Web Security and Malware Attacks

Web application security requires multiple layered approaches. Input validation prevents injection attacks, security policies provide governance, and removing hidden files reduces information disclosure. All three measures listed (1, 2, and 3) are essential security practices, making option E (all) the comprehensive correct answer.

Cross-Site Scripting (XSS) attacks inject malicious scripts into trusted websites, which are then executed in the victim's browser. Therefore, the primary direct target of an XSS attack is the end user rather than the server or application framework.

CSRF (Cross-Site Request Forgery) requires three key conditions: the attacker must know the target website, the victim must be authenticated to that site, and the victim must be tricked into executing an unwanted action. CSRF does NOT require XSS vulnerability - it exploits the browser's automatic cookie submission mechanism. Options A, B, and C correctly describe these prerequisites, though they contain grammatical errors.

CSRF attacks are known by multiple names in security literature: 'Sea Surf' (play on CSRF), 'Session Riding' (because the attacker rides the victim's valid session), 'Hostile Linking' (malicious links that exploit authentication), and 'One-Click attack' (can be triggered with a single click). All four names refer to the same vulnerability.

CSRF (Cross-Site Request Forgery) and XSS (Cross-Site Scripting) are fundamentally different vulnerabilities. XSS injects malicious scripts that execute in the victim's browser, while CSRF tricks the victim's browser into making unauthorized requests using their existing authentication. CSRF requires no script injection - it exploits the browser's automatic cookie behavior.

Accepting only POST requests is not effective CSRF prevention because CSRF can trigger POST requests via HTML forms. Secret cookies alone don't prevent CSRF because the browser automatically sends cookies with requests. Effective CSRF prevention requires Anti-CSRF tokens (unique, unpredictable, validated by server) or SameSite cookie attributes (restrict cookie cross-site behavior).

The Cheese Worm was an internet worm that specifically targeted Linux systems in 2001. It exploited vulnerabilities in Linux services and was named for its unusual behavior of leaving a 'cheese' marker file. Option B is correct. Blaster worm targeted Windows, Nachi/Welchia was a Windows worm that tried to patch Blaster, and Butter worm is fictional.

The Welchia worm (also called W32/Nachi) was a helpful worm that attempted to patch the Blaster worm vulnerability and clean infected systems. It is also known as the Nachia worm (a variant spelling). Option B is correct. Blaster was the worm it fought, kak worm was an email worm, and 'email worm' is too generic.

The Lion worm was a Unix shellscript worm that specifically targeted Linux servers by exploiting vulnerabilities and spreading through automated scripts. Unlike Kak (a Word macro worm), Tiger (not a known worm), or Looksky (an email worm), Lion was designed to compromise Linux systems through shell scripting techniques.

Looksky, Klez, and Sober are all well-known email worms that propagate through infected email attachments or mass-mailing techniques. Warhol worm was a theoretical worm design concept focused on rapid propagation using a scanning strategy, not email-based distribution.

Samy worm and Bom Sabado are both XSS (Cross-Site Scripting) worms that spread through web applications by injecting malicious JavaScript. Samy worm targeted MySpace, while Bom Sabado affected Orkut. SQL Slammer is a SQL worm targeting database servers, and Sober is an email worm.

The principle of least privilege means granting only the minimum necessary permissions to users. Defining all allowable actions for each role and denying everything else (deny-by-default) implements this principle correctly. Group-based access (A) is an implementation detail, not the principle itself. Consistent authorization checks (B) is important for security but doesn't define least privilege. Logging failed attempts (D) is an auditing practice, not authorization.

Personalized greeting lines (B) are appropriate and professional for promotional emails. Asking users to reply with credentials (A) is a major security red flag and trains users for phishing attacks. Providing 'Click Here' links (C) without clear destination is suspicious and commonly used in phishing. Sending from special domains (D) can appear legitimate but doesn't guarantee security and may trigger spam filters.

Cross-Site Scripting (XSS) attacks specifically target the client's browser by injecting malicious scripts that execute in the victim's browser context. The attack doesn't directly target the database (B), the web application server-side (C), or the web server infrastructure (D) - those are vulnerable to different types of attacks like SQL injection or server-side code execution.