Chapter 6: Malicious Software

A program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system or otherwise annoying or disrupting the victim. [NIST05]
Advertising that is integrated into software. It can result in pop-up ads or redirection of a browser to a commercial site.
Attack Kit
Set of tools for generating new malware automatically using a variety of supplied propagation and payload mechanisms.
Malicious hacker tools used to break into new machines remotely.
Backdoor (trapdoor)
Any mechanisms that bypasses a normal security check; it may allow unauthorized access to functionality in a program, or onto a compromised system.
Code that installs other items on a machine that is under attack. It is normally included in the malware code first inserted on to a compromised system to then import a larger malware package.
An attack using code in a compromised web site that exploits a browser vulnerability to attack a client system when the site is viewed. In most cases, does not actively propagate. Spreads when users visit the malicious web page.
Code specific to a single vulnerability or set of vulnerabilities.
Flooders (DoS client)
Used to generate a large volume of data to attack networked computer systems, by carrying out some form of denial-of-service (DoS) attack.
Captures keystrokes on a compromised system to allow attacker to monitor sensitive information.
Logic Bomb
Code inserted into malware by an intruder. Lies dormant until a predefined condition is met; the code "explodes" then triggers an unauthorized act.
Macro virus
A type of virus that uses scripting code, typically embedded in a document, and triggered when the document is viewed or edited, to run and replicate itself into other such documents. Platform independent and easily spread. Classification by target.
Mobile code
Software (script, macro, other portable instruction) that can be shipped unchanged to a heterogeneous collection of platforms and execute with identical semantics. Transmitted from a remote system to a local system and then executed on the local system. Often acts as a mechanism for a virus, worm, or Trojan Horse.
Set of hacker tools used after attacker has broken into a computer system and gained root-level access. Used to maintain covert access to the system. Hides by subverting the mechanisms that monitor and report on the processes, files, and registries on a computer. Gives administrator privileges to the attacker.
Spammer programs
Used to send large volumes of unwanted e-mail.
Software that collects information from a computer and transmits it to another system by monitoring keystrokes, screen data and/or network traffic; or by scanning files on the system for sensitive information. Subverts the compromised machine to allow monitoring of a wide range of activity on the system: history and browsing activity, redirecting web page requests to fake sites, dynamically modifying data exchanged between the browser and certain web sites of interest.
Trojan Horse
A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the program.
Malware that, when executed, tries to replicate itself into other executable machine or script code; when it succeeds the code is said to be infected. When the infected code is executed, the malware also executes.
A computer program that can run independently and can propagate a complete working version of itself onto other hosts on a network, usually by exploiting software vulnerabilities in the target system.
Zombie, bot
Program activated on an infected machine that is activated to launch attacks on other machines.
Classification of Malware
Based first on how it spreads or propagates to reach the desired targets, then on the actions or payloads it performs once a target is reached.
Malware: Virus
Classified by needing a host program.
Malware: Worms, Trojans, Bots
Classified as being independent, self-contained programs.
Malware: Trojans, Spam e-mail
Classified as malware that does not replicate.
Malware: Viruses, Worms
Classified as malware that does replicate
Propagation mechanisms
Infection of existing content by viruses that is subsequently spread to other systems, exploit of software vulnerabilities by worms or drive-by-downloads to allow the malware to replicate, and social engineering attacks that convince users to bypass security mechanisms to install Trojans or to respond to phishing attacks
Payload actions
Performed by malware once it reaches a target system. Includes corruption of system or data files, theft of service/make the system a zombie agent of attack as part of a botnet, theft of information from the system/keylogging, and stealthing/hiding its presence on the system.
Infection mechanism
Means by which a virus spreads or propagates. Also referred to as the infection vector.
Event or condition that determines when the payload is activated or delivered. Sometimes called a logic bomb.
What the virus does (besides spread). May involve damage or benign but noticeable activity.
Dormant phase
Virus is idle; will eventually be activated by some event; not all viruses have this stage.
Triggering phase
Virus is activated to perform the function for which it was intended; can be caused by a variety of system events.
Propagation phase
Virus places a copy of itself into other programs or into certain system areas on the disk; may not be identical to the propagating version; each infected program will now contain a clone of the virus which will itself enter a propagation phase.
Execution phase
Function is performed; may be harmless or damaging.
Boot sector infector
Infects a master boot record or boot record and spreads when a system is booted from the disk containing the virus. Classification by target.
File infector
Infects files that the operating system or shell considers to be executable. Classification by target.
Multipartite virus
Infects files in multiple ways. Classification by target.
Encrypted virus
A portion of the virus creates a random encryption key and encrypts the remainder of the virus. Classification by concealment strategy.
Stealth virus
A form of virus explicitly designed to hide itself from detection by anti-virus software. Classification by concealment strategy.
Polymorphic virus
A virus that mutates with every infection. Classification by concealment strategy.
Metamorphic virus
A virus that mutates and rewrites itself completely at each iteration and may change behavior as well as appearance. Classification by concealment strategy.
Morris worm
Earliest significant worm infection released by Robert Morris in 1988. Designed to spread on UNIX systems by cracking local password files, exploiting a bug in the finger protocol which reports the whereabouts of a remote user, and exploiting a trapdoor in the debug option of the remote process that receives and sends mail.
Social engineering
Tricking users to assist in the compromise of their own systems. Spam, Trojan horse, and mobile phone trojans.
Chernobyl virus
Infects executable files and corrupts the entire file system when a trigger date is reached.
Mass mailing worm; on trigger date causes files on the hard drive to become empty.
Encrypts the user's data and demands payment in order to access the key needed to recover the information.
Stuxnet worm
Targets specific industrial control system software.
Collection of bots capable of acting in a coordinated manner.
Remote Control Facility
Distinguishes a bot from a worm. Typical means of implementation is on an IRC server.
Exploits social engineering to leverage the user's trust by masquerading as communication from a trusted source.
Recipients are carefully researched by the attacker in order to convince them of authenticity.
Maintenance hook
Backdoor used by programmers to debug and test programs.
Main elements of prevention:
Policy, awareness, vulnerability mitigation, and threat mitigation.
Simple scanners
First generation; requires a malware signature to identify the malware; limited to the detection of known malware.
Heuristic scanners
Second generation; uses heuristic rules to search for probable malware instances; another approach is integrity checking.
Activity traps
Third generation; memory-resident programs that identify malware by its actions rather than its structure in an infected program.
Full-featured protection
Fourth generation; packages consisting of a variety of anti-virus techniques used in conjunction; include scanning and activity trap components and access control capability.
Generic Decryption (GD)
Enables the anti-virus program to easily detect complex polymorphic viruses and other malware while maintaining fast scanning speeds. Executable files are run through a scanner which contains CPU emulator, virus signature scanner, and emulation control module. Difficult to determine how long to run each interpretation.
Digital immune system
This system provides a general-purpose emulation and virus-detection system. The objective is to provide rapid response time so that viruses can be stamped out almost as soon as they are introduced. When a new virus enters an organization, the immune system automatically captures it, analyzes it, adds detection and shielding for it, removes it, and passes information about that virus to systems running a general antivirus program so that it can be detected before it is allowed to run elsewhere.
Worm Countermeasures
signature-based worm scan filtering
filter-based worm containment
payload-classification-based worm containment
threshold random walk (TRW) scan detection
rate limiting
rate halting