machine learning. Such antivirus can be very useful to protect computer from Rootkit and Keyloggers.

Example of a few Keyloggers

Revealer Keylogger Free

Ardamax Keylogger


Wednesday 1 April 2020

Chapter 1

Computer Fundamentals


A) Name at least four early calculating devices.

Answer:
Abacus
Napier’s Logs and Bones
Pascaline
Leibnitz’s Calculator

B) Name the first operational general purpose computer.


Answer:
Mark 1  

C) Who first proposed the concept of ‘Stored Program Computer’?


Answer:
In 1945, Dr. John Von Neumann proposed the concept of a stored program computer.
As per this concept the program and data could be stored in the same memory unit


D) Define the IPO cycle.


Answer:
Every task given to a computer follows an Input- Process- Output Cycle (IPO cycle). It
needs certain input, processes that input and produces the desired output. The input
unit takes the input, the central processing unit does the processing of data and the
output unit produces the output. The memory unit holds the data and instructions
during the processing.


E) Differentiate between data and information.


Answer:
Data: It is the term used for raw facts and figures. For example, 134, + 9, ‘Raju’, ‘C’ are
data. Definition of information should start from next line as given in the word file. In
composed file it is starting from the same line immediately after the definition of data.

Information: Data represented in useful and meaningful form is information. In simple
words we can say that data is the raw material that is processed to give meaningful,
ordered or structured information. For example Raju is 9 years old. This is information
about Raju and conveys some meaning. This conversion of data to information is called
data processing.


F) Explain the Von Neumann Computer.


Answer:
In 1945, Dr. John Von Neumann proposed the concept of a stored program computer.
As per this concept the program and data could be stored in the same memory unit. The
basic architecture of the Von Neumann computer is shown in the figure below

Digram :

                       


According to Von Neumann architecture, the processor executes instructions stored in
the memory of the computer. Since there is only one communication channel, the
processor at a time can either fetch data or an instruction. That means at one point of
time either the data or an instruction can be picked (fetched) from the storage unit for
execution by the processor. Hence execution takes place in sequential manner. This
limitation of Von Neumann Computer is known as Von Neumann bottleneck. EDVAC
(Electronic Discrete Variable Automatic Computer) was the first stored program
computer developed in 1952.


G) Compare the salient features of first and second generation computers.


Answer:
Salient features of First generation computers:
Used vacuum tubes to control and amplify electronic signals
Huge computers that occupied lot of space (ENIAC weighed about 27 tons, was of the size 8 feet * 100 feet * 3 feet )
High electricity consumption (consumed around 150 watts of power) and high heat generation
Were unreliable since they were prone to frequent hardware failures
Commercial production was difficult
They were very costly and required constant maintenance
Continuous air conditioning was required
Programming was done in machine language although assembly language also
started at the end of this generation Example : ENIAC , EDVAC , UNIVAC 1


Salient Features of Second generation computers:
Use transistor based technology
Were smaller and less expensive as compared to first generation
Consumed less electricity and emitted less heat
Magnetic core memories and magnetic disks were used as primary and
secondary storage respectively
First operating system developed
Programming in assembly language and in the later part high level languages
were used
Wider commercial use but commercial production was still difficult
They also required constant air-conditioning.
Examples: IBM 1401, IBM 1620, UNIVAC 1108

H) Why is Charles Babbage known as the Father of Modern Computers?


Answer:
In 1833 Charles Babbage designed the Analytical Engine which later on proved to be the
basis of modern computer. His machine called basis of modern computer due to below features.

1. This machine could perform all the four arithmetic operations as well as comparison
2. It included the concept of central processor, memory storage and input-output devices.
3. Stored information could be modified.


I) Explain the functional components of a computer with the help of a block diagram.


Answer:



Input Unit
The input unit consists of input devices that are attached to the computer. These devices
take input and convert it into binary language that the computer understands. Some of
the common input devices are keyboard, mouse, joystick, scanner etc.

Central Processing Unit (CPU)
Once the information is entered into the computer by the input device, the processor
processes it. The CPU is called the brain of the computer because it is the control centre
of the computer. As the CPU is located on a small chip, it is also called the
microprocessor.

 It first fetches instructions from memory and then interprets them so as
to know what is to be done. If required, data is fetched from memory or input device.
Thereafter CPU executes or performs the required computation and then either stores
the output or displays on the output device.

The CPU has three main components which are responsible for different functions – 1. 1. Arithmetic Logic Unit (ALU) ,
2. Control
3. Unit (CU) and Memory registers.
Arithmetic and Logic Unit (ALU)

The ALU, as its name suggests performs mathematical calculations and takes logical
decisions. Arithmetic calculations include addition, subtraction, multiplication and
division.

Logical decisions involve comparison of two data items to see which one is
larger or smaller or equal.

