>> Hi, welcome back to the course.
In the last module, we wrapped up
our discussion on Cloud forensics.
In this video, we're going to start
our discussion on malware.
We'll talk about the different types of malware.
Just a quick pre-assessment question here.
Worms do not self propagate,
is that true or false? That's false.
They actually do self propagate
and we'll talk about that in just a little bit.
We have different types of malware and this is not
an all-inclusive list naming-wise.
But we've got viruses, worms and
Trojans are the main ones there.
Then we've got other things that are
spyware related like key loggers,
we've got rootkits, and ransomware.
Again, several of those tuck into each other,
but we'll differentiate them for this discussion.
Viruses. One key aspect here,
they self-replicate, but they need a host.
Think about a virus.
I get the flu or something,
the virus needs a host like
me to be able to actually
replicate and cause me to get the flu.
Then if you sit next to me and
I cough on you or something,
then you may get the virus
>> because you're a host as well,
>> for that particular virus.
Generally, it requires some type of user interaction.
Not always but generally,
a virus requires some type of user interaction,
clicking that Excel file,
clicking on that website link,
whatever the case might be to cause it
to then execute and run.
Basically, a virus is going to corrupt or modify files,
again as part of that self-replication.
It's essentially doing that to take over the files
and calls itself to continue running on the system.
We have worms.
Again, self-replicating here.
But the main key aspect that differentiates
worms and viruses is worms are self-propagating.
That just means that they're going to
continue sending themselves across
the network or the internet for that example,
to infect different systems.
One of the main things they do
>> is they consume bandwidth.
>> Of course, they can do a lot of other
things, but generally,
be some bandwidth consumption with a worm attack.
Then Trojans. These appear to be benign programs like,
hey, it's just an Excel file.
Go ahead and open it. But in there,
there's rootkits and stuff.
These don't self propagate.
They require some type of user interaction
to then download them and
allow whatever else might be in there
to execute. Key logger.
This one here just records keystrokes.
Typing away my username
and password for my bank website,
you're harvesting that information. Then rootkits.
Again, these are generally tucked
in with Trojans nowadays.
These allow the attacker to maintain
access on the system.
A lot of times they'll infect at the kernel level,
so that way as you keep rebooting your computer,
here comes the rootkit again
and your system is still compromised.
You may have to wipe the OS or something like that.
Now if it's a firmware rootkit,
generally speaking, you're just going to have to
replace the hardware to get rid of it.
Ransomware. This one, you see in the news a lot.
Things like the WannaCry worm is a good example of it.
This basically encrypts files,
demands a ransom payment.
Hey, pay me x million dollars in
Bitcoins and I'll unlock your files.
In most cases, they'd never unlock
your files so don't pay the money, by the way.
It's generally a former Trojan that
hides through other means
and then executes on the system.
Again, I mentioned WannaCry is one of
the many examples out there in the media.
How does malware enter a system? Different ways.
Through users executing on
spam e-mails or phishing e-mails,
USB, or other external media.
USB is probably the most common one.
People love to pick those
up in a parking lot and just put them
in the computer. Third-party software.
If you're getting your software updates
from a third party and not from the actual vendor,
that's definitely a risk.
File-sharing websites,
wireless or Bluetooth attack methods,
and then compromise websites.
Things like malvertising.
I wasn't a victim of it because
I like to access websites in a sandbox,
but I was visiting, I forget,
I think it was Forbes or one
>> of those reputable websites.
>> Then I was just looking at an article
and all of a sudden,
a executable, I think was for a flash exploit,
was downloading on my computer.
It was instant. I was like, okay, there we go.
There's a malvertising attack.
Because an ad was running and then all
of a sudden it dropped it.
I do recommend that if you're browsing the web,
I always recommend people do it in
a sandbox just because you can
reduce a lot of your risk that way.
But you're welcome to do whatever.
At a minimum, have something
like Malwarebytes or something
out there to protect you in that situation.
Then a watering hole attack.
If I'm an attacker and I know
that everyone at your company goes to eat at
a certain Chinese restaurant and they all
go look up that restaurant's menu every single day.
Then I just go takeover like Equifax.
Well, they're probably a bad example to use.
Why try to take over
the Department of Defense
website when I can just go take over
the Chinese restaurant website
and then have all your users come
there and I can infect your computers that way.
In this video, we just talked
about some of the different types
of malware that we might see out there.
In the next video, we're going to go over
the different components of malware.
You'll notice that some of them are
redundant in their descriptions,
but these are things that you'll
just want to know for the exam.