Well, if you've been around a long time like me, you have transitioned to the word malware.
Instead of virus, we used to just describe computer problems.
Right?
Hacks code injected into systems as simply viruses.
And we had anti-virus software.
But as more and more virus technology proliferated, we needed ways to distinguish between different
types of viruses.
So what is now happened is we have the broad umbrella term of malware to describe any kind of code we
don't want.
And then we have subcategories of malware that we like to talk about.
Now, this is not an exact science.
So you might be doing an analysis and you may go, Wait a minute, this looks like aspects of ransomware
and it looks like a worm and it looks, you know, so there is definitely attacks that fall into multiple
categories.
This is not an exact science, but it should help us.
It should definitely help us with describing attacks, describing attack vectors, and really defending
ourselves if we can categorize the many different types of malicious code.
So remember, malware is the new unbreakable term, right?
It's like professional athlete.
And then we could have basketball players and hockey players.
Why do I think of those two sports?
Because I watched the semi-finals and the finals in those two sports yesterday.
All right.
Anyways, enough about my leisurely Sunday habits.
Let's talk about some of these different categories.
Inside of malware, this can get confusing, especially for freshers out there.
So no problem.
Let me walk you through this.
Viruses.
One of the things where we would say, oh, that is a computer virus in today's landscape, that is
a specific virus type of malware.
One of the things about it is it's going to require human interaction.
Another really painful thing about a virus is this is typically how it works.
You do something and then the malicious code is injected, let's say, in a program.
And now you can remove your original download so you can delete the virus you downloaded.
But remember it did its payload, its triggered payload, and it injected malicious code into the program.
So this is where antivirus software really started to shine because it would not only get that download
off your system, but it would be trained to go in and reverse the damage to your program.
An effective cleaning of the virus.
This is nothing new, this virus concept.
It goes all the way back to the forties, 1940s in the 1970s on the ARPANET.
There was the creeper virus.
It was a proof of concept.
All it did was clone itself.
And so you would have this creeper object appearing on all these different systems.
It did absolutely nothing harmful, but it was a big time proof of concept of the very, very scary
things that were to come.
Now, there are many different ways we can categorize viruses, but one of the fundamental things,
and I always like to categorize it with is is it residing in memory or is it non resident in memory?
So a lot of virus activity will be right there in memory, messing things up.
Other viruses don't reside in memory and a great example are the many viruses that might be attached
to like Microsoft Office macros.
We remember when we would run a macro in something like Excel.
I think it still does it to this day.
You get this warning about, Hey, do you know who wrote this macro?
Because there could be malicious code inside of it.
That would be a great example of a non memory resident type of virus.
So what is a worm?
I mean, my gosh, I thought a worm was just a virus.
No, no, no, no, no.
Hold on.
A worm is a type of malware.
Often times it is essentially doing what a virus does when it's triggered.
But there is a huge, huge aspect of the worm you need to understand, and that is it's totally self
propagating and it doesn't discriminate.
So let's say it's going to.
Take advantage of a vulnerability with some service.
It will be scouring the internet or intranet for that service port, and then it does its magic on that
port.
So a completely self propagating type of virus.
One of the big issues with these, even when they're passive.
Right.
Even when they don't do any destruction.
Well, let's face it, they still need to be cleaned up.
So the cost in time for the cleanup of a large worm attack can be absolutely immense.
Two famous examples of devastating worm attacks were Code Red and Nimona.
Whenever I give examples like this and we didn't have time to do a full ethical hacking and headline
feature on it, just be, you know, maybe make some flashcards here.
You need to be able to identify Code Red and MDA as famous worms, right?
So that's why I mentioned it.
If I put something on a slide, by the way, that's another really good thing, a good indicator that
that somebody did.
Now, as you know, I don't put a lot of words on slides.
Right.
That's on purpose.
When I put words on slides, it's important.
Hey, look at this.
Another type of malware is the Trojan, and this is after the Trojan horse.
And this was wheeled up supposedly.
I don't know if it's myth or I've never researched it.
Right.
