Malicious Software & Cyber Threats

Malicious Software Overview

• Malware is a key topic, referring to software designed to cause harm to computer systems or networks.
• Understanding the implications of malware is crucial in cybersecurity.
• Flooding based DDoS attacks are a significant type of cyber threat.
• The operation and impact of Botnets needs to be understood.

Malicious Software Basics

• Malicious software can harm computing systems or networks through intentionally inserted code.
• Malware is a general term that encompasses various types of malicious software.
• A virus replicates itself into other programs, and its malicious code runs when executed.
• A worm can execute on its own without needing to attach to a host program.
• Keyloggers are a type of malicious software that captures keystrokes.
• Spyware collects information from one computer and illegally transmits it to another.
• Ransomware locks files on a computer, demanding payment for their release.

Insider Attacks

• Insider Attacks are generated by someone who is part of the development team.
• An example includes a programmer working on a project who introduces malicious code.
• Embedded malware can be installed as part of the OS or with applications.
• A backdoor is a hidden feature that provides unauthorized access or manipulation of a target system.
• Backdoors can provide remote access to computers.
• Backdoors can be used for legitimate or illegitimate purposes.
• A logic bomb executes malicious code when a specific trigger condition is met.

Logic Bomb Example

• Example of logic bomb code is shown here

legitimate code
if day is Friday the 13th;
crash_computer();
legitimate code

Defense Against Insider Attacks

• Multiple people should maintain systems to mitigate the risk of insider threats.
• Code walk-throughs can help identify malicious code inserted by insiders.
• The least privilege principle should be enforced to limit the access of insiders.
• Employee behavior should be monitored to detect potential insider threats.

Virus Phases

• The dormant phase is when the virus is inactive and waiting for a trigger.
• The propagation phase involves the virus replicating and spreading to other systems.
• The triggering phase is when a specific event causes the virus to activate.
• The action phase is when the virus performs its malicious activity.

Virus Defense

• Detection and use of antivirus software is a key defense mechanism.
• Evasion techniques, like encryption, can be used by viruses to avoid detection.
• Polymorphic viruses change their code to avoid detection by signature-based antivirus software.
• Metamorphic viruses rewrite their entire code with each infection to evade detection.
• It is possible to use of signatures to identify known viruses.
• In-order signatures must match the exact sequence of bytes in a virus.
• Conjunction signatures require the presence of multiple specific byte sequences.
• Probabilistic signatures use statistical analysis to identify likely virus code.

Actions of Malware

• Malware can send copies of itself to spread to other systems.
• Malware can take actions without the user's knowledge.
• Malware can generate network traffic, leading to DoS and DDoS attacks.
• Malware can harvest passwords, encrypt files and data, and delete files.
• Malware can infect other machines.

Flooding Based DDoS Attacks

• Flooding attacks overwhelm the victim with a high volume of traffic.
• Examples include ICMP Flood and UDP Flood attacks.
• Multiple bots are involved in the attack.
• Bots send a flood of packets to the victim, disrupting its services.

Reflection and Amplification DDoS Attacks

• Amplification attacks use intermediaries to increase the volume of attack traffic.
• Small requests are sent to DNS/NTP servers with the source IP spoofed to be the victim's IP.
• The DNS/NTP servers send large responses to the victim.
• Multiple bots are involved in the attack.

Botnets

• A bot is a program that performs automated tasks.
• A bot itself is not inherently bad, but it can be used for malicious purposes.
• A botnet is a collection of computers connected and working under the instruction of a master.
• Botnets are typically used for committing computer crimes.
• A botnet is controlled by a person or a group of people.
• Botnets are usually driven by monetary interests.
• Botnets are used by advertisement companies and spam mailing companies.

Botnet Components

• The command and control infrastructure is essential for managing the botnet.
• In a centralized model, a central server controls all the bots.
• In a distributed model, bots work more autonomously, often called peer-to-peer botnets.
• Reliable connectivity, robustness, and quick reaction time are crucial for botnet effectiveness.
• The communication protocol is used for communication between the botmaster and the bots.

Centralized Control

• A central server directly controls all the bots in the botnet.

Decentralized Control

• Bots communicate with each other, leading to a more resilient botnet structure.