Malware
Malware (malicious software) is a generic term for a number of different types of malicious code. Malware can be used to compromise normal computer functions, steal data, obtain unauthorised access, and form a botnet to launch organised attack.
What are Malicious Code?
Malicious code refers to a broad category of programs that can cause damage or undesirable effects to computers or networks. Potential damage can include modifying, destroying or stealing data, gaining or allowing unauthorised access to a system, bringing up unwanted screens, and executing functions that a user never intended.
Examples of malicious code include computer viruses, worms, trojan horses, spyware & adware, rootkit, active content, zombies & botnets and ransomware. Because they pose a serious threat to software and information processing facilities, users and administrators must take precautions to detect and prevent malicious code outbreaks.
A computer virus is a self replicating computer program which can attach itself to other files/programs, and can execute secretly when the host program/file is activated. When the virus is executed, it can perform a number of tasks, such as erasing your files/hard disk, displaying nuisance information, attaching to other files, etc.
Type of virus
Memory-Resident Virus
This type will reside in main system memory. Whenever the operating system executes a file, the virus will infect a file if it is a suitable target, for example, a program file.
Program File Virus
This will infect programs like EXE, COM, SYS etc.
Polymorphic Virus
The virus itself can change form using various polymorphism techniques.
Boot Sector Virus
This type will infect the system area of a disk, when the disk is accessed initially or booted.
Stealth Virus
A virus which uses various stealth techniques in order to hide itself from detection by anti-virus software.
Macro Virus
Unlike other virus types, these viruses attack data files instead of executable files.
Macro viruses are particularly common due to the fact that:
Email virus
A virus spread by email messages.
Tips for Prevention
A worm is a self-replicating program that does not need to attach to a host program/file. Unlike viruses, worms can execute themselves. Worms have the ability to spread over a network and can initiate massive and destructive attacks in a short period of time.
One typical example of a massive attack is the "SQL Sapphire Slammer (Sapphire)" that occurred on 25 January 2003. The Sapphire exploited an MS SQL Server or MSDE 2000 database engine vulnerability. The weakness lays in an underlying indexing service that Microsoft had released a patch in 2002. It doubled in size every 8.5 seconds, and infected more than 90 percent of vulnerable hosts within 10 minutes. It eventually infected at least 75,000 hosts and caused network outages that resulted in:
Tips for Prevention
A trojan horse is a non-replicating program that appears legitimate, but actually performs malicious and illicit activities when executed. Attackers use trojan horses to steal a user's password information, or they may simply destroy programs or data on the hard disk.
A trojan horse is hard to detect as it is designed to conceal its presence by performing its functions properly.
Some recent examples are:
Tips for Prevention
Besides the following The Common Best Practices, you should:
Spyware is a type of software that secretly forwards information about a user to third parties without the user's knowledge or consent. This information can include a user's online activities, files accessed on the computer, or even user's keystrokes.
Adware is a type of software that displays advertising banners while a program is running. Some adware can also be spyware. They first spy on and gather information from a victim's computer, and then display an advertising banner related to the information collected.
A system with spyware / adware installed may display one or more of the following symptoms:
However, there are some spyware carefully programmed to avoid being noticed, and hence cannot be picked up by the above abnormalities. This type of spyware can only be detected and removed by anti-spyware products / tools.
Tips for Prevention
Besides the following The Common Best Practices, you should:
A rootkit is a collection of files that alter the standard functionality of an operating system on a computer in a malicious and stealthy manner. By altering the operating system, a rootkit allows an attacker to act as system administer on the victim's system. (Or the "root" user in a Unix system - hence the name "rootkit".)
Many rootkits are designed to hide their existence and the changes they made to a system. This makes it very difficult to determine whether a rootkit is present on a system, and identify what has been changed by the rootkit. For example, a rootkit might suppress directory and process listing entries related to its own files.
Rootkits may be used to install other types of attacker tools, such as backdoors and keystroke loggers. Examples of rootkits include LRK5, Knark, Adore, and Hacker Defender.
Tips for Prevention
Unlike the traditional methods of working with static data files using a software program, today's data objects, such as web pages, email and documents can interweave data and code together, allowing dynamic execution of program code on the user's computer. The fact that these data objects are frequently transferred between users makes them efficient carriers of viruses. The transparency of code execution can be a security concern.
