CY 101

CYBERSECURITY FUNDAMENTALS
Unit 4: Malicious Software

1
Malware

[SOUP13] defines malware as:

Malware is nosy software that is designed to damage and destroy computers
and computer systems. Malware is a contraction for “malicious software.”
Examples of common malware includes viruses, worms, Trojan viruses,
spyware, adware, and ransomware
6.2Name
MALWARE TERMINOLOGY
Description
With user Action ,the Virus attaches itself to a
Virus program and propagates copies of itself to other
programs
Without user action, the Worm program that
Worm
propagates copies of itself to other computers
Logic Bomb Logic bomb triggers action when condition occurs
Trojan Trojan horse program that contains unexpected
Horse additional functionality
Backdoor program modification that allows
Backdoor
unauthorized access to functionality

Clickjacking Vulnerability used by an attacker to collect an

4

infected user’s clicks

Classification of Malware

Classified into two broad categories:

Based first on how it spreads or propagates to reach the desired targets

Then on the actions or payloads it performs once a target is reached

 Types of Malware

Propagation Mechanisms include:

• Infection of existing content by viruses after that spreads to other
systems
• Exploit software vulnerabilities by worms or drive-by-downloads to allow
the malware to replicate
• Social engineering attacks that convince users to bypass security
mechanisms to install Trojans or to respond to phishing attacks

Payload actions performed by malware once it reaches a target system can

include:
• damage to system or data files
• Theft of service/make the system a zombie agent of attack as part of a
botnet
• Theft of information from the system
• Stealthing /hiding its presence on the system
 Attack Kits

 deployment of malware required large technical skill by software authors

 Toolkits are often known as “crimeware”

 Include a set of publishing mechanisms and payload modules that even novices can deploy,
which creates a significant problem for those defending systems against

 Widely used toolkits include:

 Zeus

 Blackhole

 Sakura

 Phoenix
 Attack Sources

 malware development change from individuals attack to more organized

and dangerous attack sources such as:

Organizations
Politically that sell their National
Organized
motivated Criminals services to governmen
crime
attackers companies t agencies
and nations

 This has significantly changed the resources available and motivation behind
the rise of malware and has led to development of a large underground
economy involving the sale of attack kits, access to compromised hosts, and
to stolen information
 Viruses
(Propagation / Infected Contents)
 Piece of software that infects programs

 Modifies them to include a copy of the virus

 increase and infect other content

 Easily spread through network environments

 When attached to an executable program, a virus can do anything that the

program is permitted to do

 Executes secretly when the host program is run

 Specific to operating system and hardware

 Takes advantage of their details and weaknesses

Virus lifecycle (Virus Phases)
 Virus Classification

By target By Concealment/Hiding Strategy

 Encrypted virus
 Boot sector infector
 A portion of the virus creates a random
 Infects a master boot record (MBR) encryption key and encrypts the remainder
or boot record of the virus
 File infector  Stealth virus (sneaking)
 Infects files that the operating system  A form of virus explicitly designed to hide
or shell considers to be executable itself from detection by anti-virus software
 Macro virus  Polymorphic virus
 Infects files with macro or scripting
 A virus that mutates with every infection
code
 Metamorphic virus
 Multipartite virus
 A virus that rewrites itself completely at
 Infects files in multiple ways
each iteration and may change behavior as
well as appearance
 Worms
(Propagation / Vulnerability Exploit)

 Program that actively seeks out more machines to infect

 Each infected machine serves as an automated launching pad for

attacks on other machines
 Exploits software vulnerabilities in client or server programs

 Can :

 Spread through Network Connections from system to system

 Spread through Shared Media (USB drives, CD, DVD data disks)

 Spread through E-mails, email worms

Worms
(Propagation / Vulnerability Exploit)

 Upon activation the worm may replicate and propagate again

 Usually carries some form of payload/action

 First known worm implementation was done in Xerox Palo Alto Labs in the
early 1980s
 It was not malicious , searching for idle systems to use to run a
computationally intensive task
 Worm Replication
• Worm e-mails a copy of itself to other systems
E-mail or instant
• Often, sends itself as an attachment via an instant
messenger facility message service

