All About Malwares , Worms , Trojans , Bombs , Spywares and viruses

All About Malwares , Worms , Trojans , Bombs , Spywares and viruses

Introduction

“Malware” are programs or parts of programs that have a malicious ( “Mal” ) or unpleasant

effect on your computer security. This covers many different terms that you may have heard

before, such as “Virus”, “Worm” and “Trojan” and possibly a few that you haven't like

“Rootkit”, “Logicbomb” and “Spyware”. This lesson will introduce, define and explain each of

these subdivisions of malware, will give you examples, and will explain some of the

countermeasures that can be put into place to restrict the problems caused by malware.

Viruses (Virii)

Virus – 

This is the most common type of malware that people will be aware of. The reason that

it is known as a virus, rather than anything else, is historical. The press ran the stories of the first

computer virus at the same time as articles concerning the spread of AIDS. At the time, there

were simple parallels that could be easily drawn between the two, propagation through

interaction with a contaminated party, the reliance on a host and the ultimate “death” of

anything infected. This resulted, and still does occasionally, in concerns that people could

become “infected” with a computer virus.

Viruses or virii are self-replicating pieces of software that, similar to a biological virus, attach

themselves to another program, or, in the case of “macro viruses”, to another file. The virus is

only run when the program or the file is run or opened. It is this which differentiates viruses from

worms. If the program or file is not accessed in any way, then the virus will not run and will not

copy itself further.

There are a number of types of viruses, although, significantly, the most common form today is

the macro virus, and others, such as the boot sector virus are now only found “in captivity”.

Boot Sector Viruses

The boot sector virus was the first type of virus created. It hides itself in the executable

code at the beginning of bootable disks. This meant that in order to infect a machine, you

needed to boot from an infected floppy disk. A long time ago, ( 15 years or so ) booting

from floppy was a relatively regular occurrence, meaning that such viruses were actually

quite well spread by the time that people figured out what was happening. This virus ( and

all other types ) should leave a signature which subsequent infection attempts detect, so

as not to repeatedly infect the same target. It is this signature that allows other software

( such as Anti-Virus-software ) to detect the infection.

The Executable File Virus

The Executable File virus attaches itself to files, such as .exe or .com files. Some viruses

would specifically look for programs which were a part of the operating system, and thus

were most likely to be run each time the computer was turned on, increasing their

chances of successful propagation. There were a few ways of adding a virus to an executable file, some of which worked better than others. The simplest way ( and the least

subtle ) was to overwrite the first part of the executable file with the virus code. This meant

that the virus executed, but that the program would subsequently crash, leaving it quite

obvious that there was an infection – especially if the file was an important system file.

The Terminate and Stay Resident (TSR) Virus

TSR is a term from DOS where an application would load itself into memory, and then

remain there in the background, allowing the computer to run as normal in the

foreground. The more complex of these viruses would intercept system calls that would

expose them and return false results - others would attach themselves to the 'dir'

command, and then infect every application in the directory that was listed – a few even

stopped ( or deleted ) Anti-Virus software installed onto the systems.

 The Polymorphic Virus

Early viruses were easy enough to detect. They had a certain signature to identify them,

either within themselves as a method to prevent re-infection, or simply that they had a

specific structure which it was possible to detect. Then along came the polymorphic virus.

Poly – meaning multiple and morphic – meaning shape. These viruses change themselves

each time they replicate, rearranging their code, changing encryption and generally

making themselves look totally different. This created a huge problem, as instantly there

were much smaller signatures that remained the same – some of the “better” viruses were

reduced to a detection signature of a few bytes. The problem was increased with the

release of a number of polymorphic kits into the virus writing community which allowed

any virus to be recreated as a polymorph.

 The Macro Virus

The Macro Virus makes use of the built-in ability of a number of programs to execute

code. Programs such as Word and Excel have limited, but very powerful, versions of the

Visual Basic programming language. This allows for the automation of repetitive tasks, and

the automatic configuration of specific settings. These macro languages are misused to

attach viral code to documents which will automatically copy itself on to other

documents, and propagate. Although Microsoft has turned off the feature by default now

on new installations, it used to be that Outlook would automatically execute certain code

attached to e-mails as soon as they were read. This meant that viruses were propagating

very quickly by sending themselves to all of the e-mail addresses that were stored on the

infected machine.

Worms

Worms are older than viruses. The first worm was created many years before the first virus.

This worm made use of a flaw in the UNIX finger command to quickly bring down most of

the Internet (which was much smaller at that time). This following section deals with

worms.

A worm is a program that, after it has been started, replicates without any need for

human intervention. It will propagate from host to host, taking advantage of an

unprotected service or services. It will traverse a network without the need for a user to

send an infected file or e-mail. Most of the large incidents in the press recently have been

worms rather than viruses.

Trojans

The first Trojan Horse was created by the Greeks several thousand years ago. ( Think about the

film “Troy” if you have seen it ). The basic concept is that you sneak something nasty into an

otherwise secure computer in the guise of something nicer. This can range from a

downloaded game trailer to an e-mail promising naked pictures of your favorite celebrity. This

section covers trojans and spyware.

Trojans are pieces of malware which masquerade as something either useful or

desirable in order to get you to run them. At this point they may well do something unpleasant

to your computer such as install a backdoor or rootkit (see section 6.4), or - even worse - dial a

premium rate phone number that will cost you money.

Spyware

Spyware is software that installs itself surreptitiously, often from websites that you might

visit. Once it is installed it will look for information that it considers valuable. This may be usage statistics regarding your web surfing, or it might be your credit card number. Some pieces of

spyware blow their cover by rather irritatingly popping up advertisements all over your

desktop.

Rootkits and Backdoors

Often when a computer has been compromised by a hacker, they will attempt to

install a method to retain easy access to the machine. There are many variations on this,

some of which have become quite famous – have a look on the Internet for “Back Orifice” !

Rootkits and backdoors are pieces of malware that create methods to retain access

to a machine. They could range from the simple ( a program listening on a port ) to the very

complex ( programs which will hide processes in memory, modify log files, and listen to a

port ). Often a backdoor will be as simple as creating an additional user in a password file

which has super-user privileges, in the hope that it will be overlooked. This is because a

backdoor is designed to bypass the system's normal authentication. Both the Sobig and

MyDoom viruses install back doors as part of their payload.

Logicbombs and Timebombs

Systems programmers and administrators can be quite odd people. It has been known

for there to be measures on a system that will activate should certain criteria be met. For

example: a program could be created that, should the administrator fail to log in for more

than three weeks, would start to delete random bits of data from the disks. This occurred in a

well-known case involving a programmer at a company called General Dynamics in 1992.

He created a logicbomb which would delete critical data and which was set to be activated

after he was gone. He expected that the company would then pay him significant amounts

to come back and fix the problem. However, another programmer found the logic bomb

before it went off, and the malicious programmer was convicted of a crime and fined $5,000 US dollars. The judge was merciful – the charges the man faced in court carried fines of up to

$500,000 US dollars, plus jail time.

Logicbombs and Timebombs are programs which have no replication ability and no

ability to create an access method, but are applications or parts of applications that will

cause damage to data should they become active. They can be stand-alone, or part of

worms or viruses. Timebombs are programmed to release their payload at a certain time.

Logicbombs are programmed to release their payload when a certain event occurs.

The idea behind timebombs, however, is also a useful one. Timebomb programming is

used to allow you to download and try a program for a period of time – usually 30 days. At

the end of the trial period, the program ceases to function, unless a registration code is

provided. 

Plz comment in our post if you like it and dont forget to subscribe to it to get latest updates and replies