Module 3
Malicious Software
____________________________________________________________________
MUSA Notes
Spam:
Spam is any kind of unwanted, unsolicited digital communication that gets sent out in
bulk. Often spam is sent via email, but it can also be distributed via text messages,
phone calls, or social media.
What does spam stand for?
Spam is not an acronym for a computer threat, although some have been proposed
(stupid pointless annoying malware, for instance). The inspiration for using the term
“spam” to describe mass unwanted messages is a Monty Python skit in which the actors
declare that everyone must eat the food Spam, whether they want it or not. Similarly,
everyone with an email address must unfortunately be bothered by spam messages,
whether we like it or not.
Types of spam
Spammers use many forms of communication to bulk-send their unwanted messages.
Some of these are marketing messages peddling unsolicited goods. Other types of spam
messages can spread malware, trick you into divulging personal information, or scare
you into thinking you need to pay to get out of trouble.
Email spam filters catch many of these types of messages, and phone carriers often
warn you of a “spam risk” from unknown callers. Whether via email, text, phone, or
social media, some spam messages do get through, and you want to be able to recognize
them and avoid these threats. Below are several types of spam to look out for.
Phishing emails
Phishing emails are a type of spam cybercriminals send to many people, hoping to
“hook” a few people. Phishing emails trick victims into giving up sensitive information
like website logins or credit card information.
Adam Kujawa, Director of Malwarebytes Labs, says of phishing emails: “Phishing is
the simplest kind of cyberattack and, at the same time, the most dangerous and
effective. That is because it attacks the most vulnerable and powerful computer on the
planet: the human mind.”
Email spoofing
1|Module No: 1
Spoofed emails mimic, or spoof, an email from a legitimate sender, and ask you to take
some sort of action. Well-executed spoofs will contain familiar branding and content,
often from a large well-known company such as PayPal or Apple. Common email
spoofing spam messages include:
• A request for payment of an outstanding invoice
• A request to reset your password or verify your account
• Verification of purchases you didn’t make
• Request for updated billing information
Malware and its types
Malware is a program designed to gain access to computer systems, normally for the
benefit of some third party, without the user’s permission. Malware includes
computer viruses, worms, Trojan horses, ransomware, spyware and other malicious
programs.
Types of Malware:
• Viruses –
A Virus is a malicious executable code attached to another executable file. The
virus spreads when an infected file is passed from system to system. Viruses can
be harmless or they can modify or delete data. Opening a file can trigger a virus.
Once a program virus is active, it will infect other programs on the computer.
• Worms –
Worms replicate themselves on the system, attaching themselves to different files
and looking for pathways between computers, such as computer network that
shares common file storage areas. Worms usually slow down networks. A virus
needs a host program to run but worms can run by themselves. After a worm
affects a host, it is able to spread very quickly over the network.
• Spyware –
Its purpose is to steal private information from a computer system for a third
party. Spyware collects information and sends it to the hacker.
• Trojan horse –
A Trojan horse is malware that carries out malicious operations under the
appearance of a desired operation such as playing an online game. A Trojan horse
varies from a virus because the Trojan binds itself to non-executable files, such as
image files, audio files.
• LogicBombs –
A logic bomb is a malicious program that uses a trigger to activate the malicious
code. The logic bomb remains non-functioning until that trigger event happens.
2|Module No: 1
Once triggered, a logic bomb implements a malicious code that causes harm to a
computer. Cybersecurity specialists recently discovered logic bombs that attack
and destroy the hardware components in a workstation or server including the
cooling fans, hard drives, and power supplies. The logic bomb overdrives these
devices until they overheat or fail.
• Ransomware –
Ransomware grasps a computer system or the data it contains until the victim
makes a payment. Ransomware encrypts data in the computer with a key which is
unknown to the user. The user has to pay a ransom (price) to the criminals to
retrieve data. Once the amount is paid the victim can resume using his/her
system.
• Backdoors –
A backdoor bypasses the usual authentication used to access a system. The
purpose of the backdoor is to grant the cyber criminals future access to the system
even if the organization fixes the original vulnerability used to attack the system.
• Rootkits –
A rootkit modifies the OS to make a backdoor. Attackers then use the backdoor to
access the computer distantly. Most rootkits take advantage of software
vulnerabilities to modify system files.
