Malware CJ 520 10.0

Malware “software designed to infiltrate or damage a computer system without the owner's informed consent”

Why Care About Malware? Estimated malware cost 2006 - $13.3 billion Cyber attacks, From Russia with Love April 2007 - Estonia July 2008 - Georgia preceding physical attack November 2008 - US Pentagon

Why is Malware so prevalent? Computers & networks not designed with security in mind Most computers run the same OS Most computers connected to the Internet Most people use e-mail Knowledge base of average user declining Cyber attacks on the rise Computers are everywhere

Types of Malware - Viruses Small piece of code, piggybacks on a real program Every time the program runs, virus loaded into memory Once in memory, virus copies itself to other files Can also be an e-mail attachment

Virus Characteristics Must have a host file Self-replicating Requires human interaction to replicate Has a payload http://www.youtube.com/watch?v=9G0dtEk205o

Virus Environments File viruses Boot viruses OS specific Part of an executable file May or may not run original program code Boot viruses Copies itself to boot sector Copies itself to memory every time computer starts

Virus Environments cont. Macro viruses Part of an office document Copies itself to a global macro Network viruses Attacks networks &/or e-mail Can run themselves Don’t change file content Cross platform viruses

Types of Malware - Worms Self-replicating stand alone Specific to network No human intervention Most viruses really worms Types of worms - http://www.virusall.com/worms.shtml

Types of Malware – Trojan Horse Malicious code disguised or embedded w/in legitimate software Delivers a payload Requires human interaction Not self replicating Spread via ICQ, IRC, e-mail attachments, web sites, or file sharing

Trojan Horse Payloads Backdoor programs Remote access Password theft Key loggers File destruction Zombies Disable anti-virus software

Types of Malware – Malicious Mobile Code Small programs downloaded from remote sites - similar to Trojan horse Run local w/ minimal/no human interaction Change cookie setting Written in Java, java script, vb script, active x Stand alone Non replicating

Types of Malware - Rootkit Program designed to take control of a computer system Root - unix, linux Administrator - windows Designed to get control of unresponsive system Replaces executable files used by OS

Types of Malware - Adware Not really malicious Nuisance Maybe an e-mail attachment Maybe part of another program Maybe a web site download ICQ Kazaa Weather Bug Zwicky

Adware - What it can do Change browser settings Re-direct start-up pages Replace browser search functions Generate pop-up ads May include spyware

Types of Malware - Spyware Similar to adware - same sources Installed surreptitiously on user’s machine Will intercept/take control of user’s machine Part of another program Used for marketing purposes May change browser settings Eula

Spyware Sites Cool web search Internet optimizer Zango Movieland Internet Spyware Prevention Act of 2007 Amended to Title 18

Types of Malware – Rogue Security Software Pretends to be real anti-virus or anti-spyware software Really malware - usually spyware delivered in the form of a Trojan Examples: Doctor anti-virus, Virus isolator, Spywiper, Malware Alarm http://www.youtube.com/watch?v=FSQ0WpoyZJo

Blended Threats Combination of malware Increases the effectiveness of an attack Website infects w/ multiple programs Example: 22 malware examples at one HYIP site

Backdoors Virus or Trojan payload Means of bypassing normal authentication Attempt to remain undetected Allows other malware to be installed May become a zombie

Backdoors Examples Sub 7 - http://hackpr.net/~sub7/main.shtml Back orifice - http://www.bo2k.com/index2.shtml Netbus - http://www.tcp-ip-info.de/trojaner_und_viren/netbus_eng.htm

Botnets Web Robot or zombie Botnet – collection/network of bots Run by bot herders Machine infected by trojan/worm/virus – opens a “backdoor” Infected machine notifies master when online Network used for criminal activities

Botherders Mischievous teenagers Organized crime Nation states Russian Business Network (RBN)

Botnet Crimes DoS / DDoS attacks Spam Click fraud Credit card # theft / Personal info theft Spamdexing Extortion Fast flux Hosting illegal information / contraband

Storm – 85,000 infected

Srizbi – 450,000

Kraken – 495,000 infected

Conficker – 9 Million Infected

Conficker

Operation Bot Roast 2007 FBI Operation Track down and arrest botherders Identified 1 million infected computers National security issue http://www.fbi.gov/page2/june07/botnet061307.htm