Virus and Malware

Malware or Preserve Software and Malicious Activities

• • Perverse Software is also known as Malicious software or Malware programs.
  • Malware is short for malicious software.
  • Malware programs are also known as Attacking elements.
  • Perverse software is a program that causes hindrances/disturbances in other programs’ execution in such a way resulting in modification or complete or partial destruction of data without the user’s intention or confirmation or even sabotaging the operational system.
  • Malware refers to any software designed to harm or exploit devices, services, or networks.
  • Malicious software is designed to damage, disrupt, harm, or gain unauthorized access to a computer system or network, etc.,
  • Malware is the name given to any type of software that could harm a computer system, interfere with and gather a user’s data, or make the computer perform actions without the owner’s knowledge or permission.
  • Malware programs mainly attack data and harm information security threat that involves an attempt to obtain, alter, destroy, remove, implant, or reveal information either completely or partially without authorized access or permission. It happens to both individuals and organizations. 
  • It is a type of software that is designed to secretly access a computer system, without the owner‘s consent, and finally damage the system fully or partially. The impact can be as damaging as shutting down a business, pulling down a computer network, or significantly impacting the regular use of individual computer systems, etc. The damage done can vary from something as little as changing the author’s name in a document to full control of one‘s machine without the ability to easily find out.
  • Most malware requires the user to initiate its operation. For example, sending infectious attachments (it acts when users download them and run the attachment) in e-mails, browsing a malicious website that installs software after the user clicks ok on a pop-up, and from vulnerabilities in the operating system.
  • Early infectious programs, such as Internet Worm and MS-DOS viruses, were written as experiments and were largely harmless or at most annoying.
  • With the spread of broadband Internet access, malicious software has been designed for profit, for forced advertising.
  • Here the malware keeps track of the user‘s web browsing and pushes related advertisements.
  • A wide range of antivirus software, firewalls, and other strategies are used to help protect against the introduction of malware, to help detect it if it is already present, and to recover from malware-associated malicious activity and attacks.

Types of Malware/Malicious Software

• There are several typical types of malicious software. These are – Computer viruses, Computer worms, Trojan horses, Rootkits, Spyware, ransomware etc.

(a) Computer Virus

• • A computer virus is a small software program that is designed to enter a computer without users‘ permission or knowledge, to interfere with computer operation, and to spread from one computer to another.
  • A computer virus needs to attach itself to a document or program to infect other computers or programs.
  • Some viruses do little but replicate while others can cause severe harm or adversely affect the program and performance of the system.
  • They can destroy files, software, and program applications, and cause the loss of data.
  • There are various types of computer virus that can be classified by their origins, techniques of attack, modes of spreading, forms of infections, hiding locations, and the kind of damage caused.
  • Examples of computer viruses are Randex and Melissa. A and Trj.Reboot Computer

(b) Worm

• • The worm is a program that is very similar to a virus. It can self-replicate.
  • It actively spreads itself over the network, copies itself from one disk drive to another, or copies using email.
  • It does not need user action to start it, unlike a virus.
  • Unlike a virus, a worm is a standalone piece of malicious software that replicates itself to spread to other computers.
  • It often uses a computer network to spread itself, relying on security flaws in the target system to allow access.
  • Examples of worms include PSWBugbear.B, Lovgate. F, Trile. C, Sobig.D, and Mapson.

(C) Trojan Horse/Trojan

• • Trojan Horse is a program that is disguised as something interesting and desirable, users are tempted to download and install it on their machine, without knowing what it does. This is when it does the damage by deleting files from the system or by further installing unwanted software. This is the typical technique of working of Trojan horse.
  • Trojan Horses, unlike viruses, do not reproduce themselves by infecting other files, nor do they self-replicate like worms, but they are extremely dangerous to the user’s computer’s security and personal privacy.
  • They make a computer susceptible to malicious intruders by allowing them to access and read files.
  • It is a type of malware that uses malicious code to install software that seems ok but is hidden and creates back doors into a system typically causing loss or theft of data from an external source.

(d) Rootkits

• • It is a set of software tools that enable attackers to gain administrator-level control over a device without being detected.
  • This is a technique using which the malware remains concealed in the system and continues to do the damage in a concealed manner.
  • Rootkits can prevent a malicious process from being visible (ex Task Bar in the Windows operating system) in the list of running applications.
  • Rootkits normally attempt to allow someone to gain control of a computer system.
  • These programs are usually installed by Trojans and are generally disguised as operating system files.

(e) Trap doors

• • This is a way of bypassing normal authentication procedures (windows/ operating system username and password) to access a system.
  • Once a system is compromised (impacted by) by malware, one or more backdoors may be installed for easier future access to the system.

(f) Logic/Time Bombs

• • Logic Bombs are not programs in their own right but rather camouflaged segments of other programs.
  • They are not considered viruses because they do not replicate. However, their objective is to destroy data on the computer once certain conditions have been met.
  • Logic bombs go undetected until launched, and the results can be destructive.
  • For example, some malicious programs are shut off during days such as April Fools Day or Friday the 13th.

