Topics in Malware - Computer and Network Security - Lecture Slides, Slides of Computer Science

Download Topics in Malware - Computer and Network Security - Lecture Slides and more Slides Computer Science in PDF only on Docsity!

Topics in Malware

What is Malware?

-^ Malware (malicious software) is any programthat works against the interest of the system’suser or owner. •^ Question:

Is a program that spies on the web

browsing habits of the employees of acompany considered malware? • What if the CEO authorized the installation ofthe spying program?

Typical purposes of Malware • Backdoor access:^ –^ Attacker gains unlimited access to the machine. • Denial-of-service (DoS) attacks:^ –^ Infect a huge number of machines to try simultaneously toconnect to a target server in hope of overwhelming it andmaking it crash. • Vandalism:^ –^ E.g., defacing a web site. • Resource Theft:^ –^ E.g., stealing other user’s computing and network resources,such as using your neighbors’ Wireless Network. • Information Theft:^ –^ E.g., stealing other user’s credit card numbers

Types of Malware

•^ Viruses •^ Worms •^ Trojan Horses •^ Backdoors •^ Mobile code •^ Adware •^ Sticky software

Viruses (Cont’d)

-^ Some viruses are harmful (e.g.,):^ –^

delete valuable information from a computer’sdisk, – freeze the computer.

-^ Other viruses are harmless (e.g.,):^ –^

display annoying messages to attract userattention, – just replicate themselves.

Viruses: Operation

•^ Viruses typically attach themselves toexecutable program files^ –^

e.g.,^

.exe^

files in MS Windows

•^ Then the virus slowly duplicates itselfinto many executable files on theinfected system. •^ Viruses require human intervention toreplicate.

The first computer viruses • A program called

Elk Cloner

is credited with being the

first computer virus to appear "in the wild". Written in1982 by Rich Skrenta, it attached itself to the AppleDOS 3.3 operating system and spread by floppy disk. • The first PC virus was a boot sector virus called(c)Brain, created in 1986 by two brothers, Basit andAmjad Farooq Alvi, operating out of Lahore, Pakistan.

Worms

-^ Worms are malicious programs that use the Internetto spread. •^ Similar to a virus, a worm self-replicates. •^ Unlike a virus, a worm does not need humanintervention to replicate. •^ Worms have the ability to spread uncontrollably in avery brief period of time.^ –^

Almost every computer system in the world is attached to thesame network.

Trojan horses

•^ A Trojan Horse is a seemingly innocentapplication that contains malicious codethat is hidden somewhere inside it. •^ Trojans are often useful programs thathave unnoticeable, yet harmful, sideeffects.

Trojan horses: Operation (1) • Embed a malicious element inside anotherwise benign program. • The victim:^ 1.^ receives the infected program,^ 2.^ launches it,^ 3.^ remains oblivious of the fact that the system hasbeen infected. – The application continues to operatenormally to eliminate any suspicion.

Backdoors

•^ A backdoor is malware that creates acovert access channel that the attackercan use for:^ –^

connecting, – controlling, – spying, – or otherwise interacting with the victim’ssystem.

Backdoors: Operation

-^ Backdoors can be embedded in actualprograms that, when executed, enable theattacker to connect to and to use the systemremotely. •^ Backdoors may be planted into the sourcecode by rogue software developers beforethe product is released.^ –^

This is more difficult to get away with if theprogram is open source.

Mobile code (Cont’d)

•^ Java scripts are distributed in sourcecode form making them easy toanalyze. •^ ActiveX components are conventionalexecutables that contain native IA-32machine code. •^ Java applets are in bytecode form,which makes them easy to decompile.

Mobile code: Operation

-^ Web sites quickly download and launch a program onthe end user’s system. •^ User might see a message that warns about aprogram that is about to be installed and launched.^ –^

Most users click OK to allow the program to run. – They may not consider the possibility that malicious code isabout to be downloaded and executed on their system.