Threats - Malware and Malware Types

One of the biggest threats is malware. Malware is software that wants to do harm to your computers, to your network, to your cyber security domain. We're going to be covering common types of malware, taking a look at this whole list, giving some description, some examples, just some ideas of what some of the threats are that are out there.

Viruses

A term that most of us have heard before is a virus, but what is a virus? A virus is malicious code, but more specifically it's malicious code that gets inserted into legitimate code. So here's some sort of program that's run and it's got lines of code in it that run this program, and then a virus will insert itself into that code. One of the core functions of a virus is to replicate itself, to duplicate itself, to make sure that it infects other machines. That's what we call it: we call a machine infected when it has a virus, similar to a biological virus, but in this case it's a computer that's getting infected, or some sort of equipment that's getting affected.

A boot sector virus is a virus that lives in the boot sector, so it's a type of virus. Now what is a boot sector? Your machine, your computer, has some sort of operating system on it. Windows, macOS and Linux are all examples of an operating system. But this needs to get loaded up into RAM and tell the computer what to do, and to do that it needs some initial set of instructions. That's what the boot sector is for. It's a part of the hard drive that has that initial set of instructions that gets loaded up into the machine when it starts up and tells the computer how to load the OS. You can imagine that a boot sector virus, living in the boot sector and being the first thing that gets launched, can be pretty devastating to the computer. So this is one of the types of viruses that you need to watch out for.

Worms

A worm can be similar to a virus, although it's different in that it's a standalone program. Where a virus will insert itself into other code, a worm is a program in itself, and really the primary focus of it, maybe its only focus, is to replicate itself. If a worm gets onto a computer, it's going to try to infect all of the other machines on that network, it's going to put itself on removable media, and it's going to transfer out that way as well. So it really just wants to replicate itself and get itself on as many machines as possible.

This creates a lot of exponential growth, because one computer becomes two computers infected, becomes four computers infected, becomes eight computers, then 16, and it just continues to go out from there, similar to a pandemic. This worm is going to just keep replicating itself, so it creates some exponential problems.

The biggest problem is that a worm might just be that it wants to replicate itself, and in that case at the very least it's consuming a lot of bandwidth and a lot of resources. But it could be worse: it could have some sort of payload to it, which has some sort of ransomware or data exfiltration, or creates zombies, which we'll talk about more later. So this could create other problems if it has a payload. The payload just means that it has some other malicious code or malicious intent to it, not just to replicate itself, but an additional intent.

Trojan horses

From a Mau perspective, the Trojan horse got its name from a story from Greece. Greece were going through their Trojan Wars and they were attacking a bunch of cities, and one of them was the city of Troy. The city of Troy had some big walls and gates to it, and so they were wondering how they were going to get inside and attack. This was going to be a difficult city to take over. So what they did is they built a large wooden horse and then they hid inside the horse. They rolled the horse up to the gates and presented it as a tribute to the city of Troy, and then the people of the city of Troy saw the horse and the tribute and brought the horse inside the gates, in which case the Greeks could jump out and attack the city. Or that's how the story goes.

So the idea from a malware perspective is it's any kind of software that's presenting itself as something that it really isn't. For instance, let's say you're trying to log into a program on your computer, but instead of presenting the actual program it's presenting a Trojan horse, and it asks for your username and password, and it looks like the application that you wanted to log into, but it's not. Once you type in your username and password, now whoever instigated this Trojan horse has the username and password for whatever application you were trying to log into.

Ransomware

Ransomware is really prevalent right now and it's making cyber crime very profitable. The reason is because what it will do is encrypt your files and folders so that you can't have access to them, and the only way that you get access is if you're going to pay the cyber criminals money. So what happens is, maybe you have some personal photos that you really want, or maybe it's some sort of company data that the company can't do without, and once it's encrypted you feel compelled to pay the price so that you can get access back to those files and those folders. That's ransomware.

Spyware and key loggers

Spyware is any kind of software or any kind of malware that's spying on you. It could be looking at your activities, it could be looking at your files, it could be looking at what you're doing on your electronic devices.

Key loggers are an example of that. Key loggers are a type of spyware that monitors what you're typing on the keyboard. As you're typing stuff out, it's either logging it in some sort of file or sending the information off to the threat agent so they can see things like your passwords. It'll expose passwords, because they can actually see the keystrokes that you have when you're typing on your keyboard.