• Creates a copy of itself or infects a file as a virus

File sharing on removable media (auto run mechanism )

Remote execution • Worm executes a copy of itself on another system

capability

Remote file access or • Worm uses a remote file access or transfer

transfer capability service to copy itself from one system to another

• Worm logs onto a remote system as a user and

Remote login capability then uses commands to copy itself from one
system to the other
 Zero-day
exploit

Transport Ultrafast
vehicles spreading

Worm Technology
Metamorphic Multi-exploit

Polymorphic Multiplatform
 Newer Worms Technology
 Multiplatform: not limited to Windows: UNIX; macro, scripting etc.

 Multi-exploit: penetrate systems in a variety of ways:

 E.g. servers, browsers, e-mail, file sharing, shared media, etc.

 Ultrafast Spreading: maximize locating as many vulnerable machines as possible in a

short time period.

 Polymorphic: To evade detection, worms adopt the virus polymorphic technique.

 New code generated on the fly using functionally equivalent instructions & encryption techniques.

 Metamorphic: Changing their appearance and it behavioral patterns.

 have a collection of behavior patterns that are unleashed at different stages of propagation

 Transport vehicles: Can rapidly compromise a large number of systems,

 they are ideal distributed DoS bots, rootkits, spam e-mail generators, and spyware.

 Zero-day exploit : maximum surprise and distribution,

 exploit an unknown vulnerability that is only discovered by the general network community when
the worm is launched.
 CLICKJACKING

 Also known as a
user-interface (UI) redress/reform attack
 Using a similar technique, keystrokes can also be hijacked
 A user can be led to believe they are typing in the password to their email or bank
account, but are instead typing into an invisible frame controlled by the attacker
E.g. you may think you're viewing the bank's display after entering your ID and
password, but what you actually see is a replica of the same screen laid on top of
the bank's real information.
 Clickjacking

 Vulnerability used by an attacker to collect an infected user’s clicks

 By taking advantage of Adobe Flash or JavaScript an attacker could even place a

button under or over a button making it difficult for users to detect
 Social Engineering (Propagation / Spam,Trojan)
 “Tricking” Tricking users to help in the attack of their own systems or personal information

 This can happen by SPAM e-mail, or some Trojan horse program or scripting code.

Spam Trojan horse

(uninvited) (apparently useful)

Unsolicited bulk
e-mail Program or utility containing harmful
hidden code

Significant carrier of malware

Used to accomplish functions that the

attacker could not accomplish directly
Used for phishing attacks
 Spam E-mail

 most recent spam is sent by botnets using user systems.

 most of spam e-mail content is just advertising, trying to convince the recipient
to purchase some product online but includes malware in some cases
 The e-mail may have an attached document, which, if opened, may exploit a
software vulnerability to install malware on the user’s system
Or, Trojan horse program or scripting code
 Finally the spam may be used in a phishing attack, typically directing the user

 either to a fake Web site that mirrors some legitimate service

or to complete some form with sufficient personal details

 Trojan Horses

 Trojan horses fit into one of three models:

 Continuing to perform the function of the original program and additionally
performing a separate malicious activity.
 Continuing to perform the function of the original program but modifying the
function to perform malicious activity or to disguise other malicious activity.
 e.g., a Trojan horse version of a login program that collects passwords

 e.g., a Trojan horse version of a process listing program that does not display
certain processes that are malicious

 Performing a malicious function that completely replaces the function of the

original program.
WannaCry ransomware attack
 System Corruption (Payload)

 Real-world damage, Causes damage to Hardware

 Chernobyl virus rewrites BIOS code
 Stuxnet worm
 Targets specific industrial control system software
 Logic bomb: Code embedded in the malware that is set to “explode”
when certain conditions are met
 Zombie, Bots (Payload / Attack Agents )
 Takes over another Internet attached computer and uses that computer to
launch or manage attacks
 Botnet - collection of bots capable of acting in a coordinated
manner (A botnet is a number of Internet-connected devices (bots), each of
which is running one or more bots.)
 Can be used to cause/make:
 Distributed denial-of-service (DDoS)

