Embed Size (px)
Citation preview
Malware and malicious programs blog.ahasayen.com /malware-and-malicious-programs/
Ammar Hasayen
Google+
Blogger
Tumblr
Print Friendly
In this blog post, we will be talking about malware, malicious programs or code, and viruses. It is become confusingwhen to use what word to describe those bad programs that cause damage to our computers and networks. We willstart step at a time, and guide you through couple of examples, to reach a good definition and meaning to such ofthose bad programs.
Why should I care in the first place to know those stuff??Why it is a good practice to know these terms and distinguish between them, someone may ask? Well, if you knowthat you get infected by a worm, then you should panic more than if you get hit by a virus, because of the speed ofspread. It is also nice to read in the news about one of those terms and say “OH, I know what this means!”.
Another important thing is that when you purchase an antivirus software, that you check with the supplier what kindof malware it can detect. Sometimes, those antivirus software will protect you against some, but not all of those badguys. So pay attention!
You will hear a lot about vulnerability and Exploit
Funny thing about software: it’s written by humans. Humans are fallible and sometimes they do mistakes.Sometimes those mistakes create strange behaviors in programs. And sometimes that strange behavior can be usedto create a hole that malware or hackers could use to get into your machine more easily. That hole is otherwiseknown as a vulnerability.
The strange behavior that can be used to create a hole for hackers or malware to get through, generally requiressomeone to use a particular sequence of actions or text to cause the right (or is that wrong?) conditions. To beusable by malware (or on a larger scale by hackers), it needs to be put into code form, which is also called exploitcode.
It is all Malware
The word malware is a combination of two words “malicious” and “software”. Malware is the big umbrella term. Itcovers viruses, worms, Trojans, and even exploit code. But not vulnerabilities or buggy code, or products whosebusiness practices you don’t necessarily agree with.
1/6
The difference between malware and vulnerabilities is like the difference between something and the absence ofsomething. Yeah, okay, that’s a bit confusing. What I mean is, malware is something. You can see it, interact with it,and analyze it. A vulnerability is a weakness in innocent software that a something (like malware or a hacker) can gothrough.
Some kinds of malicious code or malware can be considered Denial of Service DoS attacks, because usually they donasty stuff to your files or consume your bandwidth, memory or disks pace, and prevent you from using manyresources.
Sometimes you’ll hear the term “rootkit” or “bootkit” used to describe a certain type of malware. Generally, thisrefers to methods that the malware uses to hide itself deep inside the inner workings of Windows so as to avoiddetection.
Malware delivery methodsWe have identified malware as the umbrella term. This is a big catchall phrase that covers all sorts of software withnasty intent. Now, we will talk about how malware will reach you through one of its delivery methods.
Virus: Breaks Stuff
[Key thing to remember – They need the first click from the user]
It is a type of malicious code or malware and it is nothing but a piece of code that is designed to render your PCcompletely inoperable, while others simply delete or corrupt your files—the general point is that a virus is designedto cause havoc and break stuff. Often viruses are disguised as games, images, email attachments, website URLs,shared files or links or files in instant messages.
Spread
Viruses can spread sometimes to other machines, but usually it spread slowly and most of the time, rely on the userto transfer the infected file. You can have viruses in your computer but they are setting there doing nothing until youclick on the executable they attach themselves to. So it needs a human action and they don’t propagate bythemselves. Infected USB drives are famous way of moving the virus around.
An interesting type of viruses are macros. A macro is a piece of code that can be embedded in a data file. In mostrespects, macro viruses are like all other viruses. The main difference is that they are attached to data files (i.e.,documents) rather than executable programs.
Effect
It infects files and programs and usually destroy files and can also interfere with computer operations by multiplyingitself to fill up disk space or randomly access memory space, secretly infecting your computer.
