Upload File

chapter 6 viruses and malicious code. introduction viruses are primarily spread over the internet...

  • Home
  • Documents
  • Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,
27
Chapter 6 Viruses and Malicious Code

Upload: ambrose-park

Post on 18-Dec-2015

222 views

Category:

Documents


0 download

Report

Tags:

TRANSCRIPT

Page 1: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Chapter 6

Viruses and Malicious Code

Page 2: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Introduction

• Viruses are primarily spread over the internet through a variety of mechanisms including:– e-mail, attachments, downloadable files, web

pages, newsgroups, peer-to-peer file transfers, instant messaging, digital pictures, and several other techniques and tactics

Page 3: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Federal Survey• 85% commercial users experienced some type

of security breach in the prior year.• An additional 35% of the responders claimed

over $375,000,000 million dollars in losses to hacker and viruses.

• An average virus outbreak took approximately 20 person-days or less to recover and cost the company between $10,000 (median) and $120,000 (average) in estimated direct costs.

Page 4: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Experts

• Most people who claim to speak with authority about computer viruses have little or no genuine expertise.

• Some virus experts describe it as “False Authority Syndrome” – the person feels competent to discuss viruses because of his job title, or because of his expertise in another computer field, or simply because he knows how to use a computer.

Page 5: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Introduction

• Legend: experts around the world believe the ILoveYou virus in May 2000 caused $2.7 billion, $4.7 billion, $6.7 billion, or $8.7 billion in damages.

• Fallout: the antivirus industry can cite yet another plausible-sounding estimate.

Page 6: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Viruses and Malicious Code• Viruses in the wild are those that are spreading

as a result of normal day-to-day operations on and between the computers of unsuspecting users.

• Two or more virus experts must report problems with the virus to be recognized as a virus in the wild.

• There are currently 303 viruses currently in the wild.

Page 7: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Viruses and Malicious Code• The virus is executed by some type of

payload trigger which causes the virus or malicious code to deliver its contents or execute its commands.

• The trigger can be something the user does:– opening an e-mail attachment or – downloading a file; – triggered by a date or condition on a computer; – it can self-execute based on code written into the

virus program.

Page 8: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Virus Construction Tools

• The development of virus construction tools by virus writers allows a larger number of less sophisticated computer users to write and create viruses.

• A virus construction set is a utility program intended for creating new computer viruses.

• Virus construction sets allow generating of source code of the viruses, object modules and/or infected files themselves.

Page 9: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Viruses and Malicious Code

• Another tool developed by virus writers known as a mutation engine allows viruses to change their code each time they infect a new machine.

• Known as a polymorphic virus or malicious code, these programs do not have any constant section of code.

Page 10: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Viruses and Malicious Code

• One area of interest is termed the TSR (terminate and stay resident) capability of the virus.

• This essentially means that the virus is able to leave itself in system memory, intercept some events, and in the process run infecting routines on files and sectors of the disk.

Page 11: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Viruses and Malicious Code• Another feature of the operating algorithm of a

virus is the use of stealth algorithms.• Stealth allows the virus to remain hidden on a

system and cover its tracks during and after the infection process.

• Another virus is the use of self encryption and polymorphism.

• Polymorphic viruses are exceedingly difficult to detect and they have no permanent signatures, none of their code fragments remain unchanged.

Page 12: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

History and Development

• Several things combined to aid the spread of viruses:– Rapid growth of the internet– Rapid growth and availability of personal

computers– Availability of the polymorphic engine– Availability of virus creation tools that first hit

in July of 1992

Page 13: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

History and Development

• The main problem with trying to give the exact definition of a virus is that virtually all the unique features of a virus – such as stealth behavior, potential danger, and potential for spread – may be found in other nonvirus programs.

• A second difficulty is that viruses are operating-system and software-system specific.

Page 14: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Viruses • Other types of malicious code include

worms, Trojan horses, adware or spyware, logic bombs, denial of service attacks, and blended threats.

• Viruses operate in four primary environments:– File viruses– Boot viruses– Macro viruses– Network viruses

Page 15: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Viruses

• File viruses use a particular operating system to propagate, and they can infect virtually any type of executable file.

• Boot viruses attack either the boot sector of the system, the master boot record, or change the system pointer to an active boot sector

Page 16: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Viruses

• Macro viruses are most commonly associated with common business software and infect documents, spreadsheets, databases, and presentation files. Macro viruses transfer themselves from one infected file to another within a given system and cross over to other systems.

