- In this lesson 8.2, we're gonna look at malware attacks.
The malware is a portmanteau of malicious and software.
That's how we get malware.
The malware is used by hackers, by cybercriminals,
by hacktivists, by cyber-terrorists,
to either steal information, harm or disrupt operations,
extort, and or weaponize devices.
Now, malware is an extraordinarily powerful weapon.
It can be used as an entry point to a larger attack,
or a more sophisticated attack,
or in and of itself, it can be a stand-alone exploit.
And there are four primary malware families.
We have viruses, worms, Trojans, and rootkits.
A virus is malicious code
whose primary function is to replicate
and to deliver its payload.
Now a virus requires a host,
just like when you and I get sick and we have a virus,
the virus needs us, we're the host.
So a virus requires a host.
A worm is malicious code
that exploits known vulnerabilities.
Now a worm is self-replicating
and often takes advantage of network transport features
to spread.
I always just imagine like a little worm,
just slinking all around, right, moving from place to place.
A Trojan is malicious code that looks legitimate,
and it actually acts like a bonafide application.
Like maybe it's really a game, maybe it's a picture,
maybe it's a music file.
But simultaneously it's delivering or performing
a malicious action,
like maybe downloading a keylogger,
and then, you know, recording all of your keystrokes.
And lastly, rootkits.
rootkits are clandestine computer programs
designed to provide continued privilege access
to a computer,
while actively hiding its presence.
So you wanna make sure that you know the difference
between viruses, worms, Trojans, and rootkits.
Now, diving a little bit deeper into rootkits.
There's a number of different types of rootkits.
There's firmware rootkits,
there are rootkits known as bootkits.
There are kernel rootkits and driver rootkits.
Firmware rootkits overwrite the firmware or the BIOS,
so the rootkit can start before the operating system.
I wanna make a note
that really these firmware rootkits require a BIOS.
And if you now have a system that has a UEFI
in place of the BIOS, so really, a next-generation BIOS,
and you're running Windows Secure Boot,
then you are protected from these firmware rootkits.
A bootkit replaces the operating system's bootloader,
which is the piece of software
that starts the operating system,
so that the PC loads the bootkit
before the operating system.
Kernel rootkits replace a portion
of the operating system kernel
so the rootkit can start automatically
when the operating system loads.
Driver rootkits impersonates a trusted driver
that the operating system uses to communicate
with the hardware.
Again, also addressed by having UEFI and Driver Attestation.
So how does malware actually operate?
Well, there are four primary techniques.
Malware can be stealth, malware can be memory resident,
malware can be known as polymorphic,
or malware can be metamorphic.
The stealth malware is designed to be really inconspicuous.
It's stealth, it doesn't wanna be seen, right,
in order to avoid detection
by either concealing the file size
or moving to an alternate location.
Memory resident malware stays resident in memory
upon execution.
And dangerously, can affect other programs
that are running in memory, at the same time.
Polymorphic malware evades any pattern-matching detection,
which is really what most of our antivirus signatures do,
by frequently changing identifiable characteristics
like a file name, file type, or encryption keys.
And metamorphic malware is rewritten
with every single iteration,
so that each succeeding version of the code
is different from the proceeding one.
So just when we know what it is,
the next time it's used, it's different.
So every time, right, every iteration,
it looks a little bit different.
Stealth, memory resident, polymorphic and metamorphic.
So, how does the malware actually get on our systems?
Well, the malware distribution channel is designed
to entice our users
really, to unwittingly install malicious code.
Tactics include phishing emails
with embedded web links or attachments,
social media web links
that take you to a malware distribution site.
Web drive-by downloads;
by just going to a website that's infected,
you may get malware coming down.
Embedding the malware in pictures, movies or advertising.
We talked about that earlier, called malvertising.
Or, embedded in portable media like the USB,
and we talked about that.
And we talked about social media
and using like a USB for baiting.
There are four common malware attacks
I want you to be able to recognize.
A command and control attack, known C2,
an advanced persistent threat, APT,
a bot or zombie, and then ransomware.
Now, the objective of a C2 or command and control attack
is for the compromised system,
'cause the system's already been compromised,
to contact a command center,
which then gives the attacker complete control
over the infected device.
An APT or an advanced persistent threat
is a really sophisticated type of attack.
It's slow, it's stealthy, and it's a prolonged attack
on a specific target
with the intention to compromise the system
and or gain information from or about that target.
Now these truly are sophisticated, slow and stealthy attacks
with really a limited number of attackers
who can truly pull off an APT.
Generally, we're gonna see nation states or military
really be able to do an APT.
Bot and zombies, and those terms are interchangeable,
are just little pieces of code.
They're automated processes that either have instructions
embedded in them,
or they listen for instructions.
Now, if a bot or zombie is on your system,
it doesn't really care probably about your system too much.
It's waiting for instructions to launch an attack
on another system.
And bots and zombies are very often used
in distributed denial of service attacks.
