INTRODUCTION TO MALWARE
Tags: Virus, Computer Security, Cybersecurity, Malware

OVERVIEW

From first computer virus Creeper created in the 1970s which is spread across the network with a message displaying “I’m the creeper, catch me if you can!”, until today’s advanced threats, security experts from around the globe are trying to fight against these malicious threat actors.

But as in a real physical world, criminals are always one step ahead and this battle is a continuous process which will never end. But as a user we can do much to apply security measures recommended from these security experts to minimize the attack vector and maximize the protection of our assets.

DEFINITION

We can say that malware is any type of software with malicious intent. In a contest of information security, malware is any activity that breaks principles of confidentiality, integrity, and availability.

TYPES OF THREATS

Malware is divided into several categories, based on the way that is introduced on the system, and the way it spreads.

Most known types of malware are:

Virus — computer malware that self-replicates by copying itself to another program. Activation of a virus can be by malicious mail attachment or unsuspecting user inserting the USB thumb drive into the computer. The computer gets infected through the replication of malicious code. Worm — malware that spreads across the network by replicating himself without user intervention. Trojan horse — a type of malware that hides in a legitimate program and installs onto the computer alongside it. Backdoor — malware that creates hidden persistent access to an unsuspected computer, and opens the door to a system without any kind of user interaction. Ransomware — one of the most used types of malware in today’s world, which encrypts user files and asks for paying the ransom to decrypt it.

All malware types have one or many general characteristics:

disrupt computer operations,

steal data,

install additional malware,

monitor user activity.

VIRUS

Types of Computer Viruses

File infectors:

file infector viruses come attached with known types of files, like .com or .exe. They are executed when these programs are started.

Macro viruses:

macro viruses usually target office applications (Word or Excell). They use sequences of malicious commands to execute inside the opened document.

Overwrite Viruses:

overwrite viruses are basically created with the purpose of destroying files by overwriting them with its own code or inserting malicious code to allow them to spread further.

Polymorphic Viruses:

polymorphic viruses have the ability to change themselves in the wild, without losing the basic capability, with the purpose to hide from antivirus software which depends on signatures of known viruses.

Resident Viruses:

resident viruses embedded themselves into the memory of running computer and even when the original virus is deleted it can be started again from memory.

Rootkit Viruses:

rootkit viruses are installed secretly onto the system and have the functionality to open back door on to the system for the attacker.

USE CASES

most famous viruses of all time

Loveletter ILOVEYOU

Loveletter ILOVEYOU is one of the most well-known and in 2000 it was the most damaging malware event of all time.

The virus came in an email with a subject line that said “I love you”. in today’s time we most probably won’t open this kind of mail but in 2000 people was unaware of this kind of threats an opened it. As a curious people were clicking on it and opened attachment called ‘LOVE-LETTER-FOR-YOU.TXT.vbs’. ILOVEYOU overwrote system files and personal files and spread itself over and over and over again. Loveletter opens the Outlook email program, and scans for email addresses in the Address book. It sends the email with an attached copy of itself

ILOVEYOU was so effective it actually held the Guinness World Record as the most ‘virulent’ virus of all time.

2. MY DOOM

MyDoom is considered to be the most damaging virus ever released and it holds a record, just like ILoveYou, as a fastest spreading virus of all time. It hits big known companies like Microsoft and SCO with Distributed Denial of Services attack.

Beside that MyDoom targeted big tech companies it also spammed junk mail through infected computers, with the text “andy; I’m just doing my job, nothing personal, sorry”.

It caused slowdowns of internet traffic worldwide.

3. CryptoLocker

Cryptolocker ransomware was a cyber attack that is used infected email attachments and spreading trough existing botnet. When activated this ransomware encrypts files on local and shared drives, and displayed a message which offered to decrypt the data if a payment was made. There was no guarantee that payment would release the encrypted content.

Code of a virus

“First, the virus determines if it is to spread; if so, it locates a set of target files it is to infect, and copies itself into a convenient location within the target file. It then alters portions of the target to ensure the inserted code will be executed at some time. For example, the virus may append itself just beyond the end of the instruction space and then adjust the entry points used by the loader so that the added instructions will execute when the target program is next run. This is the infection phase It then performs some other action (the execution phase). Finally, it returns control to the program currently being run. Note that the execution phase can be null and the instructions still constitute a virus; but if the infection phase is missing, the instructions are not a virus.”

HOW TO FIGHT

10 Steps to Cyber Security

The National Cyber Security Centre recommends you review this regime — together with the nine associated security areas described below, in order to protect your business against the majority of cyber attacks.

Network Security

Protect your networks from attack. Defend the network perimeter, filter out unauthorized access and malicious content. Monitor and test security controls.

2. User education and awareness

Produce user security policies covering acceptable and secure use of your systems. Include in staff training. Maintain awareness of cyber risks.

3. Malware prevention

Produce relevant policies and establish anti-malware defenses across your organization.

4. Removable media controls

Produce a policy to control all access to removable media. Limit media types and use. Scan all media for malware before importing onto the corporate system.

5. Secure configuration

Apply security patches and ensure the secure configuration of all systems is maintained. Create a system inventory and define a baseline build for all devices.

6. Managing user privileges

Establish effective management processes and limit the number of privileged accounts. Limit user privileges and monitor user activity. Control access to activity and audit logs.

7.Incident management

Establish an incident response and disaster recovery capability. Test your incident management plans. Provide specialist training. Report criminal incidents to law enforcement.

8. Monitoring

Establish a monitoring strategy and produce supporting policies. Continuously monitor all systems and networks. Analyse logs for unusual activity that could indicate an attack.

9. Home and mobile working

Develop a mobile working policy and train staff to adhere to it. Apply the secure baseline and build to all devices. Protect data both in transit and at rest.

Set up your Risk Management Regime

Assess the risks to your organization’s information and systems with the same vigor you would for legal, regulatory, financial or operational risks. To achieve this, embed a Risk Management Regime across your organization, supported by the Board and senior managers.

REFERENCES

An Introduction to Malware

http://orbit.dtu.dk/files/139067614/malware.pdf

An introduction to malware

https://www.ncsc.gov.uk/content/files/protected_files/guidance_files/An-introduction-to-malware.pdf

What is a Computer Virus?

https://antivirus.comodo.com/blog/computer-safety/what-is-virus-and-its-definition/

Introduction to Malware: Definition, Attacks, Types, and Analysis

https://www.greycampus.com/blog/information-security/introduction-to-malware-definition-attacks-types-and-analysis

MyDoom

http://virus.wikidot.com/mydoom

Loveletter ILoveYou

http://virus.wikidot.com/loveletter

CryptoLocker

https://en.wikipedia.org/wiki/CryptoLocker

10 steps to cybersecurity — http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/

https://www.ncsc.gov.uk/content/files/protected_files/guidance_files/NCSC%2010%20Steps%20To%20Cyber%20Security%20NCSC.pdf