Malware Overview and Prevention - Week 6

Malware Overview

• Malware comes in three forms: viruses, worms, and Trojans.
• Viruses attach to files, replicate, and spread. They can be polymorphic (mutate to avoid detection) and have triggers like logic bombs or time bombs. Spread via files, boot sectors, and email attachments.
• Worms replicate across systems without user interaction, exploiting network vulnerabilities. Cause slowdowns and provide remote access for attackers (e.g., Blaster and Witty worms).
• Trojans appear harmless but hide malicious activities like keylogging (recording keystrokes) or opening backdoors for attackers to control remotely.

Malware Detection and Prevention

• User Awareness educating users to avoid risky behaviors (e.g., downloading suspicious files) prevents infections.
• Technical Solutions, like write protection, firewalls, and intrusion detection systems help prevent attacks.
• Antivirus Software identifies and removes malware but requires regular updates to recognize new threats.

Antivirus Approaches

• Virus Dictionaries scan for known virus signatures. Struggles with unknown or polymorphic viruses.
• Behavior Blockers monitor suspicious system commands (e.g., file deletions) and alert users before actions are carried out.
• Integrity Checkers detect changes in files caused by malware but only after some damage has occurred.
• Activity Monitoring tracks program behavior for unusual activities (e.g., attempting to alter other programs) but can produce false positives. Suspected files can be quarantined (isolated) in a sandbox environment.

Threat Modeling

• A systematic process for identifying potential threats and security risks.
• Provides a more comprehensive approach to evaluating security risks than a more ad-hoc approach. Helpful in preventing vulnerabilities.
• Systematic Approach involves mapped-out steps to map the threat landscape.
• Threat Actors vs. Defenders Attackers only need to exploit one vulnerability, while defenders must protect against all possible threats.
• General Approach (Key Questions):
  • What are we building? (system description, diagrams)
  • What can go wrong? (brainstorming threats, STRIDE, cyber kill chains, attack trees)
  • What will we do about it? (Identify and implement mitigation, prioritize actions)
  • Reflection (review, reflect, revise procedures)

STRIDE Framework

• Spoofing (S): Masquerading as another user or entity (e.g., phishing emails). Mitigation: Ensure strong authentication.
• Tampering (T): Unauthorized modification of data (e.g., changing salary information). Mitigation: Protect data integrity via encryption and checksums.
• Repudiation (R): Denying responsibility for an action (e.g., denying sending an email). Mitigation: Implement non-repudiation mechanisms.
• Information Disclosure (I): Unauthorized access to information (e.g., password leaks). Mitigation: Strong encryption, access controls, and proper data handling.
• Denial of Service (D): Preventing legitimate users from accessing services (e.g., DDoS attacks). Mitigation: Firewalls, intrusion detection/prevention systems, load balancing.
• Elevation of Privilege (E): Gaining unauthorized access to higher-level permissions (e.g., read-only user gaining write access). Mitigation: Authorization mechanisms, role-based access controls (RBAC), privilege separation.

Cyber Kill Chain

• Sequence of actions attackers typically follow to infiltrate a network.

• Stages:

  • Reconnaissance: Gathering information about the target (identifying weaknesses, entry points).
  • Weaponization: Creating the malicious tool or payload.
  • Delivery: Delivering the malware or exploit.
  • Exploitation: Executing the malware to gain access.
  • Installation: Establishing the attacker's presence.
  • Command and Control (C2): Establishing communication with the compromised system.
  • Actions on Objectives: Achieving final goal (e.g., exfiltrating data, disrupting services).

Additional Notes (page 5)

• Example Mitigation: Steps for minimizing attack success:
  • detecting attackers
  • stopping attackers gaining access
  • disrupting outbound data
  • counter-attacking the attacker
  • deceiving the attacker