And then lastly, we have the one that's in the news
almost every day, right now, which is ransomware.
Ransomware encrypts files and demands ransom
for the decryption key.
And in a later lesson we're gonna dissect ransomware
a little bit more,
but that's the one right now that's, you know,
really plaguing us and really dangerous and scary.
And then we have what I call code with bad intentions.
We have programmatic code
and that's code embedded in the application
by the developer.
Now, if it's a good developer, then we're fine,
but, you know, if the developer has some bad intentions,
well, they can develop code with bad intentions,
and they may have backdoors or logic bombs.
A backdoor is designed to bypass access controls.
So that means they can get back into their code,
bypassing access control,
generally getting back into the code as an administrator.
And logic bombs are instructions that execute
either when a certain event occurs or when a time occurs.
Then we have spyware.
Spyware is software with malicious behavior
that's really looking to gather information about a person
or an organization,
and then send it to another entity.
Now, it may be used just because they're trying to determine
what ads to show you,
or it could be something even more nefarious.
And then bloatware is unwanted
or potentially harmful software
that's preloaded onto new devices.
It's also known as potentially unwanted applications
or PUAs.
So you get a new device,
you know, and it's preloaded, it's there.
You don't really want it, but it's there.
So, let's talk a little bit more about bloatware.
The problem with bloatware, it seems pretty innocuous,
right,
it's just installed by the manufacturer,
is that it can deplete both memory and processor resources.
And so there are a variety of bloatware out there.
They each have their own warning signs.
The program wants you to make a purchase.
A program is hard to uninstall, the program is useless,
or the program bombards the users with popups.
Those are all warning signs that you have bloatware
on your system
that could easily be depleting memory
and processor resources.
So you wanna do whatever you can to get that bloatware
off your system.
All right, my friends,
that brings us to a three-second challenge.
Five challenge questions, three seconds each.
Let's do it.
Malicious code that exploits known vulnerabilities
and is self-replicating.
One, two, three.
That's gonna be a worm.
Number two.
Malware that evades pattern-matching detection
by frequently changing identifiable characteristics.
This is gonna be one of the morphics.
Ready? One, two, three.
That's gonna be polymorphic.
Common extortion malware.
Everybody's gonna get this one right, I'm sure.
One, two, three.
And that is ransomware.
Number four.
Automated processes that either have instructions embedded
or listen for instructions.
One, two, three.
That's gonna be a bot, also known as a zombie.
And lastly, number five.
Also known as potentially unwanted applications or PUAs.
One, two, three.
And that's bloatware.
Right. That takes us to security-in-action,
so you can practically apply your knowledge.
This one's about an extortion demand,
but it may not be what you think.
Your organization receives an extortion threat
demanding a $500,000 payment in Bitcoin.
If the money is not received,
your custom e-commerce platform will cease to operate
and the same fate will befall all of your backup copies.
Now, the investigative team can't find any evidence
or indication of a malware infection,
and there doesn't seem to be any unusual connections
or activities.
Wow, this is kind of a mystery.
So my question to you is, well, what do you suspect and why?
So let's go through that again.
Your organization receives this extortion threat
demanding $500,000 in payment, half a million dollars.
But it looks like everything's okay on your system.
There doesn't seem to be any malware,
there doesn't seem to be any unusual connections,
but they're saying if you don't pay,
your custom e-commerce application or platform
is gonna just stop operating.
And the same fate is gonna befall all of your backup copies.
So put me on pause,
think about what your hypothesis is, and then come on back.
So this one's really kind of a mystery.
Let's talk through our hypothesis.
Based on the following,
one, there's no indication of any installed malware.
We're don't seeing infected files.
It's not ransomware, right?
And we're not seeing any unusual activity.
And the e-commerce platform, though, has been customized.
Hmm. That might set off some alarm bells.
We've had some programmers involved
in the e-commerce platform.
And the fact that the claim that the backup copies
are gonna be similarly impacted, that's interesting.
So our e-commerce platform is gonna cease to operate,
and if we install any backup copies of the platform,
that's not gonna operate either.
Hmm. What do you think?
Well, I think a hypothesis worth investigating
is the insertion of a logic bomb
that's programmed to execute when a certain event occurs,
or at a certain time.
Which is why it's going to affect both the current platform
and your backup copies.
And it's why we're not seeing any unusual activity,
because that logic bomb was installed programmatically
when that code was developed,
and it will either go off at a certain time,
or when a certain event occurs.
What do you think about that hypothesis?
Probably not the one you were expecting
when you saw an extortion demand.
But you know, we have to really be always ready
to think outside the box
because, you know, our adversaries and attackers
are pretty clever.
And that, my friends, is security-in-action.
There's your word cloud, it's a pretty big one.
Make sure that you can go through all of these,
you can identify them, you're comfortable,
you're confident with the terms.
If not, go back through the lesson.
You'll find them right there.
And when you're ready, head to the next lesson.
I'll be waiting for you.