Understanding Malware Types

Types of Malware

• Cybercriminals use diverse malware to perform malicious actions.
• Malware includes any code used to steal data, bypass access controls, compromise systems or cause harm.
• Understanding malware types and how they spread is crucial for containment and removal.

Spyware

• Spyware tracks online activity and logs keystrokes to capture various data, including sensitive information.
• It modifies device security settings and often bundles with legitimate software or Trojan horses.

Adware

• Adware automatically delivers advertisements to users, often through web browsers.
• It commonly comes with spyware.

Backdoor

• Backdoor malware bypasses authentication procedures for unauthorized system access.
• Hackers can remotely access resources and issue system commands.
• Backdoors operate in the background and are hard to detect.

Ransomware

• Ransomware holds a computer system or data captive until a payment is made, usually by encrypting the data.
• It can exploit system vulnerabilities and is spread via phishing emails or software vulnerabilities.

Scareware

• Scareware tricks users into specific actions using 'scare' tactics.
• It uses operating system-style pop-up windows to warn of system risks and prompts the use of a specific program.
• Executing the prompted program infects the system.

Rootkit

• Rootkits modify the operating system to create backdoors for remote access.
• They exploit vulnerabilities for privilege escalation and modify system files.
• Rootkits modify system forensics and monitoring tools, making them hard to detect and often requiring a complete system wipe and software reinstall.

Virus

• Viruses replicate and attach to executable files by inserting their code.
• They need user interaction to activate and can be programmed to act on a specific date or time.
• Viruses can vary from harmless to destructive, modifying or deleting data.
• They can also mutate to evade detection and spread through USB drives, optical disks, network shares, or email.

Trojan Horse

• Trojan horses perform malicious operations while disguised as legitimate software.
• Unlike viruses, they don't self-replicate but trick users into installing malicious software.
• Commonly found in image, audio, or game files and exploits user privileges

Worms

• Worms replicate to spread from one computer to another.
• They do not require a host program or user participation, and spread quickly over networks.
• They exploit system vulnerabilities, propagate themselves, and carry malicious code (payloads) to damage systems or networks.
• In 2001, the Code Red worm infected over 300,000 servers in 19 hours.

Symptoms of Malware

• Increased CPU usage slowing down your device
• Computer freezing or crashing
• Decreased web browsing speed
• Unexplained network connection problems
• Modified or deleted files
• Presence of unknown files, programs, or desktop icons
• Unknown processes running
• Programs turning off or reconfiguring
• Emails sending without user knowledge or consent

Social Engineering

• Social engineering manipulates people into divulging confidential information or performing certain actions.
• Social engineers exploit the helpfulness or weaknesses of individuals.

Pretexting

• Pretexting involves an attacker lying to an individual to gain access to privileged data.
• Impersonating someone in need of personal or financial data to confirm identity.

Tailgating

• Tailgating involves an attacker quickly following an authorized person into a secure location.

Quid pro quo

• Quid pro quo is when attackers request personal information in exchange for something, such as a free gift.

Denial of Service (DoS) Attacks

• DoS attacks interrupt network services to users, devices, or applications.
• They are relatively simple to execute, even by unskilled attackers.

Overwhelming traffic

• An overwhelming quantity of traffic involves sending an unmanageable amount of data to a network, host, or application.
• This leads to slowdowns or crashes.

Maliciously formatted packets

• Maliciously formatted packets involve sending packets with errors or improper formatting over a network.
• The receiving device can't handle these packets, resulting in slow performance or crashes.

Distributed DoS (DDoS) Attacks

• DDoS attacks originate from multiple coordinated sources and are similar to DoS attacks.
• An attacker builds a botnet of infected hosts (zombies) controlled by handler systems, which scan and infect more hosts.
• The hacker instructs handler systems to use the botnet for a DDoS attack.

Botnets

• Botnets consist of infected computer by visiting unsafe websites or opening infected attachments/media files.
• A botnet is controlled by a command-and-control (C&C) server.
• Cybercriminals use botnets for activities like distributing malware, launching DDoS attacks, distributing spam, or brute-force password attacks.
• Cybercriminals rent botnets to third parties for nefarious purposes.
• Organizations use botnet traffic filters to identify botnet locations.
• Infected bots attempt to communicate with a C&C host and Cisco's firewall filters detect traffic from infected devices.
• Cloud-based Cisco Security Intelligence Operations (SIO) pushes down updated filters to firewalls for new botnets
• Cisco's security team is alerted to infected devices to mitigate threats.

On-Path Attacks

• On-path attackers intercept or modify communications between devices to collect information or impersonate.
• Also called man-in-the-middle (MitM) or man-in-the-mobile attacks.

Man-in-the-Middle (MitM)

• MitM attacks involve a cybercriminal taking control of a device without user knowledge to intercept and capture user information.
• Often used to steal financial information.

Man-in-the-Mobile (MitMo)

• A variation of MitM, targeting mobile devices to exfiltrate user-sensitive information.
• Ex: ZeuS malware captures two-step verification SMS messages.

SEO Poisoning

• Techniques to improve a website's visibility in search engine results.
• Attackers use SEO to promote malicious sites, called SEO poisoning.
• Goal of SEO poisoning to increase traffic to sites hosting malware or attempting social engineering.

Password Spraying

• Attacker tries common passwords across many accounts to avoid lockouts.

Dictionary Attacks

• Hacker systematically tries words from a dictionary as passwords.

Brute-Force Attacks

• Tries all possible character combinations.

Rainbow Table Attacks

• Uses precomputed hashes to crack passwords.
• Unlike brute-force, compares the hash of a password with those stored in the rainbow table.

Traffic Interception

• Intercepting unencrypted passwords in communications.

Advanced Persistent Threats (APTs)

• APTs are long-term, stealthy, multi-phase operations.
• Individual attackers usually lack resources to perform APTs.
• APTs are well-funded, targeting organizations or nations for business or political reasons, where the primary goal is to deploy customized malware and remain undetected.

Security Vulnerabilities and Exploits

• Security vulnerabilities : Software or hardware defects.
• Exploits : Programs written to take advantage of vulnerabilities.
• Attacks: Cybercriminals use exploits to carry out attacks to gain access to a system.

Hardware Vulnerabilities

• Hardware vulnerabilities often result from hardware design flaws.
• Rowhammer an exploit which triggers electrical interferences by repeatedly accessing a row of memory, corrupting RAM data.

Meltdown and Spectre

• Meltdown and Spectre are hardware vulnerabilities affecting CPUs released since 1995, allowing attackers to read all memory.
• Exploitations are side-channel attacks with capabilities to compromise large amounts of memory data.
• Traditional malware protection and physical security are sufficient protection for the everyday user.

Software Vulnerabilities

• Software vulnerabilities are usually introduced by errors in the operating system or application code.
• SYNful Knock vulnerability found in Cisco IOS allowed attackers to control enterprise-grade routers, through altered IOS versions.
• Integrity verification of downloaded IOS images, and limiting physical access to trusted personnel.

Buffer Overflow

• A vulnerability that occurs when data is written beyond the limits of a buffer. leads to a system crash, data compromise, or privilege escalation.

Non-Validated Input

• Incoming data with malicious content that causes a program to behave unexpectedly.

Race Conditions

• When the output of an event depends on ordered or timed outputs, which is used to create a vulnerability.

Weakness in Security Policies

• Using tested and verified coding algorithms for security is best practice, rather than creating your own which could introduce vulnerabilities.

Access Control Problems

• Access control is how you manage who accesses a system
• Many vulnerabilities are created by improper use of access controls.
• Physical access restrictions and data encryption help protect against compromised equipment.