Malware: Types, Usage, and Protection
M
A
L
W
A
R
E
•
Malware
•
Usage of Malware
•
Types of Malware
•
How Malware Spreads?
•
How Can You Protect Computer?
•
Symptoms
•
Anti-Malware Program
M
a
l
w
a
r
e
•
Short for
mal
icious soft
ware.
•
A malicious software is used or created to
disrupt computer
operation, gather sensitive information, or gain access to private
computer systems
.
•
It can appear in the form of code, scripts, active content, and other
software.
•
'Malware' is a general term used to refer to a variety of forms of
hostile, intrusive, or annoying software
U
s
a
g
e
o
f
M
a
l
w
a
r
e
•
Many early infectious programs, including the first Internet Worm,
were written as experiments or pranks.
•
Today, malware is used primarily to steal sensitive, personal, financial,
or business information for the benefit of others.
•
Malware is sometimes used broadly against government or corporate
websites to gather guarded information, or to disrupt their operation
in general.
•
However, malware is often used against individuals to gain personal
information such as social security numbers, bank or credit card
numbers, and so on.
T
y
p
e
s
o
f
M
a
l
w
a
r
e
•
Viruses
•
Trojan horses
•
Worms
•
Spyware
•
Zombie
•
Phishing
•
Spam
•
Adware
•
Ransomware
•
Botnet
V
i
r
u
s
e
s
•
A computer virus is a malicious piece of executable code that
propagates typically by attaching itself to a host document that
will generally be an executable file.
•
A program or piece of code that is loaded onto your computer
without your knowledge and runs against your wishes.
•
Viruses can also replicate themselves.
•
All computer viruses are manmade.
•
Viruses copy themselves to other disks to spread to other
computers.
•
They can be merely annoying or they can be vastly destructive to
your files.
V
i
r
u
s
g
o
t
h
r
o
u
g
h
f
o
u
r
s
t
a
g
e
s
1.
Dormant phase – not all have this stage.
2.
Propagation phase – copies itself
3.
Triggering phase – caused by some event
•
count of the number of copies made
•
A particular date, etc
4.
Execution phase – do damage!
E
x
a
m
p
l
e
s
o
f
f
a
m
o
u
s
v
i
r
u
s
e
s
•
1981 – first computer virus
written by 15 yr old student named Richard Skernta
used floppy disk to travel between machines
•
1988 – Jerusalem
Infected both .EXE and .COM files
Friday 13
th
it deleted all programs in the infected system
Boot sector viruses – Yale from USA, Stoned form New Zealand, Ping Pong from Italy
first self-encrypting virus
•
1991 – first polymorphic virus (Tequila): change pattern and encrypt itself.
•
Michelangelo (traditional virus)
•
1998 – Chernobyl
launched in Taiwan – infecting .exe files
remained resident in the memory
overwrite data on the hard drive making it inoperable
overwrites BIOS preventing boot-up
estimated damage $20 to $80 million
•
1999 – Melissa – mass mailer
Used Outlook to send email messages of itself to 50 names on the contact list of a
user
Message read: “Here is that document you asked for don’t show anyone else.”
Infected 15 to 20 percent of all business PCs
Estimated damage between $300 and $600 million
•
2000 – I love You Virus – spread via Outlook
file attachment, over-written files
T
y
p
e
s
o
f
v
i
r
u
s
e
s
•
Parasitic – traditional
•
Memory-resident: infects every program that runs
•
Boot sector – infects the master boot record
•
Polymorphic – mutates with each infection
creates copies that are functionally equivalent, but have different bit
patterns
may randomly insert superfluous instructions or interchange the order
May use encryption – each infection generates a different random key
•
Stealth – uses compression – intercept I/O subroutines
•
Macro Viruses – two thirds of all computer viruses
Aimed at MS Word docs
A
n
t
i
v
i
r
u
s
P
r
o
t
e
c
t
i
o
n
•
Prevention – IPS such as firewall
•
Detection (locate the virus)
•
Identification (identify the specific virus)
•
Removal – using antivirus and other tools
Currently four generations of antivirus software
•
Scanners
•
Heuristic rules – look for fragments of code
•
Memory-resident programs – watch for activity associated with infection
attempts
•
Fourth gen. uses all of these + access control capability, which limits
ability of viruses to penetrate a system.
T
r
o
j
a
n
H
o
r
s
e
s
•
A Trojan Horse program has the appearance of having a useful
and desired function.
•
A Trojan Horse neither replicates nor copies itself, but causes
damage or compromises the security of the computer.
•
A Trojan Horse must be sent by someone or carried by another
program and may arrive in the form of a joke program or software of
some sort.
