Understanding Virus Infection and Spread

A type of malware that relies on being executed (directly or indirectly) to spread. Unlike worms, viruses need a host program or user interaction to propagate.

Viruses that infect Microsoft Office files, often spreading via email attachments or shared drives. These viruses can spread when users unknowingly open infected files.

Viruses that infect executable files (e.g., .exe files). They spread when users run infected programs.

Viruses that take advantage of vulnerabilities in PDF readers. These viruses are often used in phishing campaigns, tricking users into opening malicious files.

As traditional executables became more secure, attackers shifted their focus to data file infection (e.g., macros, PDFs) and exploiting user behavior (e.g., tricking users into opening malicious files).

A type of malware that can spread from one computer to another without needing a host program. Unlike viruses, worms are self-sufficient.

Worms can replicate themselves and spread through a network without human interaction. They can exploit vulnerabilities to access other systems.

Worms often aim to steal data, disable systems, or launch denial-of-service attacks. They can cause significant damage to networks and computers.

A type of malware that targets the earliest stage of a computer's startup, the boot process. They gain control over the system before the operating system even loads.

The small program responsible for loading the operating system when a computer turns on.

Bootkits modify the bootloader, hijacking control of the computer before the operating system fully loads. They can then inject malware and remain hidden, making them very dangerous.

They execute at the very beginning of the boot process, before the operating system loads, making detection and removal extremely difficult, and they evade most security mechanisms.

The Master Boot Record (MBR) is a small section of the hard drive that stores the boot information, including the bootloader and partition information.

Bootkits often overwrite this section to insert their own malicious code. This allows them to control the boot process and inject harmful software into the system.

Once the MBR is compromised, the bootkit takes control and can load its malicious code into the computer's memory when it starts up. They can also inject harmful programs into the operating system when it begins to run.

They are extremely hard to detect and remove. Bootkits often use stealth techniques and evade traditional antivirus software. They give attackers a level of control that can be difficult to reverse.

Rootkits are malicious software designed to hide their presence and give attackers persistent access to a system. They are often bundled with seemingly legitimate software and installed without the user's knowledge.

Kernel-mode rootkits operate within the operating system's core, making them almost invisible to standard security tools because they have deep access to the system.

Cybercriminals use rootkits to steal sensitive information, like passwords and financial data. They can also control systems for malicious purposes, such as launching attacks or distributing other malware.

Rootkits can be deployed to target specific individuals or organizations, enabling attackers to spy on them, steal data, or maintain long-term access to their systems.

Some governments utilize rootkits for covert surveillance, such as monitoring encrypted communications or tracking individuals' online activities.

Rootkits can modify system calls, hide files and processes, and interfere with security software, making traditional methods of detection ineffective.

Keep your operating system and software up-to-date to patch vulnerabilities that rootkits exploit.

Avoid downloading software from untrusted sources and clicking on suspicious links, as these are common ways for rootkit infections to occur.

A system where apps need explicit permission from the user to access sensitive resources like location or contacts. This prevents unauthorized access to personal data.

A security mechanism that isolates apps from each other and the operating system, restricting access to system resources and user data.

Sandboxing is not just for third-party apps, it also applies to system apps, creating a consistent security model across the entire system.

The operating system enforces sandboxing rules, preventing unauthorized access to sensitive data and system resources.

Sandboxing enhances security by preventing malicious apps from accessing sensitive data or taking control of the system, limiting the impact of exploits.

By isolating apps, sandboxing prevents interference between apps or with the operating system, improving overall stability.

Sandboxing protects privacy by ensuring apps can only access data they are explicitly permitted to, reducing the risk of unauthorized data collection.

Each Android app runs as a separate user, and SELinux policies control access, preventing apps like photo editors from accessing sensitive data like SMS messages.

The most privileged execution mode where code has complete access to all system resources, including hardware and critical data. It's essential for operating system functions.

A special mode that restricts code to limited privileges, preventing direct access to hardware and crucial system data. Applications running in this mode can only interact with the operating system through system calls or APIs.

A code execution mode where code has full control over system resources, including hardware and critical data. This mode is essential for running operating system components.

Code executed in this mode has restricted access to system resources and can only interact with the operating system through system calls or APIs. This ensures that errors in user mode applications do not affect the whole system.

Kernel mode enables programs to directly access hardware and critical data, allowing them to manage low-level tasks like memory allocation and device drivers.

User mode limits access to system resources and makes applications communicate with the operating system through system calls or APIs. This ensures that applications cannot accidentally damage the operating system.

In user mode, applications are isolated from each other and the kernel, which means that a crash in one application won't affect other applications or the entire system. This enhances the system's stability.

Errors in kernel mode can lead to system instability or crashes as there are no restrictions on access. This makes kernel mode sensitive to errors.

Bootkits run at the lowest level of the system, even before the operating system itself. This makes them extremely difficult to detect and remove by traditional antivirus software.

Unlike regular malware, bootkits don't need to be stored as files in your operating system. They can reside directly in the boot sector, making them invisible to standard antivirus tools.

Secure Boot is a security feature that verifies the integrity of the bootloader, ensuring that only authorized software can load during the boot process. This acts as a barrier against bootkits.

Kernel mode refers to the highest level of privilege in an operating system, where code has full access to system resources. User mode, on the other hand, is a restricted environment where code has limited privileges.

Bootkits are more dangerous than kernel-mode rootkits because they operate at a lower level, bypassing the operating system's defenses. They can manipulate core system functions before the OS even has a chance to load.

Antimalware software with boot sector scanning capabilities can detect and remove bootkits by analyzing the boot sector for malicious modifications.

A complete reinstallation of the operating system, including a fresh MBR, is often necessary to completely remove bootkits as they can leave behind malicious code in the boot sector even after a regular antivirus scan.