• Network viruses attack the networks themselves or e-mail systems of the networks in order to spread themselves.

Page 17: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Worms

• The worm is a stand-alone piece of code; although it may need to use another program to spread, it does not change that program in any way.

• They penetrate the computer’s memory from a computer network, calculate network addresses of other computers and send their own copies to these addresses.

Page 18: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Worms

• A work is self-propagating malicious code program that does not necessarily require user intervention to spread.

• A worm self-propagates and infects systems in a very short period of time. The Code Red worm infected more than 250,000 systems in just nine hours on July 19, 2001.

Page 19: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Trojan Horses

• Is commonly an unauthorized program contained within a legitimate program that performs functions unknown (and probably unwanted) by the user.

• Just like the Trojan horse of history, there is a hidden purpose and program hidden within the desirable file.

Page 20: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Trojan Horses

• Trojan horses can be viruses or remote control programs that provide complete access to a victim’s computer

• If a certain type of Trojan horse is installed and initialized on a system, that computer is now completely open to anyone who knows to connect to it using the Trojan horse as a server.

• Trojans use auto-starting methods, so even when you shut down your computer they’re able to restart and give the attacker access.

Page 21: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Trojan Horses

• Several types of Trojan horses:– Remote Access Trojans

• The most common

– Password-Sending Trojans• Steal all of the cached passwords

– Keyloggers• Log the keystrokes of the victim

– Destructive• Destroy and delete files

Page 22: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Trojan Horses

– Denial of Service Attack Trojans• Start attacking the secondary victim

simultaneously, this will generate a great deal of traffic and access to the internet will be shut down

– Proxy/Wingate Trojans• Turn the victim’s computer into a proxy/wingate

server available to the whole world or to the attacker only

– Software Detection Killers• Kill ZoneAlarm, Norton Antivirus, and many other

popular anti-virus/firewall programs

Page 23: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Adware and Spyware• Programs that can be contained in e-mail

attachments, downloaded as part of another software program, or downloaded from a Web site.

• Adware is a type of program that is a pain to the user that manifests itself in several ways, including changes to the browser, redirecting startup pages on the internet browser, replacing the search function within the browser, and generating pop-up ads

Page 24: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Adware and Spyware

• Spyware typically takes advantage of the fact that many software users do not read the end user license agreement

• They would see legal disclaimers and permissions to share information and install the spyware

• There is now spyware killer software available.

Page 25: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Denial of Service Attacks

• A denial of service attack uses multiple systems to attack one or more victim systems or Web sits with the intent of denying service to legitimate users wishing to log on or utilize the attacked server.

Page 26: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Blended Threats

• Combine the characteristics of viruses, worms, Trojan horses, and malicious code with server and internet vulnerabilities to initiate, transmit, and spread an attack.

Page 27: Chapter 6 Viruses and Malicious Code. Introduction Viruses are primarily spread over the internet through a variety of mechanisms including: – e-mail,

Extent of Viruses and Malicious Code Attacks

• The number of known viruses surpassed 70,000 in January 2002.


Viruses and Related Threats. 2 Summary have considered: various malicious programs trapdoor, logic bomb, trojan horse, zombie viruses worms

Viruses and Worms By: Olga Bibas. Malicious Programs are perhaps the most sophisticated threats to computer systems. These threats can be divided into

Enhanced Topic-based Vector Space Model for …paginaspersonales.deusto.es/claorden/publications/2012/...of malicious software (e.g., computer viruses, Trojan horses, spyware and Internet

Week 6 COMMON TYPES OF MALICIOUS CODE. Objectives describe the operation of: Viruses Malware [last week] Spyware [last week] Adware [last week] Trojans

YOUNG PEOPLE, MUSIC & THE INTERNET · contained viruses or other malicious code.1 If your child downloads one of these malicious fi les, your PC could be used, among other things,

Stephen S. Yau 1CSE 465-591, Fall 2006 Viruses. Stephen S. Yau 2CSE 465-591, Fall 2006 Taxonomy of Malicious Programs Malicious programs Needs host programIndependent

Chapter 1 Viruses: Attack of the Malicious Programs

DEFENDING THE DIGITAL YOU: IDENTITY THEFTmedia.techtarget.com/searchSecurity/downloads/Alagna_Ch7.pdf · attack.” Viruses were an act of vandalism, like graffiti. Malicious code