•
These are often used to capture your logins and passwords.
•
Uses social engineering
E
x
a
m
p
l
e
o
f
T
r
o
j
a
n
H
o
r
s
e
s
•
“Naked Wife”: mass-mailed Trojan if executed, can delete files necessary for
everyday computer operation.
•
Zeus Trojan (infiltrates through spam emails): developed by hackers to steal
banking details from infected devices.
•
Remote access Trojans (RATs): sent as an email attachment and create a
backdoor for administrative control over the target computer.
•
Backdoor Trojans (backdoors)
•
IRC Trojans (IRCbots) – Trojans use Internet Relay Chat (IRC)
•
Keylogging Trojans:
•
NetBus - is Trojan horse malware created in 1998 with the target to
remotely control a system running windows OS. Like any other Trojan,
NetBus also has 2 components: the client and server. The server infects the
host computer and the client is used to control it.
E
x
a
m
p
l
e
o
f
T
r
o
j
a
n
H
o
r
s
e
s
•
Keylogging Trojans: keylogging or keyboard capturing, is the action of
recording (logging) the keys struck on a keyboard, typically covertly, so that
person using the keyboard is unaware that their actions are being
monitored.
W
O
R
M
S
•
A computer worm is a self-replicating computer program.
•
It uses a network to send copies of itself to other nodes (computers on
the network) and it may do so without any user intervention.
•
It does not need to attach itself to an existing program.
•
Worm uses one of the following:
Email facility
Remote execution capability – executes a copy of itself on another system
Remote login capability – worm logs in as a user
File-sharing services
E
x
a
m
p
l
e
o
f
a
T
y
p
i
c
a
l
W
o
r
m
1.
Scan for hosts running infected product
Check if port is open
Check version or even try to infect anyway
2.
Download/infect machine with code which will continue the spread
of the worm
Once in, downloads tools from third party host, or even download more
copies of itself
3.
Issuing a payload
Deleting, modification, back-dooring, flooding or other related activity
4.
Scan more hosts and repeat
Repeat Step 1
M
o
r
r
i
s
w
o
r
m
•
Released by Robert Morris – 1988
one of the first computer worms distributed via the Internet. It was the first to
gain significant mainstream media attention. According to its creator, the Morris
worm was not written to cause damage, but to gauge the size of the Internet.
•
Quite sophisticated
•
Tried a variety of methods for gaining access:
Attempted to login to a remote host as a legitimate user
Exploited a bug in finger protocol (port 79)
•
Sentenced to 400 hours community service and $10,000 fine
C
o
d
e
R
e
d
–
J
u
l
y
2
0
0
1
•
Two variants – attacked MS IIS servers
•
Operated in three stages: scanning, flooding and sleeping
•
Scanning phase phase: searched for vulnerable computers (MS II
servers)
•
Flooding phase: DoS attack on the White House Website
•
Sleep mode could last indefinitely
•
Replaced website text with the phrase “hacked by Chinese.”
•
At its peak, it infected 2,000 machines every minute = 250,000 under 9
hours.
C
o
d
e
R
e
d
I
I
•
Variant of Code Red
•
Exploited the same vulnerability as Code Red
•
Gave the attacker control over the infected system
•
Each variant was smarter than the previous one
•
Many MS IIS servers had not been patched
•
Alarm messages arrived in first few hours
•
No one was monitoring these systems
•
Emails bounced
•
Worm continue unchecked for days
Sobig Worm – August 03 – has six variants
•
Some features similar to a Trojan virus because it disguises itself as
electronic mail
•
Example: Mydoom – January 2004
Also known as Novang, Shimgapi e.g.
W32.MyDoom@mm
, and Mimail.R
Record for the fastest-spreading e-mail worm
100,000 infected emails per hour were blocked
Gets computer user to open an infected email attachment – installed a backdoor
Worst email worm to date
$250,000 bounty for creator of these worms
B
l
a
s
t
e
r
W
o
r
m
–
A
u
g
u
s
t
2
0
0
3
•
Also known as Lovsan or Lovesan
•
Focus on Windows 2000 and Windows XP OS
•
Attack 120,000 unpatched systems during first 36 hrs
•
DoS attack on MS Windows Update Website
•
Caused OS to crack
•
Contains two messages
“I just want to say Love You San” – hence the name
“Billy Gates why do you make this possible? Stop making money and fix your
software”
•
Infected over 1 million computers
C
o
n
f
l
i
c
k
e
r
W
o
r
m
•
Modifies the Registry
•
Resets PC’s System Restore point
•
Downloads files from the hacker’s website
S
t
u
x
n
e
t
W
o
r
m
–
J
u
l
y
1
3
,
2
0
1
0
•
Targets industrial control systems – known as SCADA systems
•
If found it attempts to steal code and design projects
•
Exploits four zero-day vulnerabilities
Link fine vulnerability to spread through USB drives
Remote code execution vulnerability
Two local priviledge escalation vulnerabilities
Stuxnet worm – target Iran, specifically industrial to cool the fans or reduce the fan
of a nuclear reactor.
