Okay, malware.
A lot of emphasis on malware.
Malware is malicious software that damages
or disables computer systems and gives limited or full control of the systems
to the malware creator for the purpose of theft or fraud.
Lots of different flavors of malware, all
based on different characteristics, behaviors, and so forth.
All right, malware programmers develop and
use malware to typically infilt systems or cause some impact to, again,
confidentiality, integrity, or availability.
Okay, malware can enter a system in different ways.
Think of any way you can copy a file onto your target system.
Instant messenger applications, portable hardware, removable media, downloading
files on the internet, email attachments, etc., etc.
Any way you can get your code copied from
one system to another and then trick the unsuspecting victim into executing it.
Threat actors will employ some kind of
standard techniques to distribute malware on the web.
Black Hat search engine optimization,
socially engineered click jacking, spear phishing sites.
A lot of this stuff is internet driven.
So just by visiting a malicious page, you
click on a link, malware downloads and installs, hahaha you're infected.
Compromised legitimate websites, spam emails, phishing campaigns, etc.
The components of malware.
The malware itself
is generally the malicious code that performs a malicious function,
but there's some kind of companion files that go along with it that assist the
malware in not getting detected or downloading and installing on the system.
S o cryptors, downloaders, droppers, obfuscators, packers.
They're not the malware itself, but they're companion or assistant files
meant to download the file to the system or to encode it in a way that evades
Signature based Detection or reverse analysis, something along those lines.
Obfuscators and packers are also again meant to evade Signature based detection.
Packers compress code, Obfuscators alternatively encode.
The payload is generally the malicious code that executes.
Then you also have the Exploder Delivery Code that goes along with that.
So a couple of different flavors or components of malware.
And we're also going to look at some
different categories of malware here in just a second.
First of which, Trojan.
Trojans are unknown inside of known,
unauthorized inside of authorized, unwanted inside of wanted, etc.
It's a program in which the malicious or
harmful code is contained inside a harmless program.
You get a tick tack toe game or elf
bowling or something like that, little exe game.
What you don't know is that there's malware hiding inside.
When you execute that file, the malware installs on the system.
Trojans will typically create a covert communication channel between the victim
computer and the attacker for transferring sensitive data.
Getting to and from that compromised system requires some degree of stealth and
sometimes it's just plain, clear text communication, which is easy to discover.
But a covert communication channel is a
allowable communications channel used in an unauthorized or unallowed way.
Trojans come in different shapes and sizes.
Remote access, backdoor, botnet, rootkit,
ebanking, service protocol, IoT, destructive, DDoS.
They all share the common trait of unknown
inside of known, unauthorized inside of authorized.
But they're pretty intuitively named.
Remote access Trojans give you remote access.
Iot Trojans infect IoT devices.
Mobile Trojans infect mobile devices, etc.
There's construction kits, which the first time I saw a Trojan horse construction
kit, I'm like, You've got to be kidding me.
There's an actual gooey base construction kit for creating these things.
Oh, yeah, absolutely.
Sub7, Feef, Net Bus, Beast, etc, all came
with generation utilities or construction kits and then control utilities.
There's lots of different types of malware construction kits.
We got virus, we got worm, we got Trojan, we got spyware, we got exploit kits.
Either you can write one from scratch if
you're a programmer or you can download a kit, generate your own if you're not.
Okay, virus.
Viruses will infect
executable files, deliver payload, may transform and encrypt themselves.
But it's self replicating.
It can't propagate without infecting other files.
So it does rely on infections for propagation, delivering payloads, and it
requires that the host code that it occupies actually runs.
So the virus comes in different flavors or shapes and sizes as well.
System or Boot Sector, FOM, Multipartite.
Now, a lot of this is based on what they infect and how they infect.
So again, on your second pass of the
course where if you want to read all the definitions of polymorphic and web
scripting and email and Armored, definitely have at it.
Pretty interesting stuff, but
it's a pretty common theme of infection, replication, delivery, payload.
No matter what they do, the polymorphics
and metamorphics create varied but operational copies of themselves.
The virus wants to live, to propagate, to
evade detection, and perform whatever function it was written to perform.
Lookie there, we've got virus construction kits for viruses as well.
There's the JPS virus maker.
There's plenty more where that came from.
Then ransomware.
Ransomware, not a bad money making scam.
So encrypt your victim's stuff
and hold it for ransom and force them to pay you. pay the ransom or they don't get
their stuff back and then maybe you don't give their stuff back anyway.
So the colonial pipeline hack here a few
months back is a great example of a recent ransomware attack.
Ransoms may or may not be illegal to
actually pay because it's like negotiating with terrorists.
They're just going to be back for more.
Ransomware, argument, there's differing philosophies
on whether or not that ransom should be paid.
You should take proper precautions to
protect yourself against ransomware, especially around things like backups.
Computer worms propagate on their own.
Unlike a virus, they do not have to infect executable files.
They propagate on their own and they may actually deliver an alternative payload,
viral payload backdoor, something like that.
Root Kits are especially nasty because they hide themselves from detection.
A lot of times, Root Kits are patched OS
journals, which means they can falsify file system directory listings and
registry key numerations and running processes, etc.
And basically hide themselves on the system.
The term is a kit to provide root access,
but one of the most salient characteristics or features of Root Kit
is its ability to hide and maintain a high level of stealth in the system.
Are a potentially unwanted application or program?
This is a great ware category.
They're potentially harmful applications.
They may pose severe risk, but they also may be something you're
actually aware of and want to install, like torrent managers and that thing.
They're installed when downloading and installing Freeware using a third party
installer or when accepting a misleading license agreement.
Now, we've all been there where you don't forget to uncheck a couple of boxes and
pretty soon you got browser extensions and your default website has changed to the
vendor's website and a pain to clean up after that.
Adware displays annoying pop up ads.
Not too terribly dangerous, but definitely annoying.
It may actually pop up links to malicious
sites, which could lead to drive by downloads or malware propagation.
Spyware spies on your activities.
Spyware spies on you in some way, shape or form.
Lots of different flavors of spyware,
desktop spyware, chat spyware, keystroke loggers, programs executed, and so forth.
A lot of the stuff gets marketed in the open as monitoring your employees or
monitoring your kids, which you're definitely allowed to do that thing.
But again, a lot of this may be used for
purposes other than allowable purposes, unethical purposes, etc.
But lots of spyware out there.
The keylogger logs key strokes comes in a couple of different flavors.
You have physical and software.
You also have device driver versions,
rootkit types of key loggers, or application types of key loggers.
But they quite simply log key strokes.
A lot of times they'll log window titles, internet sites visited, that thing.
A lot of times, again, they're a little bit more multifaceted spyware, and a lot
of your spyware contains key logger functionality.
Botnets.
The bot is basically a Trojan, characteristically, but the bots are used
to create botnets, which are then used to collectively attack
targets, crack passwords, capture solving farms, and so forth.
The botnet does the bidding of its master,
and they're an army of bots, plain and simple.
The victims that are compromised are not the primary target.
We'll call them a secondary victim.
Those become agents.
The systems infected are called zombies, and they are used to collectively attack
targets for things like denial service attacks.
Fileless malware.
The easiest way for your malware to get
detected is to leave a footprint in the file system and get discovered in a scan.
So in fileless malware, we don't write any files to the disk.
They reside in system RAM.
They use native Windows applications like PowerShell to execute malicious functions.
And the idea there is they have a higher likelihood of remaining undetected.
Fileless propagation techniques include phishing emails, infection through lateral
movement, registry manipulation, legitimate applications, memory code
injection, script based injection, Native applications, etc.