• Keyloggers –
Keylogger records everything the user types on his/her computer system to obtain
passwords and other sensitive information and send them to the source of the
keylogging program.
Trojan
Like its namesake, Trojan horse attacks (or simply “Trojans”) in computing are defined
as a type of malware that use deception and social engineering to trick unsuspecting
users into running seemingly benign computer programs that hide malicious ulterior
motives. While technically they are not computer viruses but rather a separate form of
malware, "Trojan horse virus" has become a common way to refer to them.
How to characterize a Trojan
People sometimes think of a Trojan as a virus or a worm, but it is really neither.
A virus is a file infector which can self-replicate and spread by attaching itself to
another program. Worms are a type of malware similar to viruses, but they don’t need
to be attached to another program in order to spread. Most viruses are now seen as
legacy threats. Worms have also become rare, though they do pop up from time to
time.
3|Module No: 1
"A Trojan can be like a Swiss Army knife of hacking."
Think of Trojans as an umbrella term for malware delivery, because there are various
kinds of Trojans. Depending on the criminal programmer’s intent, a Trojan can be like
a Swiss Army knife of hacking—acting as a bit of standalone malware, or as a tool for
other activities, such as delivering future payloads, communicating with the hacker at
a later time, or opening up the system to attacks just as the Greek soldiers did from
inside the Trojan fortress.
Put another way, a Trojan is a delivery strategy that hackers use to deliver any
number of threats, from ransomware that immediately demands money, to spyware
that conceals itself while it steals valuable information like personal and financial data.
Keep in mind that adware or PUPs (potentially unwanted programs) can be confused
with Trojans because the delivery method is similar. For example, sometimes adware
sneaks onto your computer as part of a bundle of software. You think you’re
downloading one piece of software, but it’s really two or three. The program authors
usually include the adware for marketing affiliate reasons so they can monetize their
installer with offers—usually clearly labeled. Such adware bundlers are typically less
malicious than Trojans. Also, they do not conceal themselves as Trojans do. But since
the adware distribution vector resembles that of a Trojan, it can cause confusion.
Trojan virus symptoms
Trojans can look like just about anything, from free software and music, to browser
advertisements to seemingly legitimate apps. Any number of unwise user behaviors can
lead to a Trojan infection. Here are a few examples:
• Downloading cracked applications. Promises of an illegal free copy of a piece of
software can be enticing, but the cracked software or activation key generator
may conceal a Trojan attack.
• Downloading unknown free programs. What looks like a free game or
screensaver could really be a Trojan, especially if you find it on an untrustworthy
site.
• Opening infected attachments. You get a strange email with what looks like an
important attachment, like an invoice or a delivery receipt, but it launches a
Trojan when you click on it.
• Visiting shady websites. Some sites only need a moment to infect your computer.
Others use tricks like pretending to stream a popular movie, but only if you
download a certain video codec, which is really a Trojan.
• Any other social engineering that disguises itself by taking advantage of the
latest trends. For example, in December 2017, an extensive installed base of
Intel processors was discovered to be vulnerable to attack due to hardware
issues. Hackers leveraged the ensuing panic by faking a patch called Smoke
Loader, which installed a Trojan.
4|Module No: 1
Viruses
Viruses are a subgroup of malware. A virus is malicious software attached to a
document or file that supports macros to execute its code and spread from host to host.
Once downloaded, the virus will lay dormant until the file is opened and in use. Viruses
are designed to disrupt a system’s ability to operate. As a result, viruses can cause
significant operational issues and data loss.
Worms
Worms are a malicious software that rapidly replicates and spreads to any device
within the network. Unlike viruses, worms do not need host programs to disseminate.
A worm infects a device via a downloaded file or a network connection before it
multiplies and disperses at an exponential rate. Like viruses, worms can severely
disrupt the operations of a device and cause data loss.
Attack Agents
Misuse of an Agent by Another Agent
Malicious agents may pose a threat to other agents executing in multi-agent systems.
Such threats may go unnoticed by the host platform and have a significant impact on
the victim agent as well as the host functionalities. Examples include:
•
Repudiation: The malicious agent after negotiation can deny its participation in
a transaction or communication in which it took part. This may result in conflicts
and misuse of resources and services.
•
Denial of Service: The malicious agent may overwhelm the victim agent with
interactions and consume its available resources. The latter might result in an
inability of the victim agent to function properly and even create high costs due
to resource usage.