D
e
f
e
n
c
e
s
A
g
a
i
n
s
t
W
o
r
m
s
•
Modus operandi of true worms is to exploit a known vulnerability
•
Key defence – latest patches
•
Host-based IDS – detects unauthorized system activity
•
Network-based IDS – detects signatures of known worms
•
Antivirus software for email worms
•
Don’t run executables or open files from unknown sources!
A
d
w
a
r
e
a
n
d
S
p
y
w
a
r
e
•
Annoying and deceptive software
•
Information gathering programs
•
Designed to monitor user behavior
•
Includes – spyware, adware and spam
•
Adware
– (short for advertising-supported software) is a type of malware
that automatically delivers advertisements.
Economically motivated e.g. online advertisements
Collects info about your surfing habits – with or without your knowledge
Not illegal and Not necessarily malicious
Common examples of adware include pop-up ads on websites and advertisements that
are displayed by software.
Often times software and applications offer “free versions that come bundled with
adware.
S
p
y
w
a
r
e
•
Spyware
is a type of malware installed on computers that collects
information about users without their knowledge.
•
The presence of spyware is typically hidden from the user and can be
difficult to detect.
•
Spyware programs lurk on your computer to steal important information,
like your passwords and logins and other personal identification
information and then send it off to someone else.
S
p
y
w
a
r
e
d
o
e
s
n
o
t
d
i
r
e
c
t
l
y
s
p
r
e
a
d
l
i
k
e
a
v
i
r
u
s
o
r
w
o
r
m
1.
Installed without user’s knowledge
Usually presented as a useful utility, which users download and install
Example:
Web accelerator
Bonzi Buddy – targeted at children
2.
Bundled with shareware and other free software
When the user installs it – also install spyware
3.
Tricks users by manipulating security features
Download requires a user action
No matter which “button” the user presses, a download starts
•
Spyware – exist as independent executable programs
•
Have the capability to:
Monitor your keystrokes
Scan files on the hard drive
Snoop other applications, such as chat programs or word processors
Install other spyware programs
Read cookies
Change the default home page on the Web browser
Consistently relaying information back to the spyware author
•
Can slow down your computer
S
p
a
m
Spam
•
Spam is email that you did not
request and do not want.
•
One person's spam is another's useful
newsletter or sale ad.
•
Spam is a common way to spread
viruses, trojans, and the like.
Z
o
m
b
i
e
•
Zombie
programs take control of your computer and use it and its Internet
connection to attack other computers or networks or to perform other
criminal activities.
P
h
i
s
h
i
n
g
•
Phishing (pronounced like the word 'fishing') is a message that tries to
trick you into providing information like your social security number or
bank account information or logon and password for a web site.
•
The message may claim that if you do not click on the link in the
message and log onto a financial web site that your account will be
blocked, or some other disaster.
R
a
n
s
o
m
w
a
r
e
•
Ransomware is a form of malware that essentially holds a computer
system captive while demanding a ransom.
It restricts user access to the computer either by encrypting files on the hard
drive or locking down the system and displaying messages that are intended to
force the user to pay the malware creator to remove the restrictions and regain
access to their computer.
In 2012, a major ransomware known as Reveton began to spread. It displayed a
warning purportedly from a law enforcement agency claiming that the computer
has been used for illegal activities, such as downloading unlicensed software or
child pornography. Due to this behavior, it is commonly referred to as the "Police
Trojan".
B
u
f
f
e
r
O
v
e
r
f
l
o
w
•
Advanced hacking technique
•
Requires some skill and programming knowledge
•
Aim – utilize a vulnerable/security hole
•
Objective – to gain root priviledges
•
How does it work?: when a program is executed, it is mapped into
memory in an organized manner.
•
The defence: buffer overflow attacks often take advantage of poor
application programming.
Write secure code
B
o
t
s
•
Programs that perform some predefined actions in an automated way.
•
A bot is a computer that has been compromised through a malware
infection and can be controlled remotely by a cyber criminal.
•
Cause: software vulnerabilities, IE misconfiguration, or opening an email
attachment.