 Spamming

 Sniffing traffic

 Keylogging

 Spreading new malware

 Installing advertisement add-ons and browser helper objects (BHOs)

1. The botmaster sends out malware to infect computers.
2. Once in your system, the malware will use the internet to make contact with the command &
control server (C2).
3. Once the botmaster has a purpose for the botnet, he/she sends instructions to the bots via
the command & control server.
4. the botmaster will be focussed on recruiting more and more computers to expand the botnet.
Keyloggers and Spyware
(Payload / Information Theft)

Keylogger

• Captures keystrokes to allow attacker to monitor sensitive information

• Typically uses some form of filtering mechanism that only returns information close
to keywords (“login”, “password”)

Spyware
• Subverts the compromised machine to allow monitoring of a wide range of
activity on the system
• Monitoring history and content of browsing activity
• Redirecting certain Web page requests to fake sites
• Dynamically modifying data exchanged between the browser and certain Web
sites of interest
 Phishing
(Payload / Information Theft)
 Exploits social engineering to  Spear-phishing
leverage the user’s trust  E-mail is crafted to specifically for its
recipient,
 Include a URL in a spam e-mail that links to a fake
Web site that connects the login page of a banking,  Eg. Send email by there own name such
gaming, or similar site as Dear Mr Ahmmad, NOT Dear Sir

 Suggests that urgent action is required by

the user to authenticate their account

 Attacker exploits the account using the

captured credentials
 Backdoor
(Payload – Stealthing)

 Also known as a trapdoor

 Secret entry point into a program allowing the attacker to gain access and
bypass the security access procedures

 Maintenance hook is a backdoor used by Programmers to debug and test

programs

 Difficult to implement operating system controls for backdoors in

applications

E.g. New Stealth Falcon Backdoor Discovered (September 10, 2019)

https://www.securityweek.com/new-stealth-falcon-backdoor-discovered
 Rootkit
(Payload – Stealthing)

 A rootkit is a set of hidden programs installed on a system to maintain

covert/hidden access to that system with administrator (or root) privileges

E.g. Rootkit -- An Intruder Living in your Kernel

https://www.symantec.com/connect/articles/rootkit-intruder-living-your-kernel
Rootkit Classification Characteristics

Memory
Persistent User mode
based

Virtual
External
Kernel mode machine
mode
based
 Malware Countermeasure Approaches
 Ideal solution to the threat of malware is prevention
 Four main elements of prevention:
 Policy
 Awareness
 Vulnerability reduction
 Threat reduction
If prevention fails, can be used to support the following threat mitigation options:
 Detection
 Identification
 Removal
 Worm Countermeasures

 Considerable overlap in techniques for dealing with viruses and worms

 Once a worm is resident on a machine anti-virus software can be used to detect and
possibly remove it
 Perimeter network activity and usage monitoring can form the basis of a worm
defense
 Worm defense approaches include:
 Signature-based worm scan filtering (prevent worm scans from entering/leaving network/host)
 Filter-based worm containment (content rather than a scan signature.)
 Payload-classification-based worm containment (examine network packets)
 Threshold random walk (TRW) scan detection (effective against common worm behaviors)
 Rate limiting (i.e. limiting the number of new machines a host can connect to in a window of time)
 Rate halting (blocks outgoing traffic when a threshold is exceeded either in outgoing connection rate )
Anti-Virus Evolution

 Virus & Antivirus technology have both evolved

 Early viruses simple code, easily removed
 As become more complex, nowadays.
 Four generations of Antivirus software:
1. First: Signature scanners to identify a virus
2. Second: Heuristics rules used to search virus infections
3. Third: Identify virus by its actions
4. Fourth: Packages consisting of a variety of antivirus
33

techniques.
Generic Decryption (GD)

 Enables the anti-virus program to easily detect complex polymorphic

viruses and other malware while maintaining fast scanning speeds
 Executable files are run through a GD scanner which contains the following
elements:
 CPU emulator

 Virus signature scanner

 Emulation control module

 The most difficult design issue with a GD scanner is to determine how long
to run each interpretation
 SUMMARY

 Types of malicious software (malware)

 Payload
 Advanced persistent threat
 System corruption
 Propagation
 Attack agent
 Infected content
 Zombie
 viruses
 Bots
 Vulnerability exploit
 Information theft
 worms
 Keyloggers
 Social engineering
 Phishing
 spam
 Spyware
 e-mail
 Stealthing
 Trojans.