•
Masquerading and Misinformation: The malicious agent may disguise its
identity and perform actions that will effectively beat the purpose of existence of
the victim agent and cause it to take the blame. This can result in a trust and
reputation loss, especially in communities where this matters—e.g., electronic
marketplaces where price negotiation takes place.
Information Theft
5|Module No: 1
Identity theft definition
Identity theft occurs when a criminal obtains or uses the personal information; e.g.,
name, login, Social Security number (SSN), date of birth, etc., of someone else to
assume their identity or access their accounts for the purpose of committing fraud,
receiving benefits, or gaining financially in some way.
In the US, “identity theft” wasn't legally defined until 1998. It was then Congress
passed the Identity Theft and Assumption Deterrence Act, which made identity theft a
prosecutable offense in and of itself. Prior to this, identity theft was prosecuted under a
hodgepodge of state and federal fraud statutes designed with old-timey grifters and
con-artists in mind (think Leonardo DiCaprio in the 2002 film Catch Me if You Can).
International laws vary from one country to the next. Of note, EU citizens are protected
under the General Data Protection Regulation (GDPR). The UK followed suit with
the Data Protection Act 2018.
Pre-Internet criminals typically had to go through your physical mail box or suffer the
indignity of rummaging through your smelly trash to get the information they needed
to steal your identity—like those “you're already approved,” pre-screened credit offers
we all get in the mail.
Thanks to the miracle of modern technology, today's cybercriminals don't have to work
nearly as hard to invade your privacy, but they stand to gain so much more. Big
businesses and the large caches of data contained on their networks present a much
more lucrative target than piecemeal attacks on individual consumers. Accordingly,
attacks on businesses are up 235 percent year over year, according to the Malwarebytes
Labs Cybercrime Tactics and Techniques report. At the same time, attacks on
consumers went down almost 40 percent.
What are the signs of identity theft?
• You stop receiving your regular bills and credit card statements.
• You receive statements for accounts you never opened.
• Debt collectors start calling you day and night about debts you've never heard of.
• The IRS alleges you failed to report income for a company you never worked for.
• You see withdrawals/charges on your bank or credit card statement that you
didn't make.
• You try to file your taxes only to discover that someone else beat you to it.
• You try to file your taxes and find someone claimed your child as a dependent
already.
• Your credit report includes lines of credit you never opened.
• Your credit score fluctuates wildly and for no apparent reason.
6|Module No: 1
• The most obvious sign—you receive a notification that you've been the victim of a
data breach.
Keyloggers
What is a keylogger?
Keyloggers are a particularly insidious type of spyware that can record and steal
consecutive keystrokes (and much more) that the user enters on a device. The term
keylogger, or "keystroke logger," is self-explanatory: Software that logs what you type
on your keyboard. However, keyloggers can also enable cybercriminals to eavesdrop on
you, watch you on your system camera, or listen over your smartphone's microphone
Is a keylogger a virus?
Although for our purposes, keyloggers operate in the context of malware, they are not
always illegal to install and use. Keyloggers are a common tool for corporations,
which IT departments use to troubleshoot technical problems on their systems and
networks—or to keep an eye on employees surreptitiously. The same goes for, say,
parents, who want to monitor their children’s activities. Suspicious spouses are another
market for keyloggers.
In all such cases, if the organization or person downloading and installing the
keylogger actually owns the device, then it’s perfectly legal. And there are thousands of
commercially available keyloggers on the Internet, which advertise themselves for just
such a use.
However, the concern about keyloggers is when malicious actors are behind them. And
they definitely do not own the device they infect. You don’t know they’ve breached your
computer; and depending on what kind of keylogger it is, it can steal any passwords
you’ve entered, periodically take screen shots, record the web pages you view, grab on
to your sent emails and any instant messaging sessions, as well as sensitive financial
information (such as credit card numbers, PIN codes, and bank accounts),
and then send all that data over the network to a remote computer or web server.
There, the person operating the logging program can retrieve it all, potentially sending
it to third parties for criminal purposes.
Hardware vs. software keyloggers
Keyloggers come in at least two broad flavors—hardware devices and the more familiar
software variety. Hardware devices can be embedded in the internal PC hardware
itself, or be an inconspicuous plugin that’s secretly inserted into the keyboard port
between the CPU box and the keyboard cable so that it intercepts all the signals as you
type. But that means that the cybercriminal has to have physical access to the PC
while you’re not present in order to plant the hardware keyloggers.
