Malware: Definitions and Types
Chapter 2
Definitions and Timeline
Categorizing Malware
No agreed upon definitions
o
Even for “virus” and “worm”
Consider categories based on…
o
Self-replicating
o
Population growth
o
Parasitic
Then we name the different types
o
As defined by Aycock
Self-replicating Malware
Self-replicating malware
Actively attempts to propagate by
creating new copies
May also propagate passively
o
But this isn't self-replication
Called these “worms” (in CS 265)
Population Growth
Parasitic
Parasitic malware
Requires some other executable code
"Executable” taken very broadly
o
Boot block code on a disk
o
Binary code in applications
o
Application scripting languages
o
Source code that may require
compilation before executing, etc.
Types of Malware
Logic Bomb
Trojan
Back Door
Virus
Worm
Rabbit
Spyware/Adware
Other
Logic Bomb
Self-replicating: no
Population growth: 0
Parasitic: possibly
Consists of 2 parts
o
Payload --- action to be performed
o
Trigger --- event to execute payload
Donald Gene Burleson case (CS 265)
Trojan Horse
Self-replicating: no
Population growth: 0
Parasitic: yes
Name comes from ancient world
o
Pretends to be innocent, but it’s not
Example: fake login prompt that
steals passwords
Back Door
Self-replicating: no
Population growth: 0
Parasitic: possibly
Bypasses normal security checks
o
So enables unauthorized access
Example: Remote Administration Tool,
or RAT
Virus
Self-replicating: yes
Population growth: positive
Parasitic: yes
When executed, tries to replicate
itself into other executable code
o
So, it relies in some way on other code
Does
not
propagate via a network
Nice virus history given by Aycock
Worm
Self-replicating: yes
Population growth: positive
Parasitic: no
Like a virus, except…
o
Spreads over network
o
Worm is standalone, does not rely on
other code
Good history in Aycock’s book
Rabbit
Self-replicating: yes
Population growth: 0
Parasitic: no
Two kinds of rabbits
o
One uses up system resources
o
One uses up network resources (special
case of a worm)
Spyware
Self-replicating: no
Population growth: 0
Parasitic: no
Collects info and sends it to someone
o
Username/password, bank info, credit
card info, software license info, etc.
First mention is about 1995
May arrive via “drive-by download”
Adware
Self-replicating: no
Population growth: 0
Parasitic: no
Similar to spyware but focused on
marketing
Hybrids, Droppers, etc.
Hybrid is combination of different
types of malware
o
Worm that is a rabbit, trojan that acts
like a virus, etc., etc.
Dropper is malware that deposits
other malware
o
For example, a worm might leave behind
a back door…
Zombies
Compromised machines that can be
used by an attacker
o
Spam
o
Denial of service (DoS)
o
Distributed denial of service (DDoS)
Today, usually part of a botnet
Naming
No agreed on naming convention
Virus writer might suggest a name
o
“Your PC is now stoned!”
Different vendors might use
different names
Different variants might get
different names, etc.
Naming
Factors related to naming
o
Malware type
o
Family name
o
Variant
o
Modifiers (e.g., “mm” for “mass mailer”)
But many different names applied to
same virus (or family)
o
See book for examples
Authorship
Author and distributor may differ
Is malware author a “hacker” or
“cracker”?
o
It depends on your definitions…
So, Aycock does not use terms like
hacker or cracker
o
Instead, uses boring terms like malware
author, malware writer, virus writer, etc.
Malware Writers
Botnet hacker caught in Slovenia
(2010)
Japanese Virus Writer Arrested for
the Second Time
(2010)
o
"I wanted to see how much my computer
programming skills had improved since the
last time I was arrested."
Teen Arrested in Blaster Case
(2003)
No 'sorry' from Love Bug author
(2005)
Timeline
Explore the diverse world of malware with definitions, categories, and examples such as self-replicating malware, population growth, parasitic malware, logic bombs, trojans, backdoors, viruses, and more. Gain insights into the characteristics and behaviors of different types of malware to enhance your understanding of cybersecurity threats.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Chapter 2 Definitions and Timeline
Categorizing Malware No agreed upon definitions o Even for virus and worm Consider categories based on o Self-replicating o Population growth o Parasitic Then we name the different types o As defined by Aycock
Self-replicating Malware Self-replicating malware Actively attempts to propagate by creating new copies May also propagate passively o But this isn't self-replication Called these worms (in CS 265)
Population Growth Population growth Describes change in the number of instances due to self-replication Malware that doesn't self-replicate will have a zero population growth o But malware with a zero population growth may self-replicate
Parasitic Parasitic malware Requires some other executable code "Executable taken very broadly o Boot block code on a disk o Binary code in applications o Application scripting languages o Source code that may require compilation before executing, etc.
Types of Malware Logic Bomb Trojan Back Door Virus Worm Rabbit Spyware/Adware Other
Logic Bomb Self-replicating: no Population growth: 0 Parasitic: possibly Consists of 2 parts o Payload --- action to be performed o Trigger --- event to execute payload Donald Gene Burleson case (CS 265)
Trojan Horse Self-replicating: no Population growth: 0 Parasitic: yes Name comes from ancient world o Pretends to be innocent, but it s not Example: fake login prompt that steals passwords
Back Door Self-replicating: no Population growth: 0 Parasitic: possibly Bypasses normal security checks o So enables unauthorized access Example: Remote Administration Tool, or RAT
Virus Self-replicating: yes Population growth: positive Parasitic: yes When executed, tries to replicate itself into other executable code o So, it relies in some way on other code Does not propagate via a network Nice virus history given by Aycock
Worm Self-replicating: yes Population growth: positive Parasitic: no Like a virus, except o Spreads over network o Worm is standalone, does not rely on other code Good history in Aycock s book
Rabbit Self-replicating: yes Population growth: 0 Parasitic: no Two kinds of rabbits o One uses up system resources o One uses up network resources (special case of a worm)
Spyware Self-replicating: no Population growth: 0 Parasitic: no Collects info and sends it to someone o Username/password, bank info, credit card info, software license info, etc. First mention is about 1995 May arrive via drive-by download
Adware Self-replicating: no Population growth: 0 Parasitic: no Similar to spyware but focused on marketing
Hybrids, Droppers, etc. Hybrid is combination of different types of malware o Worm that is a rabbit, trojan that acts like a virus, etc., etc. Dropper is malware that deposits other malware o For example, a worm might leave behind a back door
Zombies Compromised machines that can be used by an attacker o Spam o Denial of service (DoS) o Distributed denial of service (DDoS) Today, usually part of a botnet
Naming No agreed on naming convention Virus writer might suggest a name o Your PC is now stoned! Different vendors might use different names Different variants might get different names, etc.
Naming Factors related to naming o Malware type o Family name o Variant o Modifiers (e.g., mm for mass mailer ) But many different names applied to same virus (or family) o See book for examples
Authorship Author and distributor may differ Is malware author a hacker or cracker ? o It depends on your definitions So, Aycock does not use terms like hacker or cracker o Instead, uses boring terms like malware author, malware writer, virus writer, etc.
Malware Writers Botnet hacker caught in Slovenia (2010) Japanese Virus Writer Arrested for the Second Time (2010) o "I wanted to see how much my computer programming skills had improved since the last time I was arrested." Teen Arrested in Blaster Case (2003) No 'sorry' from Love Bug author (2005)
