Software designed to infiltrate a computer system without users knowledge.
Needs threat and attack vector.
Threat Vector: Specific method used by an attacker to infiltrate a victim machine (Breaks into the system).
Attack Vector: Means by which attacker gains access to a system to infect it with malware (Breaks into and infects the system).
Viruses
Malicious code run on a machine with user’s knowledge that allows code to infect the computer it is run on.
Types:
Boot Sector: Stored in first sector of a hard drive and is then loaded into memory whenever the computer boots.
Macro: Form of code that allows a virus embedded inside another document so that when it is opened, the virus is executed.
Program: Tries to find executables or application files to infect with their malicious code.
Multipartite: Combination of boot sector and program virus. Even if part of the virus is cleaned, they may miss it in the boot sector, etc.
Encrypted: Hides itself from being detected by encrypting its malicious code/payloads.
Polymorphic: Advanced version of encrypted virus that changes virus code each time it is executed by altering decryption module in order to evade detection.
Metamorphic: Rewrites itself entirely before it attempts to infect a file (essentially more advanced than polymorphic).
Stealth: Not really a virus, but a technique used to prevent detection by antivirus software.
Armor: Have a layer of protection to confuse a program/person analyzing it.
Hoax: Form of technical social engineering that attempts to scare end users into performing an action.
Worms
Malicious software that can replicate itself without user interaction.
Known for spreading far and wide over the Internet in a relatively short amount of time.
Worm vs. Virus: A worm does not need user consent.
Dangers:
Can infect workstation and other computer assets.
Can cause disruptions to network traffic because they are constantly trying to replicate (Denial of Service).
Trojans
Piece of malicious software disguised as a piece of harmless or desirable software.
Remote Access Trojan (RAT)
Trojan that provides attacker with remote control of victim machine.
Ransomware
Malware designed to block access to system or its data by encrypting it until a random is paid.
For large organizations, the random can be very high.
Defense:
Regularly backup all important data, files, and systems.
Update all software, especially Operating Systems and Antivirus programs.
Security user awareness.
Use Multi-Factor Authentication.
Response:
Never pay the ransom. Does not guarantee data. Encourages other attackers to attack you.
Disconnect machines from network immediately.
Notify authorities if in line with organization instant response processes.
Restore from backup after ransomware removed.
Zombies & Botnets
Botnet: Network of computers or devices controller remotely by malicious actors.
Zombies: A computer or device that is part of a botnet and used to perform tasks using remote commands.
Command and Control Node (C2): Responsible for managing and coordinating the activities of other nodes or devices within a network.
Examples: using botnet for file storage, spamming others by sending out phishing campaigns/other malware, DDoS (most common), cryptomining, compute-heavy tasks.
Rootkits
Designed to gain admin-level control over a computer/system without being detected.
Rootkits start at ring 3 and try to work down to ring 0.
Goal: Seamlessly embed itself into the Operating System.
DLL Injection: Technique used to run arbitrary code within the address space of another process by forcing it to load a dynamic-link library.
Shim: Software code that is placed between two components (e.g., Windows OS <–> Shim <–> DLL Injection).
Detection: Boot from an external drive and scan the disk.
Backdoors & Logic Bombs
Backdoor: Used to bypass normal security and authentication functions.
Used to be an insecure coding practice used by programmers for ease (e.g., RAT).
Easter Egg: Insecure coding practice that was used by programmers to provide a joke or gag gift to the users.
Closely linked to logic bombs.
Logic Bomb: Malicious inserted into a program that only executes when certain conditions are met.
e.g., rigging the slot machine computer to do a deterministic output on very specific days.
Keyloggers
Records every single keystroke made on a computer or mobile device.
Can be software or hardware based.
Can lead to:
Identity theft
Financial fraud
Corporate espionage
Defense:
Regular updates and patches
Quality Antivirus and antimalware solutions
Phishing awareness training
Multi-Factor Authentication
Encrypt keystrokes being sent to systems
Physical checks of desktops/laptops/servers
Spyware and Bloatware
Spyware: Designed to gather and send information about a user or organization.
Typical Install Methods:
Bundled with other software
Installed through malicious website
Deceptive pop-up advertisement
Bloatware: Any software that comes preinstalled on a new computer.
Not malicious.
Uses limited system resources and is a threat vector.
Removal:
Manual removal process
Bloatware removal tools
Clean operating system installation
Malware Attack Techniques
Specific Method by which malware infects a target host.
Fileless Malware: Creates process in system memory without relying on local file system of infected host.
Most modern malware uses this to avoid signature-based detection.
Example: typical two-stage attack
Stage 1: Dropper/Downloader
Dropper: Initiates or runs other malware forms within a payload on an infected host.
Downloader: retrieves additional tools post-infection facilitated by a dropper.
Shellcode: Lightweight code meant to execute an exploit on a given target.
Stage 2: Downloader & “Actions on Objective” & Concealment
Download and install a RAT to conduct command and control of victimized system.
“Actions on Objectives” Phase: Execute primary objects to meet core objectives (e.g., data exfiltration or file encryption).