7|Module No: 1
Software keyloggers are much easier to introduce to and install on victims’ devices,
which is why that variety is much more common. Unlike other kinds of malware,
software keyloggers are not a threat to the systems they infect themselves. In fact, the
whole point of keyloggers is to work behind the scenes, sniffing out the keystrokes
while the computer continues to operate normally. But even if they don’t harm the
hardware, keyloggers are definitely a threat to users, especially when they steal
sensitive data.
Phishing
Phishing definition
Phishing is an attack in which the threat actor poses as a trusted person or
organization to trick potential victims into sharing sensitive information or sending
them money. As with real fishing, there's more than one way to reel in a victim: Email
phishing, smishing, and vishing are three common types. Some attackers take a
targeted approach, as is the case with spear phishing or whale phishing
How phishing attacks work
Phishing attacks begin with the threat actor sending a communication, acting as
someone trusted or familiar. The sender asks the recipient to take an action, often
implying an urgent need to do so. Victims who fall for the scam may give away
sensitive information that could cost them. Here are more details on how phishing
attacks work:
• The sender: In a phishing attack, the sender imitates (or “spoofs”) someone
trustworthy that the recipient would likely know. Depending on the type of
phishing attack, it could be an individual, like a family member of the recipient,
the CEO of the company they work for, or even someone famous who is
supposedly giving something away. Often phishing messages mimic emails from
large companies like PayPal, Amazon, or Microsoft, and also banks or
government offices.
• The message: Under the guise of someone trusted, the attacker will ask the
recipient to click a link, download an attachment, or to send money. When the
victim opens the message, they find a scary message meant to overcome their
better judgement by filling them with fear. The message may demand that the
victim go to a website and take immediate action or risk some sort of
consequence.
• The destination: If users take the bait and click the link, they're sent to an
imitation of a legitimate website. From here, they're asked to log in with their
username and password credentials. If they are gullible enough to comply, the
sign-on information goes to the attacker, who uses it to steal identities, pilfer
bank accounts, and sell personal information on the black market.
8|Module No: 1
Who is targeted by phishing?
Anyone can be targeted with a phishing attack, but some types of phishing are done to
very specific people. Some threat actors will send out a general email to many people,
hoping a few will take the bait based on a common trait. An example would be saying
something is wrong with your Facebook or Amazon account, and you need to click this
link right away to log in and fix it. The link would likely lead to a spoofed webpage
where you might give away your login credentials.
Threat actors use more targeted phishing attacks if they are after something specific,
like access to a certain company's network or data, or information from a politician or
political candidate. This is called spear phishing. In this case, they may research
information to make their attack sound familiar and credible, so the target is more
likely to click a link or provide information. An example would be researching the name
and communication style of a target company's CEO, then emailing or texting specific
employees at that company pretending to be the CEO asking for something.
While threat actors often pretend to be CEOs in their phishing attacks, sometimes the
target is the CEO themself. "Whale phishing" describes phishing attacks toward high-
profile people like company executives, celebrities, or well-known wealthy individuals.
Whether an attack is general or highly targeted, sent to one person or many people,
anyone can become a phishing target, so it's important to
Types of phishing attacks
Despite their many varieties, the common denominator of all phishing attacks is their
use of a fraudulent pretense to acquire valuables. Some major categories include:
Email phishing
Email phishing is one of the most common types of phishing. It has been widespread
since the early days of e-mail. The attacker sends an email purporting to be someone
trustworthy and familiar (online retailer, bank, social media company, etc.), and asks
you to click a link to take an important action, or perhaps download an attachment.
Vishing (voice call phishing)
With phone-based phishing attempts, sometimes called voice phishing or “vishing,” the
phisher calls claiming to represent your local bank, the police, or even the IRS. Next,
they scare you with some sort of problem and insist you clear it up immediately by
sharing your account information or paying a fine. They usually ask that you pay with
a wire transfer or with prepaid cards, so they are impossible to track.
Smishing (SMS or text message phishing)
SMS phishing, or “smishing,” is vishing's evil twin, carrying out the same kind of scam
(sometimes with an embedded malicious link to click) by means of SMS texting.
