MODULE I
Syllabus: - Introduction to malware, OS security
concepts, malware threats, evolution of malware,
malware types: viruses, worms, rootkits, Trojans, bots,
spyware, adware, logic bombs. Types of malware
Analysis – Static Analysis, Dynamic Analysis, Malware
Analysis Techniques - Obfuscated, De-obfuscated,
Malware Analysis Tools - Static Analysis Tools, Dynamic
Analysis Tools. Antivirus Scanning, Fingerprint for
Malware.
[Link]
What is Malware?
Definition
• Malware, short for "malicious software," is any
software intentionally designed to cause harm
to a computer system or network.
• Malware is a weapon used by malicious entities
to execute sinister motives. In technical terms,
malware (or rather mal-ware) is malicious
software—a piece of software whose intentions
are malicious.
[Link]
Goals
Malware can have various goals, including
• data theft
• system disruption
• data destruction
• spying
• spreading itself.
[Link]
Operating System Security
1 User Authentication 2 Access Control
User Permissions: Defining what each user can
Password-Based Authentication: Ensuring that
and cannot do within the system (e.g., read, write,
only authorized users can access the system by
execute).
requiring strong passwords.
Role-Based Access Control (RBAC): Assigning
Multi-Factor Authentication (MFA): Adding an
permissions based on the roles users have within
extra layer of security by requiring more than one
an organization.
form of verification.
[Link]
Operating System Security
4 Security Patches and Updates
3 Data Encryption
Regular Updates: Keeping the OS and software up-to-
Disk Encryption: Protecting data at rest by encrypting the
date to protect against known vulnerabilities.
contents of the storage devices.
Patch Management: Systematically deploying
File Encryption: Encrypting specific files to prevent
updates to fix security issues.
unauthorized access.
[Link]
Operating System Security 6 Audit and Logging:
5 Intrusion Detection and Prevention
Logging: Keeping detailed records of system
Intrusion Detection Systems (IDS): Monitoring the system for
activities and user actions.
suspicious activity and potential threats.
Auditing: Regularly reviewing logs to detect
Intrusion Prevention Systems (IPS): Proactively blocking
and investigate suspicious activities.
identified threats before they can cause harm.
[Link]
Operating System Security
7 Malware Protection: 8 Network Security:
Antivirus Software: Detecting and removing malicious Firewalls: Controlling incoming and outgoing network
software. traffic based on security rules.
Anti-Malware Tools: Providing additional layers of Virtual Private Networks (VPNs): Creating secure
protection against various types of malwares. connections over potentially untrusted networks.
[Link]
Operating System Security
9 Security Policies:
10 Backup and Recovery:
Security Configurations: Defining and enforcing security Data Backups: Regularly backing up
settings and policies. important data to prevent loss.
User Training and Awareness: Educating users about Disaster Recovery Plans: Preparing
security best practices and potential threats. strategies to recover from security
incidents and system failures.
[Link]
Malware Threats
Data Theft System Disruption
Stealing personal, financial, or Causing systems to crash or operate
confidential information, leading to inefficiently, resulting in downtime,
identity theft, financial fraud, and loss of productivity, and potential
loss of sensitive information. damage to hardware.
Data Destruction Financial Loss
Deleting or corrupting files and data, Resulting from ransom payments,
leading to loss of critical unauthorized transactions, or
information, recovery costs, and business losses, leading to direct
potential legal issues. financial impact, loss of revenue,
and potential legal liabilities.
[Link]
Types of Malware
Spyware
Viruses Worms
Secretly monitors user Attach to legitimate files and Self-replicating malware that
activities and collects programs, spreading when spreads through networks,
information. these files are executed. causing network congestion
and system failures.
Often bundled with legitimate
software or downloaded from
malicious websites. Trojan Horses Ransomware
Malicious software disguised Encrypts data and demands a
Can capture personal as legitimate software, often ransom for the decryption
information, browsing habits, downloaded and installed by key, often spreading through
and other sensitive data. users who believe it to be safe. phishing emails, malicious
downloads, or exploit
kits(automated frameworks
designed to identify security
flaws in systems.)
[Link]
Types of Malware
Adware Rootkit Botnet Logic Bomb
Displays unwanted Provides unauthorized access Network of infected devices Malicious code that triggers
advertisements. to and control over a controlled by attackers. destructive actions when
computer. certain conditions are met.
Often bundled with free Often spreads through
software or downloaded Often installed by other vulnerabilities in software Often hidden within
from malicious websites. malware or through or network protocols. legitimate software or
compromised software. installed by attackers.
Can slow down systems, and Used for coordinated Can delete or corrupt data,
track user behavior. Hides its presence and the tasks like DDoS attacks, disrupt operations, and
presence of other malware, sending spam, or mining cause significant damage
making detection difficult. cryptocurrencies when triggered.
.
[Link]
Evolution of Malware
1970s-1980s 1
The early days of malware, with the Creeper virus and
Elk Cloner, spreading through floppy disks.
2 1990s
The rise of computer viruses, with the AIDSTrojan, the
first ransomware, and the ConceptVirus, targeting
2000s 3 Microsoft Word documents.
The internet era, with the ILOVEYOU virus, CodeRed
and Nimda worms, and MyDoom worm, spreading
rapidly across the internet. 4 2010s
Advanced persistent threats and ransomware, with
Stuxnet worm, Cryptolocker, WannaCry, and
2020s 5 NotPetya, causing massive global disruptions.
Fileless malware, AI-powered malware, and supply
chain attacks, targeting the software supply chain to
distribute malware through trusted software updates.
[Link]
Malware Analysis Techniques
Static Analysis Dynamic Analysis
Examining the malware without executing it, using Running the malware in a controlled environment
tools like disassemblers and debuggers to to observe its behavior, using tools like sandboxes
understand its structure and functionality. and virtual machines to isolate the malware and
prevent it from causing harm.
[Link]
Antivirus Scanning and
Fingerprinting
Antivirus Scanning
Using antivirus software to detect and remove
malicious software by comparing the malware's
signature or behavior to a database of known
threats.
Fingerprint for Malware
Creating a unique fingerprint for each malware
sample, based on its characteristics, to identify
and track its spread and evolution.
[Link]