 Countermeasures
EXTRA WORK – NOT INCLUDE INTO EXAM
Malware Terminology
Malware Terminology
Morris Worm
 One of the Earliest significant worm infection

 Released by Robert Morris in 1988

 Designed to spread on UNIX systems

 Attempted to crack local password file to use login/password to logon to other

systems
 Exploited a bug in the finger protocol which reports the whereabouts/ location of a
remote user
 Exploited a trapdoor in the debug option of the remote process that receives and
sends mail

 Successful attacks achieved communication with the operating system command

interpreter
 Sent interpreter a bootstrap program to copy worm over
 Recent Worm Attacks
Melissa 1998 e-mail worm, first to include Virus+ Worm + Trojan in one package

Code Red July 2001 exploited Microsoft IIS bug Probes/examines random IP addresses
consumes significant Internet capacity when active
Code Red II August 2001 also targeted Microsoft IIS installs a backdoor for access

Nimda September 2001 had Worm, Virus and Mobile code characteristics spread using e-mail, Windows
shares, Web servers, Web clients, backdoors
SQL Slammer Early 2003 exploited a buffer overflow vulnerability in SQL server compact and spread
rapidly
Sobig.F Late 2003 exploited open proxy servers to turn infected machines into spam engines

Mydoom 2004 mass-mailing e-mail worm installed a backdoor in infected machines

Warezov 2006 creates executables in system directories sends itself as an e-mail attachment
can disable security related products

Conficker November 2008 exploits a Windows buffer overflow vulnerability

(Downadup) most widespread infection since SQL Slammer
Stuxnet 2010 restricted rate of spread to reduce chance of detection
targeted industrial control systems

McAfee: What Is Stuxnet?

https://www.mcafee.com/enterprise/en-us/security-awareness/ransomware/what-is-stuxnet.html
 Newer Worms Technology
 Multiplatform: not limited to Windows: UNIX; macro, scripting etc.

 Multi-exploit: penetrate systems in a variety of ways:

 E.g. servers, browsers, e-mail, file sharing, shared media, etc.

 Ultrafast Spreading: maximize locating as many vulnerable machines as possible in a

short time period.

 Polymorphic: To evade detection, worms adopt the virus polymorphic technique.

 New code generated on the fly using functionally equivalent instructions & encryption techniques.

 Metamorphic: Changing their appearance and it behavioral patterns.

 have a collection of behavior patterns that are unleashed at different stages of propagation

 Transport vehicles: Can rapidly compromise a large number of systems,

 they are ideal distributed DoS bots, rootkits, spam e-mail generators, and spyware.

 Zero-day exploit : maximum surprise and distribution,

 exploit an unknown vulnerability that is only discovered by the general network community when
the worm is launched.
Drive-by-downloads

 Exploits browser vulnerabilities to download and installs malware on the

system when the user views a Web page that is controlled by the attacker
 It contains code that exploits the browser bug to download and install malware on the
system without the user’s knowledge or consent.

 In most cases does not actively propagate

 Spreads when users visit the malicious Web page

A drive-by download refers to the unintentional

download of malicious code to your computer or
mobile device that leaves you open to a cyberattack.
(press a link, or open a malicious email attachment to
become infected.)

