Malware Malware Mathias Rust Category="Computing portmanteaus"Category="Malware"Malware (a Portmanteau of "malicious software") is a type of software designed to take over and/ or damage a computer user's operating system, without his or her knowledge or approval. Once installed, it is often very difficult to remove, and depending on the severity of the program installed, its handiwork can range in degree from the slightly annoying (such as unwanted pop up ads while a user is performing regular computing tasks on or offline), to irreparable damage requiring the reformatting of one's hard drive, since much of malware is poorly written. Examples of malware include viruses and trojan horses.

Malware should not be confused with defective software, that is, software which is intended for a legitimate purpose but has errors or bugs.

Types of malicious software

Two common types of malware are viruses and worms. These types of programs have in common that they are both able to self-replicate; they can spread (possibly modified) copies of themselves. Not every program that copies itself is a virus or worm; for instance, Backup software may copy itself to other media as part of a system backup. To be classified as a virus or worm, at least some of these copies have to be able to replicate themselves too, such that the virus or worm can propagate itself. The difference between a virus and a worm is that a worm operates more or less independently of other files, whereas a virus depends on hosts to spread itself.

Virus

Viruses have used many sorts of hosts. When computer viruses first originated, common targets were executable files that are part of application programs and the boot sectors of floppy disks. Recently, viruses have embedded themselves in e-mail as Email attachments, depending on a curious user opening the viral attachment, and even more recently files transmitted through peer to peer (P2P) softwares have been a major culprit in the propogation of viruses. In the case of executable files, the infection routine of the virus arranges that when the host code is executed, the viral code gets executed as well. Normally, the host program keeps functioning after it is infected by the virus. Some viruses overwrite other programs with copies of themselves which destroys them altogether. Viruses can spread across computers when the software or document they've attached themselves to is transferred from one computer to the other.

Because viruses were historically the first to appear, the term "virus" is often applied, especially in the popular media, to all sorts of malware. Modern anti-viral software strengthen this broader sense of the term as their operation is never limited to viruses.

Worms

Computer worms are similar to viruses but are stand-alone software and thus do not require host files (or other types of host code) to spread themselves. They do modify their host operating system, however, at least to the extent that they are started as part of the boot process. To spread, worms either exploit some vulnerability of the target system or use some kind of social engineering to trick users into executing them.

Wabbit

A third, uncommon, type of self-replicating malware is the Wabbit. Unlike viruses, wabbits do not infect host programs or documents. Unlike worms, wabbits do not use network functionality in order to spread to other computers. Instead, a wabbit repeatedly replicates itself on a local computer. Wabbits can be programmed to have (malicious) side-effects, in addition to the direct consequences of their quick self-replication. An example of a simple wabbit is a Fork bomb.

Trojan

A trojan horse program is a harmful piece of software that is disguised as legitimate software. Trojan horses cannot replicate themselves, in contrast to viruses or worms. A trojan horse can be deliberately attached to otherwise useful software by a programmer, or it can be spread by tricking users into believing that it is useful. To complicate matters, some trojan horses can spread or activate other malware, such as viruses. These programs are called 'droppers'. A common aftermath is the Trojan attracting a large amount of adware/Spyware, causing lots of popups and Web browser instability.

Backdoor

A Backdoor is a piece of software that allows access to the computer system bypassing the normal authentication procedures. Based on how they work and spread, there are two groups of backdoors. The first group works much like a Trojan, i.e., they are manually inserted into another piece of software, executed via their host software and spread by their host software being installed. The second group works more like a worm in that they get executed as part of the boot process and are usually spread by worms carrying them as their Payload. The term Ratware has arisen to describe backdoor malware that turns computers into zombies for sending spam. The installed software can also be used for anonymizing traffic, Brute force cracking of passwords and encryptions, and distributed denial of service attacks (DDOS).

Spyware

Spyware is a piece of software that collects and sends information (such as browsing patterns in the more benign cases or credit card numbers in more malicious cases) about users or, more precisely, the results of their computer activity, typically without explicit notification. They usually work and spread like Trojan horses. The category of spyware is sometimes taken to include Adware of the less-forthcoming sort.

Key Logger

A keylogger is software that copies a computer user's keystrokes to a file, which it may send to a hacker at a later time. Often the keylogger will only "awaken" when a computer user connects to a secure website, such as a bank. It then logs the keystrokes, which may include account numbers, PIN's and passwords, before they are encrypted by the secure website.

Dialers

A Dialer is a program that either replaces the phone number in a modem's dial-up connection with a long-distance number, often out of the country, in order to run up phone charges on pay-per-dial numbers, or dials out at night to send keylogger or other information to a hacker.

Browser Hijacker

A Browser hijacker is any program designed to alter a computer user's brower settings. These changes can sometimes come in the form of new web sites added to the user's bookmarks; the replacement of his or her home page to one set by the author; or, in the worst case scenario, the browser actually being redirected to various URLs of the author's choosing when certain addresses are typed or found in a search engine results page.

Malware Tools and Aids

Exploit

An exploit is a piece of software that attacks a particular security vulnerability. Exploits are not necessarily malicious in intent — they are often devised by security researchers as a way of demonstrating that a vulnerability exists. However, they are a common component of malicious programs such as network worms.

Rootkit

A Rootkit is software inserted onto a computer system after an attacker has gained control of the system. Rootkits often include functions to hide the traces of the attack, as by deleting log entries or cloaking the attacker's processes. Rootkits may also include backdoors, allowing the attacker to easily regain access later; or exploit software to attack other systems. Because they often hook into the operating system at the kernel level to hide their presence rootkits can be very hard to detect.

Aims of Malware

Malware typically contains a payload with one or more undesirable functions.

Ideological payloads

Some viruses, particularly early ones, display political or ideological messages when activated. In some cases, they are programmed to activate on a date selected by the author. They may also delete files or take other action.

Destructive or damaging payloads

Some malware deletes files or formats disks. Occasionally, particular types of files, such as MP3 have been targetted. Some defendants in trials involving pornography have claimed that material found on their computers was placed there by malware.

Malware Transmission and Bad Computing/ Surfing Habits

It is the conventional wisdom of many computer users that malware works by invasively sneaking onto their systems. However, in reality, nothing could be further from the truth. In fact, more often than not, victims of an infestation will have unwittingly brought the infection on themselves, as malware is designed to take advantage of the carelessness or laxness of those who don't take enough steps to secure their computers against attacks.

Examples

Curing an infection

Unfortunately, cleaning an operating system that has been infected by malware is no longer as simple as it used to be. Malware has become increasingly more difficult to clean, as no one anti-virus or spyware can successfully catch everything that has been installed on a computer. In fact, it is not unusual to resort to an arsenal of security products, online scanners, and anti-spyware/ virus software to make sure everything has been properly removed.

External links