Viruses and Related Threats · 3 Viruses and Related Threats Viruses Computer viruses have got a lot of publicity One of a family of malicious software Malicious software is software

UNITED STATES SECURITIES AND EXCHANGE COMMISSION … · 2019. 5. 1. · include sophisticated malware (viruses, worms, and other malicious software programs) and phishing emails that

Novel Reassortant Influenza A(H5N8) Viruses among ... · ducks, which are the poultry populations primarily affected by these viruses in South Korea. Materials and Methods Animals

malware: Malicious Code - Uic Computer Sciencesloan/CLASSES/privacy/Malware.pdf · Malicious code: Viruses • Most famous type of malicious code • Malware Program that seeks out

Lesson 10 – SECURING YOUR NETWORK Security devices Internal security External security Viruses and other malicious software OVERVIEW

Computer Security Seminar Lecture 2orrd/CompSecSeminar/2013/... · Malware Backdoors Defense Viruses Worms Trojan Rootkits Botnets Computer Viruses One of the eldest malicious threats

Lecture: Malicious Code CIS 3360 Ratan K. Guha. Malicious Code2 Overview and Reading Assignments Defining malicious logic Types Action by Viruses Reading

Florida Season: FLU REVIEW...2020/02/19  · Influenza, or flu, is a respiratory infection caused by a variety of influenza viruses. Most experts believe influenza viruses spread primarily

SplitScreen: Enabling Efficient, Distributed Malware Detectiondga/papers/splitscreen-nsdi2010.pdfThe amount of malicious software (malware)—viruses, worms, Trojan horses, and the

Firewall and IPS - cisco.com · • Detect Malicious Traffic on the Internal Networks—Monitoring and detecting worms, viruses, ... employee productivity loss and leakage of confidential

User’s Guide for Nokia N95 - nds1.webapps.microsoft.comnds1.webapps.microsoft.com/files/support/apac/phones/guides/Nokia_N95... · be exposed to viruses, malicious messages and

Tartarus: A honeypot based malware tracking and mitigation ... · malicious entities. Detection and defence from these malicious entities has primarily been the concern of Intrusion

Malware (MALicious softWARE) Malware Taxonomycs.wellesley.edu/~cs342/fall14/lectures/22_viruses_and_worms.pdfDepartment of Computer Science Wellesley College Viruses and Worms Thrursday,

Malware: Malicious Softwarecs.armstrong.edu/rasheed/ITEC2010/Slides7.pdf · Viruses, Worms, Trojans, Rootkits • Malware can be classified into several categories, depending on propagation

CS 356 – Lecture 8 Malicious CodeTypes of Malicious Software (Malware) propagation mechanisms include: • infection of existing content by viruses that is subsequently spread to

1 Chap 10 Virus. 2 Viruses and ”Malicious Programs ” Computer “Viruses” and related programs have the ability to replicate themselves on an ever increasing

ESET NOD32 Antivirus for Microsoft Exchangemedia.zones.com/images/pdf/eset_nod32_av_exchangeserver_ds.pdf · Since most viruses and malicious software come from email, protection

Complete Protection for All Devices from Internet Threats · • Advanced Threat Detection—Identifies and blocks viruses, spyware, ransomware, malicious links, and other Internet

Taxonomy of Malicious Programs Malicious Softwareabc/teaching/bbm... · 3.11.2016 3 9 How Viruses Work -1 a) An executable program b) With a virus at the front c) With the virus at

Malicious Software programs exploiting system vulnerabilities known as malicious software or malware program fragments that need a host program e.g. viruses,

Viruses, Malicious Code, & Other Nasty Stuff Presented by: Melissa Dark K-12 Outreach Coordinator CERIAS, Purdue University [email protected] 765.496.6762

Viruses. Malware versus Virus Viruses belong to a larger category of software known as Malware, which is short for “malicious software” Computer viruses

Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Proactive, Layered Protection Against Spam, Viruses, and ... · Proactive, Layered Protection Against Spam, Viruses, and Malicious Email SecurityPlus for MDaemon Messaging Server

Fall 2008CS 334: Computer SecuritySlide #1 Malicious Logic Trojan Horses Viruses Worms

4-1 Last time Malicious code: Malware Viruses Trojan horses Logic bombs Worms Other malicious code: web bugs

Overview · • Advanced Threat Detection – Identifies & blocks viruses, spyware, ransomware, malicious links, and more, on your laptops, tablets & smartphones. • Smart Home