Kaspersky: What Is a Drive-By Download?

https://www.kaspersky.com/resource-center/definitions/drive-by-download
 Worm Countermeasures

 Considerable overlap in techniques for dealing with viruses and worms

 Once a worm is resident on a machine anti-virus software can be used to detect and
possibly remove it
 Perimeter network activity and usage monitoring can form the basis of a worm
defense
 Worm defense approaches include:
 Signature-based worm scan filtering (prevent worm scans from entering/leaving network/host)
 Filter-based worm containment (content rather than a scan signature.)
 Payload-classification-based worm containment (examine network packets)
 Threshold random walk (TRW) scan detection (effective against common worm behaviors)
 Rate limiting (i.e. limiting the number of new machines a host can connect to in a window of time)
 Rate halting (blocks outgoing traffic when a threshold is exceeded either in outgoing connection rate )
 Virus Phases
1. Dormant/asleep phase
Will eventually be Not all viruses have this
Virus is idle
activated by some event stage

2. Triggering phase
Virus is activated to perform the function Can be caused by a variety of system
for which it was intended events

3. Propagation phase
Virus places a copy of itself Each infected program will
into other programs or into May not be identical to the now contain a clone of the
certain system areas on the propagating version virus which will itself enter a
disk propagation phase

4. Execution phase

Function is performed May be harmless or damaging

Worm Replication

 A worm typically uses the same phases as a computer virus:

 dormant, propagation, triggering, and execution.

 The propagation phase generally performs the following functions:

 Search for appropriate access mechanisms to other systems to infect by
examining host tables, address books, buddy lists, trusted peers,
 scanning possible target host addresses; or by searching for suitable removable media devices to use.

 Use the access mechanisms found to transfer a copy of itself to the remote
system, and cause the copy to be run.
 The worm may also attempt to determine whether a system has previously been
infected before copying itself to the system.
 Target Discovery
 Scanning (or fingerprinting)
 Propagation phase for a network, worm searches for other systems to infect
 Scanning strategies that a worm can use:
1. Random
o Each compromised host probes random addresses in the IP address space using a
different seed
o This produces a high volume of Internet traffic which may cause generalized
disruption even before the actual attack is launched
2. Hit-list
o The attacker first compiles a long list of potential vulnerable machines
o Once the list is compiled the attacker begins infecting machines on the list
o Each infected machine is provided with a portion of the list to scan
o This results in a very short scanning period which may make it difficult to detect
that infection is taking place
Target Discovery

3. Topological
3. This method uses information contained on an infected victim machine to find
more hosts
4. Local subnet
o If a host can be infected behind a firewall, then it looks for targets in its own local
network
o The host uses the subnet address structure to find other hosts that would
otherwise be protected by the firewall
 System Corruption (Payload)

Chernobyl Virus Klez

• First seen in 1998 • Mass mailing worm infecting Windows 95 to
• Windows 95 and 98 virus XP systems
• Infects executable files and corrupts the entire • On trigger date causes files on the hard drive
file system when a trigger date is reached to become empty

Ransomware
• Encrypts the user’s data and demands payment in order to access the key
needed to recover the information
• PC Cyborg Trojan (1989)
• Gpcode Trojan (2006)
• WannaCry (May 2017)

https://www.kaspersky.com/resource-center/threats/hardware-failure
https://www.kaspersky.com/about/press-releases/2002_free-defense-against-the-internet-worm-klez
https://www.us-cert.gov/Ransomware
https://www.trendmicro.com/vinfo/us/security/news/ransomware
 Remote Control Facility
 Distinguishes a bot from a worm
 Worm propagates itself and activates itself

 Bot is initially controlled from some central facility (master)

 Typical means of implementing the remote control facility is on an IRC server

(Internet Relay Chat, an old and obsolete application layer chat protocol)

 Bots join a specific channel on this server and treat incoming messages as
commands
 More recent botnets use covert communication channels via protocols such as
HTTP
 Distributed control mechanisms use peer-to-peer protocols to avoid a single
point of failure
 Host-based Behavior-blocking Software
 Integrates with the operating system of a host computer and monitors program
behavior in real time for malicious action
 Blocks potentially malicious actions before they have a chance to affect the system
 Blocks software in real time so it has an advantage over anti-virus detection
techniques such as fingerprinting or heuristics

Limitations
• Because malicious code must run on the target
machine before all its behaviors can be identified, it
can cause harm before it has been detected and
blocked