Malware

• Identify common types of malware and the threats they pose.

• Types of malware
• Malware removal and mitigation
• Trojan behavior, detection, and creation
• Backdoors and covert channels
• Ransomware

• Any software that is hostile, intrusive, or annoying in its operation and performs any action or activity without the knowledge or consent of the system’s owner.
• Has been adopted by criminals for a wide array of purposes to capture information about the victim or commit other acts.
• Includes viruses, worms, Trojans, spyware, adware, scareware, ransomware, and more.
• Has evolved to steal or destroy information, such as keystroke loggers.

Virus

• Oldest piece of malware software
• Term is frequently used to refer to all types of malware
• A piece of code or software that spreads from system to system by attaching itself to other files
• Virus activates when the file is accessed
• Upon activation, the code carries out the attack or other action the author wishes to execute (destroying or corrupting data, for example)

• Logic bombs
  • Designed to go off on a specific date or when specific event happens
• Polymorphic viruses
  • Can change its shape to avoid antivirus programs and detection
• Multipartite viruses
  • Infects using multiple attack vectors, including the boot sector and executable files on the hard drive
• Macro viruses
  • Infects and operates using macro language
• Hoaxes
  • Not a true virus but are designed to get the user to take an action even though no infection or threat exists

• Self-replicating piece of software that combines the convenience of computer networks with the power of malware.
• Does not require a host program; is self-contained
• Does not require user intervention
• Replicates rapidly
• Consumes bandwidth and resources
• Can transmit information from a victim system.
• Can carry a payload such as a virus.

• Patch operating systems
  • Doesn’t protect from a zero-day exploit, in which a hole can be exploited immediately
• Education
  • How to open email safely
  • Don’t respond to phishing messages
• Antivirus
• Firewalls

1. A Trojan attaches to another file.
2. The file is retrieved and executed by an unsuspecting victim.
3. The Trojan then typically grants access to the attacker or can do some other action on the attacker’s behalf.

• Functions of Trojans:
  • Data theft
  • Installation of software
  • Downloading or uploading of files
  • Modification or deletion of files
  • Installing keystroke loggers
  • Viewing the system user’s screen
  • Consuming computer storage space
  • Crashing the victim’s system

• The CD/DVD drawer of a computer opens and closes.
• The computer screen changes, such as flips or inverts.
• Screen settings change by themselves.
• Documents print with no explanation.
• A browser is redirected to a strange or unknown webpage.
• Windows color settings change.
• Screen saver settings change.
• Right and left mouse buttons reverse their functions.
• The mouse pointer disappears.
• The mouse pointer moves in unexplained ways.

• The start button disappears.
• Chat boxes appear on the infected system.
• The Internet service provider (ISP) reports that the victim’s computer is running port scans.
• People chatting appear to know detailed personal information.
• The system shuts down by itself.
• The taskbar disappears.
• The account passwords are changed.
• Legitimate accounts are accessed without authorization.

• Unknown purchase statements appear in credit card bills.
• The Ctrl+Alt+Del command stops working.
• Although the computer is rebooted, a message states that there are other users still connected.

• The attackers merge intended payload with a harmless executable to create a single executable.
• New executable is posted in some location where it is likely to be downloaded.

• Are typically implemented as hardware or software
• Software is installed just like any other Trojan
  • Examples: IKS Software Keylogger and Ghost Keylogger
• Hardware-based keystroke loggers are plugged into a universal serial bus (USB) or PS2 port

• Communications are redirected to ports other than their original destination.
• Done by setting up a piece of software to listen on specified ports.
• When packets are received, the traffic is sent on to another system.

• Netcat
  • A simple command-line utility available for Linux, UNIX, and Windows
  • Designed to function by reading information from connections using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) and doing simple port redirection on them as configured.

(Cont’d)

(Cont’d)

• Types of malware
• Malware removal and mitigation
• Trojan behavior, detection, and creation
• Backdoors and covert channels
• Ransomware