Worm: Copy Themselves with massive effect
[Key thing to remember – They don’t need the first user click or any action. They can propagate by their ownusing your network]
Some consider them sub class of viruses but the key difference is that they don’t need the first user click or anyaction. They can propagate by their own.
It is called warm because they can move around by their own. You can think of them as viruses that are self-
2/6
contained and go around searching out other machines to infect.
Effect
Due to the copying nature of a worm and its capability to travel across networks, the end result in most cases is thatthe worm consumes too much system memory (or network bandwidth), causing Web servers, network servers andindividual computers to stop responding.
Examples
Some of the most famous worms include the ILOVEYOU worm, transmitted as an email attachment, which costbusinesses upwards of 5.5 billion dollars in damage. The Code Red worm defaced 359,000 web sites, SQLSlammer slowed down the entire internet for a brief period of time (75000 infections in the first 10 minutes !), and theBlaster worm would force your PC to reboot repeatedly.
Spread
Worms are standalone malicious software and do not require a host program or human help to propagate. It alsouses a vulnerability or social engineering to trick the user into spreading them.
Worm rely on network to spread. One example would be for a worm to send a copy of itself to everyone listed in youre-mail address book. Then, the worm replicates and sends itself out to everyone listed in each of the receiver’saddress book, and the manifest continues on down the line.
Trojans Horses: Install a Backdoor
In simple words, it is a malicious software that you thought was going to be one thing, but turns out to be somethingbad.
Do you remember that story you had to read in high school about the big wooden horse that turned out to be full ofguys with spears? This is the computer equivalent.
3/6
Malware actionsWe talked about how malicious programs and malware will reach you [Delivery Methods]. In this part, we will talkabout some of the actions that malware will do once you get infected. This is by far the most interesting part.
Spyware: Steals Your Information
It is malicious computer program that does exactly what its name implies -i.e., spies on you. After downloading itselfonto your computer either through an email you opened, website you visited or a program you downloaded, spywarescans your hard drive for personal information and your internet browsing habits.
Some spyware programs contain keyloggers that will record personal data you enter in to websites, such as yourlogon usernames and passwords, email addresses, browsing history, online buying habits, your computer’shardware and software configurations, your name, age and sex, as well as sensitive banking and credit information.
Some spyware can interfere with your computer’s system settings, which can result in a slower internet connection.Since spyware is primarily meant to make money at your expense, it doesn’t usually kill your PC—in fact, manypeople have spyware running without even realizing it, but generally those that have one spyware applicationinstalled also have a dozen more. Once you’ve got that many pieces of software spying on you, your PC is going tobecome slow.
Some spyware programs will even enhance your system security, and patch your system. They will even detect ifthere are other malicious code and malware on your device and stop them. They want you to continue working onyour machine smoothly so that they can continue spying on you. Interesting right?!
Scareware: Holds Your PC for Ransom !!
Sometime it is called Ransomware. Lately a very popular way for Internet criminals to make money. This maliciouscode or malware alters your system in such a way that you’re unable to get into it normally. It will then display somekind of screen that demands some form of payment to have the computer unlocked. Access to your computer isliterally ransomed by the cyber-criminal.
Sometime the user is tricked into downloading what appears to be an antivirus application, which then proceeds totell you that your PC is infected with hundreds of viruses, and can only be cleaned if you pay for a full license. Of
4/6
course, these scareware applications are nothing more than malware that hold your PC hostage until you pay theransom—in most cases, you can’t or even use the PC.
Ransomware can be lock screen type (locks your computer until you pay), or encryption type, which will encryptyour files with a password until you pay.
The most famous malware of this type is the “FBI MoneyPak”. It will lock your screen saying that you break somecopyright laws or visited unauthorized pages, and you need to pay the FBI money to unlock your PC. Really smart !!
The WannaCry ransomware attack happened in 2017, and it was a worldwide cyberattack by the WannaCryransomware cryptoworm, which targeted computers running the Microsoft Windows operating system.