The two main 'active content' technologies are ActiveX controls and Java. In general, ActiveX poses a greater threat because it has direct access to native Windows calls, and hence any system function. Java, on the other hand, is "sandboxed" or insulated from operating system services by the Java Virtual Machine. However, this does not mean that there will never be a Java virus.
Tips for Prevention
Besides the following The Common Best Practices, you should:
A zombie computer, usually known in the short form zombie, is a computer attached to the Internet that has been compromised and manipulated without the knowledge of the computer owner. A botnet refers to a network of zombie computers that have been taken over and put under the remote control of an attacker.
A botnet might consist of thousands of zombie computers, and even more. The zombie computers in the botnets can consist of computers at homes, schools, businesses and governments scattered around the world.
A zombie computer itself may only be slowed down slightly, or displaying mysterious messages. However, the whole botnet can be used by the attacker for a massive attack, such as DDoS (the Distributed Denial of Service) attack, against another system or network. Due to the large number of machines in a botnet, the aggregate computing power can be enormous when all these machines work together to launch a DDoS attack against a single target.
You should protect your machines or systems from becoming zombie computers.
Virus Hoax
A virus hoax is a false virus warning, usually in the form of an email message. It suggests the reader to forward the message to others, resulting in a rapidly growing proliferation of emails that may overload systems.
Mobile Device Virus / Worms
Like any computing platform, mobile devices are also susceptible to malicious code attacks. Although at present, malicious codes for handheld devices and smart phones are not that common, there is likely to be an increase as the functionality of mobile applications increase and with the wider deployment of these devices.
The open architecture of mobile application development environments, often with extensive software development documentation and tools, also allow attackers to create malicious code for these platforms quite easily.
Malicious code can infect mobile devices in several ways. These include:
Logic Bombs
A logic bomb is a program code which is embedded in another program, and can be activated when a certain predefined criteria are met.
For instance, a time bomb will attack a system and erase all data if a licence key or another program code is not found in the system. In some cases, a logic bomb will inform the attacker via the Internet that the bomb is ready to attack the victim.
Trap Door
A trap door is a secret entry point into a program that is intentionally included in the program code. While it can facilitate debugging during program development, it may be used for malicious purposes as well.
Common Obfuscation Techniques
The following are common obfuscation techniques used by malicious code developers and writers to evade detection and destruction:
Most virus signature files are created based on the checksum value which makes use of the file properties and first few bytes of the malicious code binaries. The binders technique is to bind the virus and malicious code file on to another file, which changes its form. The packers technique is to compress the virus code before it is embedded.
Malicious code may encrypt and decrypt itself, even using several layers of encryption and decryption and/or using random keys in encryption and decryption. This makes them harder to examine directly.
Malicious code can change its default encryption settings as well as the decryption code during self-encryption. These make it much more difficult to detect.
Malicious code change its form by, for instance, rearranging its code fragments or/and by adding useless lines of code into its source, and recompiling itself into a new form.
This method converts an executable program (.exe) into a visual basic script (.vbs) file that can be attached to a document, data files or email messages.
The technique is designed to evade anti-virus software detection by hiding the code itself. One example is to monitor system calls to files; the malicious code then modifies the return information to the process call by returning only original information.
Growing Risk
The risks posed by malicious code are on the rise, due to fundamental changes in the threats and purposes that malicious code is put to. Instead of just causing a nuisance and being destructive, malicious code attacks are becoming more motivated by financial gain. Attackers are increasingly sophisticated and organised, adopting methods that are similar to traditional software development and business practices.
It has been shown that the amount of time between the discovery of a software vulnerability and attempts to exploit that vulnerability via attacks from new computer viruses/worms is continuously decreasing. In addition, it takes time for anti-virus vendors to develop virus and malicious code definitions, so there is always a chance that your anti-virus software cannot detect newly discovered malicious code in time. Thus, your computer is still vulnerable to virus attack if other security best practices are not put in place.
Your computer system could be infected if:
Symptoms of Infection of Malware
Protection Against Malware
Anti-virus Information
Virus Databases
(The following list contains links to commercial product/service vendors for reference purpose only and should NOT be regarded as a list of InfoSec recommended or approved products and services.)
