Malware Threats and Distribution Methods

Malware Threats

• Malware is malicious software designed to damage or disable computer systems. It grants limited or full control to the creator for theft or fraud.
• Examples of malware include Trojan horses, viruses, backdoors, worms, rootkits, spyware, ransomware, botnets, adware, and crypters.

Different Ways Malware Enters a System

• Instant messaging applications (e.g., IRC)
• Browser and email software bugs
• Removable devices
• Attachments
• Legitimate software (packaged by disgruntled employees)
• Fake programs
• Untrusted websites and freeware software
• Downloading files, games, screensavers from the internet

Common Techniques for Distributing Malware

• Blackhat SEO: Ranking malware pages highly in search engine results.
• Social Engineering: Tricking users to click on innocent-looking webpages (Click-jacking).
• Malvertising: Embedding malware in ad networks displayed on legitimate high-traffic sites.
• Spearphishing: Mimicking legitimate institutions to steal login credentials.
• Compromised websites: Hosting embedded malware that spreads to unwitting visitors.
• Drive-by Downloads: Exploiting browser software flaws to install malware just by visiting a website.

How Hackers Use Trojans

• Delete or replace critical operating system files.
• Disable firewalls and antivirus software.
• Generate fake traffic to create denial-of-service (DoS) attacks.
• Record screenshots, audio, and video of the victim's PC.
• Use the victim's PC for spamming and blasting emails.
• Download spyware, adware, and malicious files.
• Create backdoors to gain remote access.
• Infect the victim's PC as a proxy server to relay attacks.
• Use the victim's PC as a botnet to perform DDoS attacks.
• Steal information (passwords, security codes, credit cards) using keyloggers.

How to Infect Systems Using a Trojan

• Create a new Trojan packet using a Trojan Horse Construction Kit.
• Create a dropper to install the malicious code onto the target system.
• Create a wrapper to hide the Trojan.
• Propagate the Trojan (spread it).
• Execute the dropper.
• Execute the damage routine.

Wrappers

• Trojans can be bundled with seemingly innocent applications (e.g., games, office apps) using wrappers.
• Wrappers hide Trojans inside legitimate-looking files (Chess.exe, File Size: 110 KB).
• Attackers use wrappers for deceptive greetings.

Command Shell Trojans

• Command shell Trojans give remote control of a command shell on a victim's machine.
• A Trojan server is installed on the victim's machine, opening a port for the attacker's client to connect.
• The attacker's client installs on their machine to launch the command shell on the target machine.

Remote Access Trojans (RATs)

• These Trojans act like remote desktop access software.
• Hackers gain complete GUI access to the remote system.
• Victim computers are infected with server.exe and Reverse Connecting Trojan.
• Trojans connect to port 80 to the attacker in Russia (and other locations).
• Attackers have complete control over the victim's machine.

Botnet Trojans

• Botnet Trojans infect multiple computers to create a botnet controlled by a central location (C&C center).
• Botnets launch denial-of-service attacks, spam campaigns, click fraud, and financial theft.

Evading Anti-Virus Techniques

• Breaking the Trojan into multiple pieces and zipping it.
• Writing custom Trojans and embedding them into applications.
• Changing Trojan syntax to evade detection.
• Altering file content and checksums (using hex editors).
• Converting executable files to other types (e.g., script files).
• Downloading Trojans from the internet (evading detection).

Introduction to Viruses

• Viruses replicate by attaching themselves to other programs, computer boot sectors, or documents.
• Viruses spread through downloads, infected disks/flash drives, and email attachments.
• Virus characteristics include infecting other programs, altering data, transforming themselves, corrupting files/programs, encrypting themselves, and self-replicating.

Stages of Virus Life

• Design: Creating the virus using programming kits or languages.
• Replication: Virus replicates in the targeted system.
• Launch: Virus activates.
• Detection: Anti-malware software identifies virus as threat.
• Incorporation: Anti-malware developers adapt to the virus to avoid vulnerability.
• Elimination: Users eliminate virus threats.

Why People Create Computer Viruses

• Inflict damage to competitors.
• Financial benefits.
• Research projects.
• Cyber terrorism.
• Play pranks.
• Vandalism.

How Computers Get Infected By Viruses

• Accepting files or downloads without proper verification.
• Opening infected email attachments.
• Installing pirated software (unverified).
• Failing to keep software/plug-ins updated.
• Not running the latest anti-virus/anti-malware software.

Encryption Viruses

• Encryption viruses encrypt the code. The encrypted virus has a different key for each infected file.
• Anti-virus scanners can't directly detect these, as they utilize encryption methods.

Computer Worms

• Computer worms are malicious programs that replicate, execute, and spread across networks autonomously.
• They spread through network connections.
• Worms may carry a payload (for damage).
• Some worms use infected computers to create large botnets.

How Worms Differ from Viruses

• Worms can replicate independently without attaching to other programs.
• Worms use network resources to spread.
• Viruses need to attach to a host to spread, whereas worms can replicate and spread independently.

Anti-Virus Sensor Systems

• Detect and analyze malicious code threats (viruses, worms, and Trojans)

How to Detect Trojans

• Scan for suspicious open ports.
• Scan for suspicious startup programs.
• Scan for suspicious running processes.
• Scan for suspicious files and folders.
• Scan for suspicious registry entries.
• Scan for suspicious network activities.
• Scan for suspicious device drivers.
• Scan for suspicious Windows services.
• Run Trojan scanner to detect Trojans.

Trojan Countermeasures

• Avoid opening email attachments from unknown senders.
• Install security updates for operating systems and applications.
• Block unnecessary ports and use a firewall.
• Avoid accepting programs through instant messaging.
• Harden weak default configuration settings for programs.
• Monitor internal network traffic for unusual ports or encrypted traffic.
• Scan CDs and DVDs with antivirus before use.
• Restrict application permissions.
• Avoid downloading applications or files from untrusted sources.
• Maintain local workstation file integrity.
• Employ anti-virus and intrusion detection software.

Backdoor Countermeasures

• Use commercial anti-virus software to automatically scan and detect backdoors.
• Educate users about safe application installation practices.
• Use anti-virus tools like McAfee or Norton to detect and eliminate the backdoors.

Virus and Worms Countermeasures

• Install effective anti-virus software.
• Pay attention to download instructions from legitimate sources.
• Avoid opening attachments from unknown senders.
• Generate an anti-virus policy for appropriate computing practices.
• Update antivirus software regularly.
• Back up data regularly in the event of virus infection.
• Do not accept disks or programs without verifying their safety.
• Implement anti-virus software to detect infections.
• Ensure all executable code complies with organization policy.
• Do not boot from infected bootable disks.
• Stay informed about the latest virus threats.
• Implement internet security policies.
• Use antivirus/firewall for protection.
• Be cautious with instant messages.

Anti-Virus Tools

• List of popular anti-virus tools provided. (specific URLs for each provided).