But the idea was this gift was rolled up to the castle and they were like, Whoa, it's this beautiful
horsy, let's wheel it into the castle.
And then, of course, all the soldiers jumped out that were hiding inside and killed everyone.
Now, I'm thinking of one of the last episodes of Game of Thrones.
They didn't use a Trojan.
They just used the army of the white walkers.
All right, now I'm really getting off track.
All right, so, yeah, the Trojan.
It may be, again, doing just what a standard virus does.
It's just the delivery mechanism is why we call it a Trojan.
It's hiding in what appears to be a benign package or executable or even just file.
So scary.
We download some new calculator program that we find that's going to do just what we wanted to do.
And when we install it, we install the Trojan that was hiding inside it.
Yikes.
Oh, man.
Botnets This is super scary.
And forgive me, I have an Adobe Stock Image account and I'm not afraid to use it.
So here is what I found on my search for botnet.
I absolutely love it because botnets are often referred to as zombies.
That's right.
Your computer is being controlled by the attackers.
It's now a botnet or a zombie.
Now, the one confusing thing about the botnet term is we use it for an individual computer and we also
use the term for a whole fleet or network of computers that are all acting as zombies.
So notice we use botnet for the individual computer and we also use it for the whole net or network
of computers that are infected.
So it's kind of like shrimp.
The word shrimp is for one or many.
Boy, I really pulled that one out of my bum.
I'm actually looking at beautiful Tampa Bay here in Florida right now, the bay itself.
So no wonder why he came up with a seafood analogy.
All right.
Well, it's time for us to describe our final category of malware.
Oh, no, no.
We've got one more after this.
I could keep going.
Right.
There is even more categories of malware than I'm giving you.
I just wanted to, you know, give you the most commonly asked about in certification environments and
the ones we really should know.
I think I spelled this wrong.
Yeah.
So it's ransom without the E where.
And ransomware is.
Oof!
It is.
There's been some famous ransomware attacks like WannaCry.
And boy, oh, boy.
Did it make people WannaCry?
Ransomware is when someone goes to their machine and they're told it's locked, and it does appear to
them to be completely locked.
And they need to send someone some cryptocurrency typically in order to gain access to the device.
We actually did an ethical hacking in the headline segment and we talked about the Colonial Pipeline
attack and you know that ransomware was part of the attack.
What they did was they encrypted so that Colonial Pipeline couldn't get to over 300 gigs of data.
And they said, Hey, you want us to unencrypted for you pay us.
And that's exactly what the Colonial Pipeline did.
Ransomware.
Very, very common.
2019 was called the year of ransomware because we saw more ransomware doing damage than any other style
of my malware, it seemed.
But ransomware is still alive and kicking today.
I just got it off someone's machine a year ago, and so that was 2021.
And yeah, it's still going strong.
The other category I've mentioned a couple of times, it's spyware.
This is like one of those.
Okay.
Doesn't do any damage except someone's watching what I do.
A lot of times spyware is for marketing and sales purposes.
I know it's totally gross.
And for some people, that's like even more egregious than some kind of a virus.
They can't believe there are consumer activities are being spied on and then they're being marketed
to.
I know one thing.
My Amazon Echo devices certainly seem to be listening to me and marketing to me.
Just the other night I was telling someone about the Titanic Lego set and describing its price in everything.
And what a coincidence.
When I went into Amazon the next day and the Titanic Lego set was being offered to me at a discount
from the price I mentioned during the dinner conversation.
Coincidence?
Mm, don't know.
Having trouble counting today, I believe I said there was one more, and it was spyware, but no,
there were two more.
We can't forget about a dropper type of malware.
What a dropper does is it will hide.
It will do its best to hide on an infected system.
And then it will trigger either trigger itself or triggered by a user action.
And what it does is it reaches out onto the Internet and it surreptitiously downloads the attack code.
So notice this.
You know, these are new styles and new terms that will arise based on attacker techniques.
So I will make flashcards for you on these because I know you're going to need them potentially, especially
if you're refresher in this area.
But look, even if you're not and you feel like you might confuse these.
Do yourself a favor.
Run through the flashcard.