•
Used for DDoS attacks – similar to zombies
•
Spam: spammers pay to access bots that run email-gateways
•
Harder to block is spam from multiple sources
•
Harvesting valuable information – includes online banking credentials,
software activation license keys, etc
•
Secondary infection – scanning and creating more zombies.
B
o
t
n
e
t
E
x
a
m
p
l
e
Zeus
•
Began to spread in 2006
•
Objective – stealing banking information by keystroke logging (tracking/
logging the keys struck on a keyboard) and form grabbing
•
Purchased for around $3000-4000
Storm
•
Uses email spamming and phishing websites
•
Begins gathering infected computers into the storm botnet
•
Infected 1.7 million computers
•
Responsible for blasting out 20 percent of spam sent worldwide
•
Storm 2.0 strain 2010
relays junk e-mail advertising male enhancement pills and adult websites
A
c
t
i
o
n
•
Keystroke logging – passwords to get keys to decrypt the packets
•
Sniffing Traffic – watching for clear text passwords
•
Installing Advertisement Add-ons
Set up a fake website with some advertisement
Negotiate a deal with hosting companies that pay for clicks on adds
Bots click on the pop-ups
•
Manipulating online polls/games
•
Mass identity theft – “phishing mails”
•
Spreading new malware
H
o
w
M
a
l
w
a
r
e
S
p
r
e
a
d
s
?
•
Malware is a program that must be triggered or somehow
executed before it can infect your computer system and spread to
others.
•
Here are some examples on how malware is distributed:
a) Social network
b) Pirated software
c) Removable media
d) Emails
e) Websites
D
a
m
a
g
e
s
1.
Data Loss
- Many viruses and Trojans will attempt to delete files or wipe hard drives
when activated, but even if you catch the infection early, you may have to delete
infected files.
2. Account Theft
•
Many types of malware include keylogger functions, designed to steal accounts and
passwords from their targets.
•
This can give the malware author access to any of the user's online accounts, including
email servers from which the hacker can launch new attacks.
3. Botnets
•
Many types of malware also subvert control over the user's computer, turning it into a
"bot" or "zombie."
•
Hackers build networks of these commandeered computers, using their combined
processing power for tasks like cracking password files or sending out bulk emails.
D
a
m
a
g
e
s
c
o
n
t
d
4. Financial Losses
•
If a hacker gains access to a credit card or bank account via a keylogger,
he can then use that information to run up charges or drain the
account.
•
Given the popularity of online banking and bill payment services, a
hacker who manages to secrete a keylogger on a user's system for a full
month may gain access to the user's entire financial portfolio, allowing
him to do as much damage as possible in a single attack.
H
o
w
C
a
n
Y
o
u
P
r
o
t
e
c
t
Y
o
u
r
C
o
m
p
u
t
e
r
?
•
Install protection software.
•
Practice caution when working with files from unknown or
questionable sources.
•
Do not open e-mail if you do not recognize the sender.
•
Download files only from reputable Internet sites.
•
Install firewall.
•
Scan your hard drive for viruses monthly.
S
y
m
p
t
o
m
s
•
Increased CPU usage
•
Slow computer or web browser speeds
•
Problems connecting to networks
•
Freezing or crashing
•
Modified or deleted files
•
Appearance of strange files, programs, or desktop icons
•
Programs running, turning off, or reconfiguring themselves (malware will often
reconfigure or turn off antivirus and firewall programs)
•
Strange computer behavior
•
Emails/messages being sent automatically and without user’s knowledge (a friend
receives a strange email from you that you did not send)
•
There seems to be a lot of network activity when you are not using the network
•
The available memory on your computer is lower than it should be
•
Programs or files appear or disappear without your knowledge
•
File names are changed
A
n
t
i
-
M
a
l
w
a
r
e
P
r
o
g
r
a
m
•
Anti-Malware program is used to prevent, detect, and remove computer viruses,
worms, trojan horses and any other type of malware.
•
Examples of Anti-Malware program:
– Antivirus program
– Anti-spyware program
– Anti-spam program
– Firewall
Antivirus Program
•
“Antivirus" is protective software designed to defend your computer against
malicious software.
•
In order to be an effective defense, the antivirus software needs to run in the
background at all times, and should be kept updated so it recognizes new versions of
malicious software.
E
x
a
m
p
l
e
s
o
f
A
n
t
i
v
i
r
u
s
P
r
o
g
r
a
m
•
Norton Antivirus
•
AVG
•
Kaspersky
•
Avast!
•
PC-Cilin
•
McAffee
•
Avira
•
Panda
•
Etc.
A
n
t
i
-
S
p
y
w
a
r
e
P
r
o
g
r
a
m
•
Anti-spyware program is a type of program designed to prevent and detect
unwanted spyware program installations and to remove those programs if
installed.
