Malware Threats and Distribution Techniques

Malware Threats

• Malware is malicious software that damages or disables computer systems, granting limited or complete control to the creator for theft or fraud.
• Examples of malware include Trojan Horses, viruses, backdoors, worms, rootkits, spyware, ransomware, botnets, adware, and crypters.

Ways Malware Enters a System

• Instant messenger applications (IRC, etc.)
• Browser and email software bugs
• Removable devices
• Attachments
• Legitimate "shrink-wrapped" software (planted by disgruntled employees)
• NetBIOS (File Sharing)
• Fake programs
• Untrusted sites and freeware
• Downloading files, games, and screensavers from the internet.

Common Malware Distribution Techniques

• Blackhat SEO: Ranking malware pages highly in search results.
• Social Engineering: Tricking users into clicking malicious links or downloads.
• Clickjacking: Tricking users into clicking innocent-looking links or webpages that trigger malware installation.
• Malvertising: Embedding malware within ad networks.
• Spearphishing: Mimicking legitimate institutions to steal login credentials.
• Compromised Legitimate Websites: Hiding malware on legitimate websites to infect visitors.
• Drive-by Downloads: Exploiting vulnerabilities in browser software to install malware simply by visiting a webpage.

How Hackers Use Trojans

• Deleting or replacing critical operating system files.
• Disabling firewalls and antivirus software.
• Generating fake traffic to trigger DOS attacks.
• Recording screenshots, audio, and video of the victim's PC.
• Using the victim's PC for spamming and sending emails.
• Downloading spyware, adware, and malicious files.
• Creating backdoors for remote access.
• Infecting as a proxy server for relaying attacks.
• Using the victim's PC as a botnet to execute DDoS attacks.
• Stealing information like passwords, security codes, and financial details using keyloggers.

How to Infect Systems Using a Trojan

• Create a new Trojan packet using a Trojan Horse Construction Kit.
• Create a dropper, which installs the malicious code on the target system.
• Create a wrapper using wrapper tools to install the Trojan on the victim's computer.
• Propagate the Trojan.
• Execute the dropper.
• Execute the damage routine.

Wrappers

• Bind a Trojan executable to an innocent-looking application (games or office apps).
• After execution, first install the Trojan in the background and then run the wrapping application in the foreground.
• Combine multiple programs into one single file.
• Attackers might disguise a greeting as a malicious Trojan installation.

Command Shell Trojans

• Give remote control of a command shell on a victim's machine.
• The Trojan server is installed on the victim's machine, opening a port for the attacker to connect.
• The attacker's client machine is used to launch a command shell on the victim's machine.

Remote Access Trojans (RATs)

• Acts like a remote desktop access, granting hackers complete GUI access to the target system.
• The Trojan infects a computer (e.g., server.exe) and connects to Port 80, establishing a reverse connection with the attacker.
• The attacker gains complete control over the infected machine.

Botnet Trojans

• Infects a large number of computers to create a network of bots controlled by a C&C (Command and Control) center.
• Launching various cyber-attacks such as denial-of-service, spamming, click fraud, and financial information theft.

Evading Anti-Virus Techniques

• Breaking the Trojan file into multiple pieces and zipping them as a single file.
• Writing custom Trojans and embedding them into applications.
• Changing Trojan syntax (e.g., converting EXE to VB script, changing extensions).
• Modifying Trojan content using a hex editor and changing checksums.
• Never using Trojans downloaded from the web.

Introduction to Viruses

• Self-replicating programs that copy themselves by attaching to programs, boot sectors, or documents.
• Often transmitted via file downloads, infected flash drives, and email attachments.
• Characteristics include infecting other programs, altering data, corrupting files, transforming themselves, encrypting themselves, and self-replicating.

Stages of Virus Life Cycle

• Design: Developing virus code using programming languages or construction kits.
• Replication: Virus replicates for a time in the target system before spreading.
• Launch: Virus is activated when the user performs certain actions.
• Detection: Antivirus software detecting the virus.
• Incorporation: Antivirus software incorporating defenses against the virus.
• Elimination: Users install antivirus updates to remove the virus threat.

Why People Create Computer Viruses

• Inflict damage to competitors.
• Achieve financial benefits.
• Conduct research projects.
• Play pranks
• Vandalism
• Cyberterrorism
• Distribute political messages

How a Computer Gets Infected by Viruses

• Accepting files and downloads without checking the source.
• Opening infected email attachments.
• Installing pirated software.
• Not updating or installing new versions of plug-ins.
• Not running the latest antivirus application.

Encryption Viruses

• Viruses that use simple encryption to encipher the code.
• Each infected file is encrypted using a different key.
• Antivirus scanners cannot detect them using signature detection methods.

Computer Worms

• Self-replicating malicious programs that spread across networks without human interaction.
• Most spread to consume resources, some carry a payload to damage the system.
• Attackers use worm payloads to create backdoors on infected computers, forming botnets for further attacks.

How a Worm Differs from a Virus

• Worms replicate on their own and use memory to spread; viruses cannot attach to other programs.
• Worms utilize network features for propagation, while viruses don't spread automatically across a network.

Anti-Virus Sensor Systems

• Computer software that detects and analyzes malicious code.
• Detects various threats, including viruses, worms, and Trojans.
• Commonly used with sheep dip computers.

How to Detect Trojans

• Scanning for suspicious open ports.
• Scanning for suspicious startup programs.
• Scanning for suspicious running processes.
• Scanning for suspicious files and folders.
• Scanning for suspicious registry entries.
• Scanning for suspicious network activities.
• Scanning for suspicious device drivers.
• Scanning for suspicious Windows services.
• Running a Trojan scanner.

Trojan Countermeasures

• Avoid opening unknown email attachments.
• Install security updates for operating systems and applications.
• Block unnecessary network ports.
• Avoid accepting programs via instant messaging.
• Harden default configuration settings.
• Monitor network traffic for anomalies.
• Scan CDs and DVDs with antivirus software.
• Restrict permissions for applications and prevent malicious applications' installation.
• Avoid typing commands and pre-fabricated programmes.
• Ensure file integrity.
• Download and run software only from trusted sources.
• Run host-based antivirus, firewall, intrusion detection software.

Backdoor Countermeasures

• Utilize commercial antivirus products for automatic backdoor detection and removal.
• Educate users to avoid downloading applications from untrusted sources and phishing links.
• Utilize anti-virus tools to detect and remove backdoors.

Virus and Worms Countermeasures

• Install reliable anti-virus software to detect and remove viruses and worms.
• Implement an anti-virus policy for safe computing.
• Regularly update anti-virus software.
• Maintain data backups.
• Carefully inspect any software or files before execution.
• Use a current antivirus version when verifying if a file isn't malicious from an unknown source.
• Employ pop-up blockers and firewalls to prevent malicious program execution.
• Scan DVDs and CDs before opening.
• Be cautious with emails and instant messages.

Anti-Virus Tools

• Provides a list of various anti-virus tools with associated URLs.