Understanding Computer Viruses: What They Can Do, Why People Write Them and How to Defend Against Them Computer Hardware and Software Maintenance

What is a computer virus? A computer virus is a malicious program that spreads from computer to computer.

Viruses, Worms, Trojan Horses Have you heard other names for malicious computer programs? –Viruses, Worms, Trojan Horses There are technical differences between each of these, but all of them attempt to run on your computer without your knowledge.

Malware The most general name for a malicious computer program is malware. You may have heard computer programs called software. The word malware comes from MALicious softWARE.

How does malware invade your computer? You have probably heard of some ways that malware can invade your computer. What are they? –Through attachments –By clicking on a web link when surfing the web –By downloading a program that claims to be a game or cool picture –Others?

Front Door Attacks What do many of these attacks (through , web browsing or downloads) have in common? –They all require the actions of a legitimate user. They can be considered “front door” attacks because a user is tricked into opening the door for the attack through their action.

Understanding Front Door Attacks The key to understanding front door attacks is that when you run a program it runs with *all* your rights and privileges. –If you can delete one file, any program you run can delete all your files. –If you can send one , any program you run could send thousands of spam s. This includes any program you run even accidentally by opening an attachment or clicking on web link.

Back Door Attacks Not all attacks require action by a legitimate user. “Back door” attacks target vulnerabilities in server software that is running on your computer. Server software is software that listens for requests that arrive over the network and attempts to satisfy these requests. –A web server is an example of server software.

Exploiting a weakness If an attacker crafts an attack that works on their local machine then chances are that it will work on many other machines. Attackers tend to target the most common computing platform – Windows – so that their attacks will impact the most machines.

What do viruses do? Once an attacker manages to exploit a weakness, they can run any code they want on the victim’s machine. Attack codes vary in what they try to do. Have you ever suffered a computer attack? What happened to your machine? How hard was it to recover?

What does malware do? Some attackers just want to see if they can make an attack succeed. –The malware they write may simply displaying something to the user or announce its presence in another way. Other attackers want to do damage to others without trying to benefit directly. –The malware they write might delete files or otherwise corrupt the system.

What does malware do? (continued) Still others try to write malware that steals information from the victim. –The malware they write might search for credit card numbers or other personal information and send it back to the attacker. –Spyware might watch for victim’s passwords or otherwise spy on their online activity.

What does malware do? (continued) Still others write malware that uses the victim’s computer for their own purposes. –Use it to store files (often illegal) and make them available to others – shifting liability away from the attackers. –Use it to attack other computers – making it harder to trace the attack to its real source.

Self-replicating Regardless of its other goals, a large percentage of malware tries to spread itself automatically. Malware programs may try to spread by –Sending out with infected attachments. –Send out carefully-requests back door attack packets.

Consequences of Attacks If you have ever been attacked by a computer virus, you know the damage it can cause –Your computer can begin to run very slowly and constantly pop-up annoying messages that make it difficult to do anything productive. –Having the virus removed by a technician can be expensive and time-consuming. –The virus itself may destroy irreplaceable files like family pictures or videos. Even if the virus itself does not cause data loss, often the process of removing the virus can require reinstalling the operating system and all the programs. –Your credit card or other private information can be stolen.

World-wide damage estimates Computer viruses cause a huge amount of damage worldwide. –Damages from just one virus (The I Love You Virus) are estimated at $10 billion dollars. It is also estimated that 45 million people worldwide were affected. Costs come from restoring damaged systems, replacing lost information, steps taken to prevent attacks and steps taken to prepare to recover from attacks.

Blackhat vs. Whitehat Blackhat computer hackers look for flaws in software to exploit them or break into computer for malicious purposes. Whitehat computer hackers look for flaws in software to fix them or attempt to break into computers to audit their security.

What do whitehat hackers do? Analyze server software for flaws that could be exploited and recommend fixes. Analyze new viruses or malware to characterize what they are doing and to build patches. Audit the overall security of computer systems.

Defenses Even if you are not whitehat hacker there is a lot you can do to defend your computer against attack Defending against front door attacks means being careful about what programs you run and what attachments and links you open Defending against back door attacks means knowing what services are running on your machine and keeping them patched

Defending against front door attacks 1) Be careful opening attachments even from friends. 2) Be careful clicking on web links found on less reputable web sites. 3) Beware of free downloads that seem too good to be true. 4) Use a good virus scanner and keep your virus signatures up-to-date. 5) Consider using less popular readers and web browser software.( Attackers target the most popular software.) There are excellent and free open source options.

Defending against back door attacks 1) Use netstat to see what services are running. 2) Periodically check to see if any new services have been started. 3) Keep your server software patched and up-to-date. 4) Consider shutting down any services you do not need.

Prepare to recover from an attack No matter how careful you are it is still wise to prepare to recover from an attack if one does occur. –1) Back up your personal data such as digital pictures, letter and papers you’ve written, your address book, etc. –2) Keep track of the software you’ve installed on your computer including where you got it and any activation keys you paid for.

Conclusion Knowing the different kinds of attacks and the goals of attackers can help you understand how better to defend yourself.