•
Examples of Anti-spyware program:
Spyware Doctor
AVG Anti-spyware
STOPzilla
Spysweeper
Anti-Spam Program
•
Anti-spam software tries to identify useless or dangerous messages for
you.
F
i
r
e
w
a
l
l
•
A firewall blocks attempts to access your files over a network
or internet connection.
•
It blocks incoming attacks.
•
Your computer can become infected through shared disks
or
even from another computer on the network, so you
need to monitor what your computer is putting out over
the network or internet also.
S
u
m
m
a
r
y
•
Malicious code attacks work because of:
Flaws in software design
Vulnerabilities caused by insecure configurations
Social engineering
Human error and/or naïve users
Persistence on the part of hackers
L
A
B
–
P
i
n
g
o
f
D
e
a
t
h
•
Open a
Command Prompt
and set a
VERY
large sized, continuous Ping
going, directed at a chosen IP address (website)
Ping –t –l 65000
(IP address)
•
Repeat this ten more times in separate copies of the Command Prompt.
•
Then
Open a browser – visit the website and try to explore the site
Observe the effect on the website as more students direct these Pings
at the website
•
What was the effect on the website?
IP Addressing Example
View the IP address on your own computer
:
Ipconfig, ipconfig /all,
To find a computer name from an IP address or vice versa
“nslookup IP address/domain name” e.g nslookup abuad.edu.ng
To list all servers IP address between your computer and your
website: e.g. “tracert google.com”
IP
Motivation
IP
IP Addresses
I
I
I
References
[1] Class note by Adam C. Champion, Ph.D.
[2] Principle of Information Security by Michael E. Whitman, 5
th
Edition, Herbert J. Mattord.
[3] Network Security Essentials: Applications and Standards, 4
th
Edition, William Stallings.
Malware, short for malicious software, encompasses various forms of hostile software designed to disrupt computer operation, steal sensitive information, or gain unauthorized access. It includes viruses, trojan horses, worms, spyware, phishing, ransomware, and more. Malware is often used to steal personal, financial, or business data. Protecting your computer from malware involves awareness, using anti-malware programs, and practicing safe browsing habits. Learn about the types of malware, how they spread, and common symptoms to detect their presence.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
MALWARE MALWARE Malware Usage of Malware Types of Malware How Malware Spreads? How Can You Protect Computer? Symptoms Anti-Malware Program
Malware Malware Short for malicious software. A malicious software is used or created to disrupt computer operation, gather sensitive information, or gain access to private computer systems. It can appear in the form of code, scripts, active content, and other software. 'Malware' is a general term used to refer to a variety of forms of hostile, intrusive, or annoying software
Usage Usage of Malware of Malware Many early infectious programs, including the first Internet Worm, were written as experiments or pranks. Today, malware is used primarily to steal sensitive, personal, financial, or business information for the benefit of others. Malware is sometimes used broadly against government or corporate websites to gather guarded information, or to disrupt their operation in general. However, malware is often used against individuals to gain personal information such as social security numbers, bank or credit card numbers, and so on.
Types of Malware Types of Malware Viruses Trojan horses Worms Spyware Zombie Phishing Spam Adware Ransomware Botnet
Viruses Viruses A computer virus is a malicious piece of executable code that propagates typically by attaching itself to a host document that will generally be an executable file. A program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are manmade. Viruses copy themselves to other disks to spread to other computers. They can be merely annoying or they can be vastly destructive to your files.
Virus go through four stages Virus go through four stages 1. Dormant phase not all have this stage. 2. Propagation phase copies itself 3. Triggering phase caused by some event count of the number of copies made A particular date, etc 4. Execution phase do damage!
Examples of famous viruses Examples of famous viruses 1981 first computer virus written by 15 yr old student named Richard Skernta used floppy disk to travel between machines 1988 Jerusalem Infected both .EXE and .COM files Friday 13thit deleted all programs in the infected system Boot sector viruses Yale from USA, Stoned form New Zealand, Ping Pong from Italy first self-encrypting virus 1991 first polymorphic virus (Tequila): change pattern and encrypt itself. Michelangelo (traditional virus)
1998 Chernobyl launched in Taiwan infecting .exe files remained resident in the memory overwrite data on the hard drive making it inoperable overwrites BIOS preventing boot-up estimated damage $20 to $80 million 1999 Melissa mass mailer Used Outlook to send email messages of itself to 50 names on the contact list of a user Message read: Here is that document you asked for don t show anyone else. Infected 15 to 20 percent of all business PCs Estimated damage between $300 and $600 million 2000 I love You Virus spread via Outlook file attachment, over-written files
Types of viruses Types of viruses Parasitic traditional Memory-resident: infects every program that runs Boot sector infects the master boot record Polymorphic mutates with each infection creates copies that are functionally equivalent, but have different bit patterns may randomly insert superfluous instructions or interchange the order May use encryption each infection generates a different random key Stealth uses compression intercept I/O subroutines Macro Viruses two thirds of all computer viruses Aimed at MS Word docs
Antivirus Protection Antivirus Protection Prevention IPS such as firewall Detection (locate the virus) Identification (identify the specific virus) Removal using antivirus and other tools Currently four generations of antivirus software Scanners Heuristic rules look for fragments of code Memory-resident programs watch for activity associated with infection attempts Fourth gen. uses all of these + access control capability, which limits ability of viruses to penetrate a system.