9|Module No: 1
Backdoor
• A backdoor virus or remote access Trojan (RAT) secretly creates a backdoor into an
infected computer system that enables threat actors to remotely access it without
alerting the user or the system's security programs.
Rootkits
• A rootkit is "a program or, more often, a collection of software tools that gives a
threat actor remote access to and control over a computer or other system." It gets
its name because it's a kit of tools that (generally illicitly) gain root
access (administrator-level control, in Unix terms) over the target system, and use
that power to hide their presence.
Denial of Service Attacks
A Denial-of-Service (DoS) attack is an attack meant to shut down a machine or
network, making it inaccessible to its intended users. DoS attacks accomplish this by
flooding the target with traffic, or sending it information that triggers a crash. In both
instances, the DoS attack deprives legitimate users (i.e. employees, members, or
account holders) of the service or resource they expected.
Victims of DoS attacks often target web servers of high-profile organizations such as
banking, commerce, and media companies, or government and trade organizations.
Though DoS attacks do not typically result in the theft or loss of significant information
or other assets, they can cost the victim a great deal of time and money to handle.
There are two general methods of DoS attacks: flooding services or crashing services.
Flood attacks occur when the system receives too much traffic for the server to buffer,
causing them to slow down and eventually stop. Popular flood attacks include:
• Buffer overflow attacks – the most common DoS attack. The concept is to
send more traffic to a network address than the programmers have built the
system to handle. It includes the attacks listed below, in addition to others that
are designed to exploit bugs specific to certain applications or networks
• ICMP flood – leverages misconfigured network devices by sending spoofed
packets that ping every computer on the targeted network, instead of just one
10 | M o d u l e N o : 1
specific machine. The network is then triggered to amplify the traffic. This
attack is also known as the smurf attack or ping of death.
• SYN flood – sends a request to connect to a server, but never completes
the handshake. Continues until all open ports are saturated with requests and
none are available for legitimate users to connect to.
Other DoS attacks simply exploit vulnerabilities that cause the target system or service
to crash. In these attacks, input is sent that takes advantage of bugs in the target that
subsequently crash or severely destabilize the system, so that it can’t be accessed or
used.
An additional type of DoS attack is the Distributed Denial of Service (DDoS)
attack. A DDoS attack occurs when multiple systems orchestrate a synchronized DoS
attack to a single target. The essential difference is that instead of being attacked from
one location, the target is attacked from many locations at once. The distribution of
hosts that defines a DDoS provide the attacker multiple advantages:
• He can leverage the greater volume of machine to execute a seriously disruptive
attack
• The location of the attack is difficult to detect due to the random distribution of
attacking systems (often worldwide)
• It is more difficult to shut down multiple machines than one
• The true attacking party is very difficult to identify, as they are disguised behind
many (mostly compromised) systems
Zombie
What is a zombie?
In computing, a zombie is a computer connected to a network that has been
compromised by a hacker, a virus or a Trojan. It can be used remotely for malicious
tasks.
Most owners of zombie computers do not realize that their system is being used in
this way, hence the comparison with the living dead. They are also used in DDoS
attacks in coordination with botnets in a way that resembles the typical zombie attacks
of horror films.
What are they used for?
11 | M o d u l e N o : 1
Zombies are frequently used in denial-of-service attacks (DDoS), which refers to the
saturation of websites with a multitude of computers accessing at the same time. As so
many users are making requests at the same time to the server hosting the Web page,
the server crashes, denying access to genuine users.
A variant of this type of saturation is known as degradation-of-service attack and uses
'pulsing zombies': degradation of the service by periodically saturating the websites at a
low intensity, with the intention of slowing down, instead of blocking, the targeted
website. Such attacks are difficult to detect, as the slow service may go undetected for
months or even years or is simply assumed to be due to other problems.
Zombies have also been used for sending spam. In 2005, it was estimated that between
50% and 80% of all spam in circulation had been sent by zombie computers. This
technique is useful for criminals as it helps them avoid detection and at the same
time reduce bandwidth costs (as the owners of the zombies will bear the cost).
This type of spam is also used for spreading Trojans, as this type of malware is not self-
replicating but relies on circulation via email in order to spread, unlike worms that
spread via other means. For similar reasons, zombies are also used for fraud against
sites with pay-per-click contextual ads, artificially increasing the number of hits.
12 | M o d u l e N o : 1