Adware: We will get you some Advertisements
Adware is a malicious software that, once installed on your computer, tracks your internet browsing habits and sendsyou popups containing advertisements related to the sites and topics you’ve visited. While this type of software maysound innocent, and even helpful, it consumes and slows down your computer’s processor and internet connectionspeed. Additionally, some adware has keyloggers and spyware built into the program, leading to greater damage toyour computer and possible invasion of your private data.
BotnetThe term Bot is a short of robot. A Bot is nothing than a malware that allows attacker to take control over anaffected machine. Home computers are the biggest candidate for such malware type.
Multiple infected machines with this type of malware are called Botnet or Zombie Army . The cybercriminals thatcontrol these bots are called botherders or botmasters.
Some botnets might have a few hundred or a couple thousand computers, but others have tens and even hundredsof thousands of zombies at their disposal. Many of these computers are infected without their owners’ knowledge.
A recently discovered attacker has a botnet with 1.5 million infected machines with a rate of 75,000 infectedmachines in the first 30 minutes! According to the Symantec Internet Security Threat Report, through the first sixmonths of 2006, there were 4,696,903 active botnet computers. Attackers may use instant messaging (IM)applications to spread malware that transforms computers into zombie computers.
Bots sneak onto a person’s computer in many ways. Bots often spread themselves across the Internet by searchingfor vulnerable, unprotected computers to infect or an open port. They infect a computer by leaving a Trojan horseprogram that can be used for future activation. When an infected computer is on the Internet the bot can then startup an IRC client and connect to an IRC server created by the botmaster. Their goal is then to stay hidden until theyare instructed to carry out a task.
How they get to you
Attackers find new ways to deliver their programs. Have you ever seen a pop-up ad that included a “No Thanks”button? Hopefully you didn’t click on it – those buttons are often just decoys. Instead of dismissing the annoyingpop-up ad, they activate a download of malicious software.
Once the victim receives the program, he must activate it. In most cases, the user thinks the program is somethingelse. It might appear to be a picture file, an MPEG or some other recognizable file format. When the user chooses torun the program, nothing seems to happen. For some people, this raises alarm bells and they immediately follow upwith a flurry of virus and spyware scanner activity. Unfortunately, some users simply think they received a bad file
5/6
and leave it at that.
Meanwhile, the activated program attaches itself to an element of the user’s operating system so that every time theuser turns on his computer, the program becomes active. Attackers don’t always use the same segment of anoperating system’s initializing sequence, which makes detection tricky for the average user.
Types of attacks
Distributed Denial of Service DDoS is the most common one, where the whole zombie army will try to bring apublished service down by sending millions of requests using Ping of Death, or using ICMP through a reflectorSmurf Attack.
Another technique would be something called Teardrop where bots send pieces of an illegitimate packet; the victimsystem tries to recombine the pieces into a packet and crashes as a resultMailbomb on the other side is when bots send a massive amount of e-mail, crashing e-mail servers.
Botmasters nowadays will rent their Zombie army to another people for certain amount of money to send spamemails and advertisements or even to do DDoS attacks.
Even worse, botmasters may use botnet to perform some phishing attacks or install key logging programs to stealyour credit card information and passwords.
One of the most interesting usage of botnet is to play with internet poll results or performing Click Fraud. ClickFraud refers to the practice of setting up a botnet to repeatedly click on a link.
Sometimes, crackers will commit Click Fraud by targeting advertisers on their own Web sites. Since Web advertisersusually pay sites a certain amount of money for the number of clicks an ad gets, the botmaster could stand to earnquite a few dollars from fraudulent site visits.
It becomes way dangerous when it comes to identity theft or unknowingly participate in an attack on an importantweb site
Final thoughtsMalware and malicious programs come in different types, forms and damage types. Knowing what causes them islike winning half the battle. You should always make sure you are logging to secure patched devices and that younever download non trusted programs and applications.
6/6