Trojan Horses Trojan Horses A Trojan Horse program has the appearance of having a useful and desired function. A Trojan Horse neither replicates nor copies itself, but causes damage or compromises the security of the computer. A Trojan Horse must be sent by someone or carried by another program and may arrive in the form of a joke program or software of some sort. These are often used to capture your logins and passwords. Uses social engineering
Example of Trojan Horses Example of Trojan Horses Naked Wife : mass-mailed Trojan if executed, can delete files necessary for everyday computer operation. Zeus Trojan (infiltrates through spam emails): developed by hackers to steal banking details from infected devices. Remote access Trojans (RATs): sent as an email attachment and create a backdoor for administrative control over the target computer. Backdoor Trojans (backdoors) IRC Trojans (IRCbots) Trojans use Internet Relay Chat (IRC) Keylogging Trojans: NetBus - is Trojan horse malware created in 1998 with the target to remotely control a system running windows OS. Like any other Trojan, NetBus also has 2 components: the client and server. The server infects the host computer and the client is used to control it.
Example of Trojan Horses Example of Trojan Horses Keylogging Trojans: keylogging or keyboard capturing, is the action of recording (logging) the keys struck on a keyboard, typically covertly, so that person using the keyboard is unaware that their actions are being monitored.
WORMS WORMS A computer worm is a self-replicating computer program. It uses a network to send copies of itself to other nodes (computers on the network) and it may do so without any user intervention. It does not need to attach itself to an existing program. Worm uses one of the following: Email facility Remote execution capability executes a copy of itself on another system Remote login capability worm logs in as a user File-sharing services
Example of a Typical Worm Example of a Typical Worm 1. Scan for hosts running infected product Check if port is open Check version or even try to infect anyway 2. Download/infect machine with code which will continue the spread of the worm Once in, downloads tools from third party host, or even download more copies of itself 3. Issuing a payload Deleting, modification, back-dooring, flooding or other related activity 4. Scan more hosts and repeat Repeat Step 1
Morris worm Morris worm Released by Robert Morris 1988 one of the first computer worms distributed via the Internet. It was the first to gain significant mainstream media attention. According to its creator, the Morris worm was not written to cause damage, but to gauge the size of the Internet. Quite sophisticated Tried a variety of methods for gaining access: Attempted to login to a remote host as a legitimate user Exploited a bug in finger protocol (port 79) Sentenced to 400 hours community service and $10,000 fine
Code Red Code Red July 2001 July 2001 Two variants attacked MS IIS servers Operated in three stages: scanning, flooding and sleeping Scanning phase phase: searched for vulnerable computers (MS II servers) Flooding phase: DoS attack on the White House Website Sleep mode could last indefinitely Replaced website text with the phrase hacked by Chinese. At its peak, it infected 2,000 machines every minute = 250,000 under 9 hours.
Code Red II Code Red II Variant of Code Red Exploited the same vulnerability as Code Red Gave the attacker control over the infected system Each variant was smarter than the previous one Many MS IIS servers had not been patched Alarm messages arrived in first few hours No one was monitoring these systems Emails bounced Worm continue unchecked for days
Sobig Worm August 03 has six variants Some features similar to a Trojan virus because it disguises itself as electronic mail Example: Mydoom January 2004 Also known as Novang, Shimgapi e.g. W32.MyDoom@mm, and Mimail.R Record for the fastest-spreading e-mail worm 100,000 infected emails per hour were blocked Gets computer user to open an infected email attachment installed a backdoor Worst email worm to date $250,000 bounty for creator of these worms
Blaster Worm Blaster Worm August 2003 August 2003 Also known as Lovsan or Lovesan Focus on Windows 2000 and Windows XP OS Attack 120,000 unpatched systems during first 36 hrs DoS attack on MS Windows Update Website Caused OS to crack Contains two messages I just want to say Love You San hence the name Billy Gates why do you make this possible? Stop making money and fix your software Infected over 1 million computers
Conflicker Conflicker Worm Worm Modifies the Registry Resets PC s System Restore point Downloads files from the hacker s website
Stuxnet Stuxnet Worm Worm July 13, 2010 July 13, 2010 Targets industrial control systems known as SCADA systems If found it attempts to steal code and design projects Exploits four zero-day vulnerabilities Link fine vulnerability to spread through USB drives Remote code execution vulnerability Two local priviledge escalation vulnerabilities Stuxnet worm target Iran, specifically industrial to cool the fans or reduce the fan of a nuclear reactor.
