Back to Threads
Researchers tend to classify malware into one or more sub-types (i.e., computer viruses, computer worms, Trojan horses, ransomware, spyware, adware, rogue software, wipers, and keyloggers).
Malware poses serious problems to individuals and businesses on the internet. According to Symantec's 2018 Internet Security Threat Report (ISTR), the malware variants number has increased to 669,947,865 in 2017, which is twice as many malware variants as in 2016.
Cybercrime, which includes malware attacks as well as other crimes committed by computers, was predicted to cost the world economy US $6 trillion in 2021 and is increasing at a rate of 15% per year. Since 2021, malware has been designed to target computer systems that run critical infrastructure such as the electricity distribution network.
The defense strategies against malware differ according to the type of malware but most can be thwarted by installing antivirus software, and firewalls, applying regular patches, securing networks from intrusion, having regular backups, and isolating infected systems. Malware can be designed to evade antivirus software detection algorithms.
The notion of a self-reproducing computer program can be traced back to initial theories about the operation of complex automata. John von Neumann showed that in theory, a program could reproduce itself. This constituted a plausibility result in computability theory. Fred Cohen experimented with computer viruses confirmed Neumann's postulate and investigated other properties of malware such as detectability and self-obfuscation using rudimentary encryption. His 1987 doctoral dissertation was on the subject of computer viruses. The combination of cryptographic technology as part of the payload of the virus, exploiting it for attack purposes was initialized and investigated from the mid-1990s, and includes initial ransomware and evasion ideas.
Before Internet access became widespread, viruses spread on personal computers by infecting executable programs or boot sectors of floppy disks. By inserting a copy of itself into the machine code instructions in these programs or boot sectors, a virus causes itself to be run whenever the program is run or the disk is booted. Early computer viruses were written for the Apple II and Macintosh, but they became more widespread with the dominance of the IBM PC and MS-DOS systems. The first IBM PC virus in the "wild" was a boot sector virus dubbed (c)Brain, created in 1986 by the Farooq Alvi brothers in Pakistan. Malware distributors would trick the user into booting or running from an infected device or medium. For example, a virus could make an infected computer add autorunnable code to any USB stick plugged into it. Anyone who then attached the stick to another computer set to autorun from USB would in turn become infected and also pass on the infection in the same way.
Older email software would automatically open HTML emails containing potentially malicious JavaScript code. Users may also execute disguised malicious email attachments. The 2018 Data Breach Investigations Report by Verizon, cited by CSO Online, states that emails are the primary method of malware delivery, accounting for 96% of malware delivery around the world.
The first worms, network-borne infectious programs, originated not on personal computers, but on multitasking Unix systems. The first well-known worm was the Morris worm of 1988, which infected SunOS and VAX BSD systems. Unlike a virus, this worm did not insert itself into other programs. Instead, it exploited security holes (vulnerabilities) in network server programs and started running as a separate process.[18] This same behavior is used by today's worms as well.
With the rise of the Microsoft Windows platform in the 1990s and the flexible macros of its applications, it became possible to write infectious code in the macro language of Microsoft Word and similar programs. These macro viruses infect documents and templates rather than applications (executables) but rely on the fact that macros in a Word document are a form of executable code.
Many early infectious programs, including the Morris Worm, the first internet worm, were written as experiments or pranks. Today, malware is used by both black hat hackers and governments to steal personal, financial, or business information. Today, any device that plugs into a USB port – even lights, fans, speakers, toys, or peripherals such as a digital microscope – can be used to spread malware. Devices can be infected during manufacturing or supply if quality control is inadequate.
Since the rise of widespread broadband Internet access, malicious software has more frequently been designed for profit. Since 2003, the majority of widespread viruses and worms have been designed to take control of users' computers for illicit purposes. Infected "zombie computers" can be used to send email spam, host contraband data such as child pornography, or engage in distributed denial-of-service attacks as a form of extortion. Malware is used broadly against government or corporate websites to gather sensitive information or to disrupt their operation in general. Further, malware can be used against individuals to gain information such as personal identification numbers or details, bank or credit card numbers, and passwords.
In addition to criminal money-making, malware can be used for sabotage, often for political motives. Stuxnet, for example, was designed to disrupt very specific industrial equipment. There have been politically motivated attacks that spread over and shut down large computer networks, including massive deletion of files and corruption of master boot records, described as "computer killing." Such attacks were made on Sony Pictures Entertainment (25 November 2014, using malware known as Shamoon or W32.Disttrack) and Saudi Aramco (August 2012).
Obtained from trustworthy sources. For example, Google Play Apps, and Apple Apps.
Insufficient consensus and/or metrics. For example, Potentially Unwanted Programs (PUP), Spyware, Adware.
The broad consensus among antivirus software is that the program is malicious or obtained from flagged sources. For example, Viruses, Worms, Root Kits, Backdoors, Ransomware, and Trojan horses.
3.4 Scareware
Internet has changed how we talk, shop, play, etc. It has even changed the way how the criminals target people for ransom. While surfing the Internet, suddenly a pop-up alert appears on the screen which warns of the presence of dangerous viruses, spyware, etc in the user's computer. As a remedial measure, the message suggests downloading the full paid version of the software. As the user proceeds to download, a malicious code, known as scareware is downloaded into the host computer. It holds the host computer hostage until the ransom is paid. The malicious code can neither be uninstalled nor can the computer be used till the ransom is paid.
Trojan Horse is a malicious code that is installed in the host machine by pretending to be useful software. The user clicks on the link or downloads the file which pretends to be a useful file or software from a legitimate source. It not only damages the host computer by manipulating the data but also it creates a backdoor in the host computer so that it can be controlled by a remote computer. It can become part of a botnet (robot network), a network of computers that are infected by malicious code and controlled by the central controller. The computers of this network that are infected by malicious code are known as zombies. Trojans neither infect the other computers in the network nor do they replicate.
3.6 Worms
They are a class of viruses that can replicate themselves. They are different from the virus by the fact that they do not require human intervention to travel over the network and spread from the infected machine to the whole network. Worms can spread either through the network, using the loopholes of the Operating System, or via email. The replication and spreading of the worm over the network consumes the network resources like space and bandwidth and forces the network to choke.
3.7 Virus
A virus is a malicious code written to damage/harm the host computer by deleting or appending the file, occupying memory space of the computer by replicating the copy of the code, slowing down the performance of the computer, formatting the host machine, etc. It can be spread via email attachments, pen drives, digital images, e-greetings, audio, or video clips, etc. A virus may be present in a computer but it can't activate itself without human intervention.
There are some malicious software that are downloaded along with the free software offered over the internet and installed in the host computer without the knowledge of the user. This software modifies the browser's settings and redirects links to other unintentional sites.
It is a special type that is installed in the target computer with or without the user's permission and is designed to steal sensitive information from the target machine. Mostly it gathers the browsing habits of the user and then sends it to the remote server without the knowledge of the owner of the computer. Most of the time they are downloaded into the host computer while downloading freeware i.e. free application programs from the internet. Spyware may be of various types; It can keep track of the cookies of the host computer, it can act as a keylogger to sniff the banking passwords and sensitive information, etc.
It is a special type of malware which is used for forced advertising. They either redirect the page to some advertising page or pop up an additional page which promotes some product or service. These adware are financially supported by organizations whose products are advertised.
No comments yet.
You must be logged in to leave a comment. Login here