Bloatware

Bloatware is all that annoying software that comes pre-installed on new machines. If you buy a new computer it comes with all of this pre-installed software on it, most of which you're not going to want. It just fills up your resources and it's really annoying. You've got to clean it up, and it slows down your computer, or it used to be a real problem with slowing down your computer. It's really annoying stuff that they'll have pre-installed, but they want you to purchase the upgrade. They're giving you a little taste of the software, and then they're doing some sort of advertising through it, or they want you to purchase the full version of it.

Now keep in mind, bloatware actually has multiple meanings as well. It could be just software that has unnecessary code or features. Maybe there's some sort of program that's actually legitimate and is coming out with more and more features that's just know really is using, or maybe the code is not written correctly. That could mean bloatware as well.

Logic bombs

A logic bomb is a virus that is waiting for some sort of trigger, waiting to be activated. It's looking for some sort of condition to be met, and once that happens then it's going to execute some sort of malicious function. An example of this: maybe I want time for my virus to spread around and get to lots of machines before it actually gets executed, so that somebody doesn't find it and get rid of it before it actually starts causing problems. So maybe I put some sort of timer on it. This is an example of a condition that needs to be met, a timer that looks for a certain date, and then once that date and time occurs, it's going to execute all at once, and therefore it has less likelihood that it's going to get caught before it actually gets activated. That's an example of a logic bomb.

Rootkits

A rootkit allows us to get access to areas that we wouldn't normally have access to. It's important to note that this is not always malware. I've used rootkits before. There are areas of an operating system or of hardware that the manufacturer or the distributor doesn't want you to get into, doesn't want you to have access to, so what we can do is download software to gain access to it.

Rootkit is broken into two parts: root, which means the privileged account on a Unix or a Linux machine, and kit, which is the software that gives us access to that area. A good example of this is one of the times I used a rootkit to break into a Kindle Fire, one of the initial Kindle Fires. I wanted to be able to do my own thing with it and not what they wanted me to do with it, so I was able to root that device and get into it to do what I wanted out of it.

Botnets, command and control

A botnet is a network of bots. But then what is a bot? I would install software on each one of these machines and then they would become bots, so I would gain control over each one of these machines. The question is, what am I trying to do? For instance, let's say I'm trying to launch some sort of denial of service attack against this website, and I'm on this machine right here, and maybe this machine alone couldn't generate enough traffic to be able to disrupt this bank of web servers here. So what I do is I infect all of these other computers here with these bots, and now I have control over them, and these computers become zombie computers. Now I have this network of bots and I launch an attack all at the same time, this distributed denial of service attack, to be able to tackle this web server and bring it to its knees. So it's now not able to hand out legitimate web pages and be able to service its legitimate customers, because I've taken the service down.

A botnet attack can be referred to as a command and control attack, and the reason is because a botnet attack will use command and control software. Command and control is a type of software where you have a command center that's running on a machine and it's controlling all of these bots. Hence the command and control: it controls these bots to carry out a botnet attack.

Cryptojacking

Cryptojacking, also known as malicious crypto mining, is when somebody uses somebody else's resources without their consent to do crypto mining. Essentially what cryptocurrency needs is somebody to do the processing of all the transactions, and anybody can elect to step in and help with the crypto mining, or the processing of these transactions, and as a reward for that you would get some sort of cryptocurrency in return for helping out with this whole process. Well, if somebody were to install software on somebody else's machine that does this crypto mining, using up their resources, that's called cryptojacking.

Adware

Adware is software that's going to show ads to you. The way that whoever made this adware makes money is they get you to install it on your machine, it's going to show ads to you, and then every time you click one of those ads, or every time it shows you one of those ads, they get a little bit of money for that. Get enough people out there to click on those ads, or just to view those ads, and then it can add up to quite a bit of money for whoever has created this adware.

Fileless malware

Fileless malware is malware that actually never gets stored on your computer. It never goes to your hard drive, it never gets onto some sort of media that's permanent. What it actually resides in is your RAM. RAM is something that when you turn your machine off, it gets cleared out, so it just gets installed onto the RAM during the time that you're using it, and then when you turn the machine off it goes away.

Now why would somebody create software that does this? The idea behind this is that a lot of virus protection is scanning your hard drives and files and folders, but they're not necessarily scanning your active memory. So the intention of fileless malware is to not get detected by antivirus software and still thrive.

Malware can be really problematic on our networks. We went over quite a few different definitions here, from viruses to worms, Trojan horses, ransomware, spyware, key loggers, bloatware, logic bombs, rootkit, botn net wear, adware and fileless malware. There are more and others that are out there, but this gives us a high overview of what some of the common ones are and what we're going to want to protect our networks against.