Defences Defences Against Worms Against Worms Modus operandi of true worms is to exploit a known vulnerability Key defence latest patches Host-based IDS detects unauthorized system activity Network-based IDS detects signatures of known worms Antivirus software for email worms Don t run executables or open files from unknown sources!
Adware and Spyware Adware and Spyware Annoying and deceptive software Information gathering programs Designed to monitor user behavior Includes spyware, adware and spam Adware (short for advertising-supported software) is a type of malware that automatically delivers advertisements. Economically motivated e.g. online advertisements Collects info about your surfing habits with or without your knowledge Not illegal and Not necessarily malicious Common examples of adware include pop-up ads on websites and advertisements that are displayed by software. Often times software and applications offer free versions that come bundled with adware.
Spyware Spyware Spyware is a type of malware installed on computers that collects information about users without their knowledge. The presence of spyware is typically hidden from the user and can be difficult to detect. Spyware programs lurk on your computer to steal important information, like your passwords and logins and other personal identification information and then send it off to someone else.
Spyware does not directly spread like a virus or worm Spyware does not directly spread like a virus or worm 1. Installed without user s knowledge Usually presented as a useful utility, which users download and install Example: Web accelerator Bonzi Buddy targeted at children 2. Bundled with shareware and other free software When the user installs it also install spyware 3. Tricks users by manipulating security features Download requires a user action No matter which button the user presses, a download starts
Spyware exist as independent executable programs Have the capability to: Monitor your keystrokes Scan files on the hard drive Snoop other applications, such as chat programs or word processors Install other spyware programs Read cookies Change the default home page on the Web browser Consistently relaying information back to the spyware author Can slow down your computer
Spam Spam Spam Spam is email that you did not request and do not want. One person's spam is another's useful newsletter or sale ad. Spam is a common way to spread viruses, trojans, and the like.
Zombie Zombie Zombie programs take control of your computer and use it and its Internet connection to attack other computers or networks or to perform other criminal activities.
Phishing Phishing Phishing (pronounced like the word 'fishing') is a message that tries to trick you into providing information like your social security number or bank account information or logon and password for a web site. The message may claim that if you do not click on the link in the message and log onto a financial web site that your account will be blocked, or some other disaster.
Ransomware Ransomware Ransomware is a form of malware that essentially holds a computer system captive while demanding a ransom. It restricts user access to the computer either by encrypting files on the hard drive or locking down the system and displaying messages that are intended to force the user to pay the malware creator to remove the restrictions and regain access to their computer. In 2012, a major ransomware known as Reveton began to spread. It displayed a warning purportedly from a law enforcement agency claiming that the computer has been used for illegal activities, such as downloading unlicensed software or child pornography. Due to this behavior, it is commonly referred to as the "Police Trojan".
Buffer Overflow Buffer Overflow Advanced hacking technique Requires some skill and programming knowledge Aim utilize a vulnerable/security hole Objective to gain root priviledges How does it work?: when a program is executed, it is mapped into memory in an organized manner. The defence: buffer overflow attacks often take advantage of poor application programming. Write secure code
Bots Bots Programs that perform some predefined actions in an automated way. A bot is a computer that has been compromised through a malware infection and can be controlled remotely by a cyber criminal. Cause: software vulnerabilities, IE misconfiguration, or opening an email attachment. Used for DDoS attacks similar to zombies Spam: spammers pay to access bots that run email-gateways Harder to block is spam from multiple sources Harvesting valuable information includes online banking credentials, software activation license keys, etc Secondary infection scanning and creating more zombies.