Control Unit
The Control unit coordinates and controls the data flow in and out of CPU and also
controls all the operations of ALU, memory registers and also input/output units.
It is also responsible for carrying out all the instructions stored in the program. It decodes the fetched instruction, interprets (understands) it and sends control signals to
input/output devices until the required operation is done properly by ALU and
memory.

Memory Registers
A register is a temporary unit of memory in the CPU. These receive data/information
and then this data/information is held in them as per the requirement. Registers can be
of different sizes(16 bit , 32 bit , 64 bit and so on) and each register inside the CPU has a
1 4
specific function like storing data, storing an instruction, storing address of a location in
memory etc. The user registers can be used by an assembly language programmer for
storing operands, intermediate results etc. Accumulator (ACC) is the main register in
the ALU and contains one of the operands of an operation to be performed in the ALU.

Memory
Memory attached to the CPU is used for storage of data and instructions and is called
internal memory.
During processing, it is the internal memory that holds the data.
 The internal memory is divided into many storage locations, each of which can store data or instructions. Each memory location is of the same size and has an address. With the help of the address, the computer can find any data easily without having to search the entire memory.

The internal memory is also called the Primary memory or Main
memory. When the task is performed, the CU makes the space available for storing data
and instructions, thereafter the memory is cleared and the memory space is then
available for the next task. Therefore this memory is also called Random Access memory (RAM).

Primary memory is volatile in nature. That means when the power is switched off, the data stored in this memory is permanently erased. That is why secondary memory is needed to store data and information permanently for later use. Some of the examples of secondary storage devices are hard disk, compact disks, pen drives etc.


Output Unit
The output unit consists of output devices that are attached with the computer. It
converts the binary data coming from CPU to human understandable from. The
common output devices are monitor, printer, plotter etc.

J) What are the functions of the control unit?


Answer:
Control Unit

The Control unit coordinates and controls the data flow in and out of CPU and also
controls all the operations of ALU, memory registers and also input/output units.

 It is also responsible for carrying out all the instructions stored in the program.

It decodes the fetched instruction, interprets (understands) it .

It sends control signals to input/output devices until the required operation is done properly by ALU and



K) Where are the instructions needed to start a computer stored?


Answer:
I will answer this later.

L) Explain booting process and its types.


Answer:
When the computer is switched on, a copy of boot program is brought from ROM into
the main memory. This process is called booting. When the computer is switched on, a copy of boot program is brought from ROM into the main memory. This process is called booting.


The CPU first runs a jump instruction
that transfers to BIOS (Basic Input output System) and it starts executing. The BIOS
conducts a series of self diagnostic tests called POST (Power On Self Test). These tests
include memory tests, configuring and starting video circuitry, configuring the system’s
hardware and checking other devices that help to function the computer properly.


BIOS locates a bootable drive to load the boot sector. The execution is
then transferred to the Boot Strap Loader program on the boot sector which loads and
executes the operating system. If the boot sector is on the hard drive then it will have a
Master Boot record (MBR) which checks the partition table for active partition. If found,
the MBR loads that partition’s boot sector and executes it.

Cold Booting: When the system starts from initial state i.e. it is switched on, we call it
cold booting or Hard Booting. When the user presses the Power button, the instructions
are read from the ROM to initiate the booting process.
Warm Booting: When the system restarts or when Reset button is pressed, we call it
Warm Booting or Soft Booting. The system does not start from initial state and so all
diagnostic tests need not be carried out in this case. There are chances of data loss and
system damage as the data might not have been stored properly.



M) Differentiate between:
i) Digital computers and analog computers.


Answer:
Digital computers
Analog computers.
These computers are capable of processing information in discrete form
A computer which uses the continuous signal for its operation is called an Analog computer.
data which can be in the form of letters, symbols or numbers is represented
in binary form i.e. 0s and 1s.
These
computers measure changes in continuous physical quantities say current and voltage.
It computes by counting and
Adding operations.
it is used to process data generated by changing physical quantities especially when the response to change is fast.
It work fast
It is slow
More accurate
Less accurate
The digital computers are used in industrial, business and scientific
Applications. They are quite suitable for large volume data processing.
Some of the common examples where Analog computers are used simulations in aircrafts, nuclear power plants, hydraulic and electronic networks.


ii) Microcomputers and Mini Computers


Answer:
Microcomputers
Mini Computers
These are also known as Personal Computers. Ex desktops and laptops.
These computers can support multiple users working simultaneously on the same
Machine.
These computers can work on small volume of data, are very versatile and can handle variety
of applications.
These are mainly used in an organization where computers installed in
Various departments are interconnected.
Consists of one processor.
Generally consists of multiprocessors.
Inexpensive and easy to use.
It can handle a huge amount of data.