1. Malware
CJ 520
10.0

2. Malware
“software designed to infiltrate or damage a computer system without the owner's informed consent”

3. Why Care About Malware? Estimated malware cost 2006 - $13.3 billion
Cyber attacks, From Russia with Love
April Estonia
July Georgia preceding physical attack
November US Pentagon

4. Why is Malware so prevalent?
Computers & networks not designed with security in mind
Most computers run the same OS
Most computers connected to the Internet
Most people use
Knowledge base of average user declining
Cyber attacks on the rise
Computers are everywhere

5. Types of Malware - Viruses
Small piece of code, piggybacks on a real program
Every time the program runs, virus loaded into memory
Once in memory, virus copies itself to other files
Can also be an attachment

6. Virus Characteristics
Must have a host file
Self-replicating
Requires human interaction to replicate
Has a payload

7. Virus Environments File viruses Boot viruses OS specific
Part of an executable file
May or may not run original program code
Boot viruses
Copies itself to boot sector
Copies itself to memory every time computer starts

8. Virus Environments cont.
Macro viruses
Part of an office document
Copies itself to a global macro
Network viruses
Attacks networks &/or
Can run themselves
Don’t change file content
Cross platform viruses

9. Types of Malware - Worms
Self-replicating stand alone
Specific to network
No human intervention
Most viruses really worms
Types of worms -

10. Types of Malware – Trojan Horse
Malicious code disguised or embedded w/in legitimate software
Delivers a payload
Requires human interaction
Not self replicating
Spread via ICQ, IRC, attachments, web sites, or file sharing

11. Trojan Horse Payloads Backdoor programs Remote access Password theft
Key loggers
File destruction
Zombies
Disable anti-virus software

12. Types of Malware – Malicious Mobile Code
Small programs downloaded from remote sites - similar to Trojan horse
Run local w/ minimal/no human interaction
Change cookie setting
Written in Java, java script, vb script, active x
Stand alone
Non replicating

13. Types of Malware - Rootkit
Program designed to take control of a computer system
Root - unix, linux
Administrator - windows
Designed to get control of unresponsive system
Replaces executable files used by OS

14. Types of Malware - Adware
Not really malicious
Nuisance
Maybe an attachment
Maybe part of another program
Maybe a web site download
ICQ
Kazaa
Weather Bug
Zwicky

15. Adware - What it can do Change browser settings
Re-direct start-up pages
Replace browser search functions
Generate pop-up ads
May include spyware

16. Types of Malware - Spyware
Similar to adware - same sources
Installed surreptitiously on user’s machine
Will intercept/take control of user’s machine
Part of another program
Used for marketing purposes
May change browser settings
Eula

17. Spyware Sites Cool web search Internet optimizer Zango Movieland
Internet Spyware Prevention Act of 2007
Amended to Title 18

18. Types of Malware – Rogue Security Software
Pretends to be real anti-virus or anti-spyware software
Really malware - usually spyware delivered in the form of a Trojan
Examples: Doctor anti-virus, Virus isolator, Spywiper, Malware Alarm

19. Blended Threats Combination of malware
Increases the effectiveness of an attack
Website infects w/ multiple programs
Example: 22 malware examples at one HYIP site

20. Backdoors Virus or Trojan payload
Means of bypassing normal authentication
Attempt to remain undetected
Allows other malware to be installed
May become a zombie

21. Backdoors Examples Sub 7 - http://hackpr.net/~sub7/main.shtml
Back orifice -
Netbus -

22. Botnets Web Robot or zombie Botnet – collection/network of bots
Run by bot herders
Machine infected by trojan/worm/virus – opens a “backdoor”
Infected machine notifies master when online
Network used for criminal activities

23. Botherders Mischievous teenagers Organized crime Nation states
Russian Business Network (RBN)

24. Botnet Crimes DoS / DDoS attacks Spam Click fraud
Credit card # theft / Personal info theft
Spamdexing
Extortion
Fast flux
Hosting illegal information / contraband

25. Storm – 85,000 infected

26. Srizbi – 450,000

27. Kraken – 495,000 infected

28. Conficker – 9 Million Infected

29. Conficker

30. Operation Bot Roast 2007 FBI Operation
Track down and arrest botherders
Identified 1 million infected computers
National security issue