Botnet Example Botnet Example Zeus Began to spread in 2006 Objective stealing banking information by keystroke logging (tracking/ logging the keys struck on a keyboard) and form grabbing Purchased for around $3000-4000 Storm Uses email spamming and phishing websites Begins gathering infected computers into the storm botnet Infected 1.7 million computers Responsible for blasting out 20 percent of spam sent worldwide Storm 2.0 strain 2010 relays junk e-mail advertising male enhancement pills and adult websites
Action Action Keystroke logging passwords to get keys to decrypt the packets Sniffing Traffic watching for clear text passwords Installing Advertisement Add-ons Set up a fake website with some advertisement Negotiate a deal with hosting companies that pay for clicks on adds Bots click on the pop-ups Manipulating online polls/games Mass identity theft phishing mails Spreading new malware
How How Malware Spreads? Malware Spreads? Malware is a program that must be triggered or somehow executed before it can infect your computer system and spread to others. Here are some examples on how malware is distributed: a) Social network b) Pirated software c) Removable media d) Emails e) Websites
Damages Damages 1. Data Loss - Many viruses and Trojans will attempt to delete files or wipe hard drives when activated, but even if you catch the infection early, you may have to delete infected files. 2. Account Theft Many types of malware include keylogger functions, designed to steal accounts and passwords from their targets. This can give the malware author access to any of the user's online accounts, including email servers from which the hacker can launch new attacks. 3. Botnets Many types of malware also subvert control over the user's computer, turning it into a "bot" or "zombie." Hackers build networks of these commandeered computers, using their combined processing power for tasks like cracking password files or sending out bulk emails.
Damages Damages contd contd 4. Financial Losses If a hacker gains access to a credit card or bank account via a keylogger, he can then use that information to run up charges or drain the account. Given the popularity of online banking and bill payment services, a hacker who manages to secrete a keylogger on a user's system for a full month may gain access to the user's entire financial portfolio, allowing him to do as much damage as possible in a single attack.
How Can You Protect Your Computer? How Can You Protect Your Computer? Install protection software. Practice caution when working with files from unknown or questionable sources. Do not open e-mail if you do not recognize the sender. Download files only from reputable Internet sites. Install firewall. Scan your hard drive for viruses monthly.
Symptoms Symptoms Increased CPU usage Slow computer or web browser speeds Problems connecting to networks Freezing or crashing Modified or deleted files Appearance of strange files, programs, or desktop icons Programs running, turning off, or reconfiguring themselves (malware will often reconfigure or turn off antivirus and firewall programs) Strange computer behavior Emails/messages being sent automatically and without user s knowledge (a friend receives a strange email from you that you did not send) There seems to be a lot of network activity when you are not using the network The available memory on your computer is lower than it should be Programs or files appear or disappear without your knowledge File names are changed
Anti Anti- -Malware Malware Program Program Anti-Malware program is used to prevent, detect, and remove computer viruses, worms, trojan horses and any other type of malware. Examples of Anti-Malware program: Antivirus program Anti-spyware program Anti-spam program Firewall Antivirus Program Antivirus" is protective software designed to defend your computer against malicious software. In order to be an effective defense, the antivirus software needs to run in the background at all times, and should be kept updated so it recognizes new versions of malicious software.
Examples of Antivirus Program Examples of Antivirus Program Norton Antivirus AVG Kaspersky Avast! PC-Cilin McAffee Avira Panda Etc.
Anti Anti- -Spyware Spyware Program Program Anti-spyware program is a type of program designed to prevent and detect unwanted spyware program installations and to remove those programs if installed. Examples of Anti-spyware program: Spyware Doctor AVG Anti-spyware STOPzilla Spysweeper Anti-Spam Program Anti-spam software tries to identify useless or dangerous messages for you.
Firewall Firewall A firewall blocks attempts to access your files over a network or internet connection. It blocks incoming attacks. Your computer can become infected through shared disks or even from another computer on the network, so you need to monitor what your computer is putting out over the network or internet also.
Summary Summary Malicious code attacks work because of: Flaws in software design Vulnerabilities caused by insecure configurations Social engineering Human error and/or na ve users Persistence on the part of hackers
LAB LAB Ping of Death Ping of Death Open a Command Prompt and set a VERY large sized, continuous Ping going, directed at a chosen IP address (website) Ping t l 65000 (IP address) Repeat this ten more times in separate copies of the Command Prompt. Then Open a browser visit the website and try to explore the site Observe the effect on the website as more students direct these Pings at the website What was the effect on the website?
IP Addressing Example IP View the IP address on your own computer: I Motivation Ipconfig, ipconfig /all, IP IP Addresses To find a computer name from an IP address or vice versa I nslookup IP address/domain name e.g nslookup abuad.edu.ng To list all servers IP address between your computer and your website: e.g. tracert google.com I
References [1] Class note by Adam C. Champion, Ph.D. [2] Principle of Information Security by Michael E. Whitman, 5th Edition, Herbert J. Mattord. [3] Network Security Essentials: Applications and Standards, 4th Edition, William Stallings.
