Lesson 6 - Web Trojan

A voting website has a form containing HTML code shown in the attached image.

What is the main reason which allows this voting website be easily attacked?

• Because the form uses the GET method.

• Because the code does not include an encryption algorithm.

• Maybe the website is not protected by an Antivirus.

• Because the radio button input can be easily modified.

Which of the following descriptions defines a Trojan Horse in the context of computer security?

• A malicious computer program which appears to be a gift, but it actually is a trap.

• A malicious software that when executed can replicates itself by modifying other computer programs and inserting its own code.

• Any attempt to expose, alter, disable, destroy, steal or gain unauthorized access to or make unauthorized use of a digital resource.

• A weakness in a computer system which can be exploited by an attacker, to perform unauthorized actions within the system.

To protect against Web Trojans, which technique is an appropriate approach to be implemented by developers?

• Escaping meta-character

• Ticket system

• HTML encoding

• Regular expression

Web pages with tickets in them cannot be cacheable.

• True

• False

Tickets are needed only for requests that actually change something on the server.

• True

• False

Using Ticket mechanism to secure a system against the Web Trojan, the system might be still vulnerable if the application is vulnerable to Cross-site Scripting.

• True

• False

In a web application protected by ticket mechanism, in case of session timeout, the application should directly throw away the user's input.

• True

• False

Ticket system makes it impossible to accidentally perform a request twice, both for POST and GET, as there will be no valid ticket the second time.

• True

• False