(g) Keystroke Loggers/Keyloggers

• • A type of malware that records every keystroke made on a device to capture sensitive information like passwords.
  • This is a program, once installed on the system, which intercepts the keys when entering the password or the Credit Card number while shopping online.
  • This can be used for Credit Card fraud.

(h) Spywares

• • Spyware is a special type of malware software that aids in gathering information about a person or organization without their knowledge, they can monitor and log the activity performed on a target system, like log keystrokes, or gather credit card and other information.
  • Spyware is a special type of malware software that secretly monitors and collects user data without permission, often for advertising or identity theft.

(i) Adware

• • It is a type of malware that automatically displays or downloads unwanted advertisements, typically for revenue generation.
  • Adware is also considered malware software which can automatically cause pop-up and banner adverts to be displayed to generate revenue for its author or publisher.
  • A lot of freeware will use Adware but not always in a malicious way, if it was malicious, it would then be classed as spyware or malware.

(j) Ransomware

• • Ransomware is a type of malware that encrypts files on a user’s device and demands a ransom payment to unlock them.
  • Malware that encrypts a user’s data on a victim’s computer and demands payment in exchange for the decryption key or to restore access.
  • Ransomware is a type of malware from a crypto virology branch that threatens the owner to publish the victim’s data or perpetually block access to it unless a ransom amount is paid.
  • Some simple ransomware may lock the system so that it is not difficult for a knowledgeable person to reverse it.
  • It encrypts the victim’s files, making them inaccessible, and demands a ransom payment to decrypt them.

(k) Rogue Software

• • Rogue security software is a form of malicious software and internet fraud that misleads users into believing there is a virus on their computer and aims to convince them to pay for a fake malware removal tool that installs malware on their computer.
  • It is a form of scareware that manipulates users through fear and a form of ransomware.
  • Rogue security software has been a serious security threat in desktop computing since 2008.

(l) Wiper

• • A wiper is a class of malware whose intention is to wipe the hard drive of the computer it infects.

(m) Scareware

• • Scareware is a form of malware that uses social engineering to cause shock, anxiety, or the perception of a threat to manipulate users into buying unwanted software.

(n) Botnet

• • A botnet is a network of infected devices (bots) that are controlled remotely by attackers to perform malicious activities, such as launching Distributed Denial of Service (DDoS) attacks.

(o) Zero-Day Exploit

• • it is a vulnerability situation in software that is unknown to the vendor and is exploited by attackers before it’s patched or fixed.

(p) DDoS Attack (Distributed Denial of Service)

• • It is a type of cyber attacks that aim to disrupt the normal functioning of a targeted server, service, or network. They achieve this by overwhelming the target with excessive requests or traffic, rendering it unable to handle legitimate requests from users.
  • A DDoS attack is an extension of a DoS attack but is carried out by multiple sources, often thousands of devices (bots) controlled by the attacker in a botnet.
  • In a DDoS attack, a botnet—usually a network of infected devices spread across the globe—simultaneously bombards the target with a flood of requests or traffic. This makes it harder to stop, as the requests come from many different IP addresses, making it challenging to identify and block all sources.
  • A botnet consisting of thousands of compromised computers worldwide attacks an online service, overwhelming it with traffic from multiple sources, and taking it offline.
  • It is an attack that overwhelms a server or network by flooding it with unnecessary traffic from multiple sources, causing it to slow down or crash.

(q) Patch

• • A form of software update or fix that repairs security vulnerabilities or bugs to improve system security and performance.

(r) Brute Force Attack

• • It is a method of hacking where an attacker tries every possible combination of passwords or keys to gain access to a system.

(s) Data-Stealing

• • This is a web threat that results in the stealing of personal and proprietary information to be used for commercial gains either directly or via underground distribution.
  • Some popular examples of recent data-stealing cases are – stealing and selling large numbers of credit card numbers from businesses such as TJX, OfficeMax, Sports Authority, etc.

(t) Penetration Testing

• • An authorized attempt to simulate a cyber attack on a system to identify vulnerabilities and improve security.

(u) Social Engineering

• • Manipulating people into giving up confidential information by exploiting trust, often through phishing, pretexting, or baiting.

(v) Phishing

• • A cyber attack that uses deceptive emails, messages, or websites to trick users into revealing sensitive information, such as passwords or credit card numbers.
  • It is a fraudulent attempt to obtain sensitive information, such as passwords or credit card numbers, by posing as a trustworthy entity in an email, website, or other electronic communication.

(w) Social Media Hijacking

• • The act of taking over someone’s social media account by gaining unauthorized access, often for malicious purposes.

(x) Threat Actor

• • Any individual or group involved in activities that pose a threat to cybersecurity, including hackers, cybercriminals, and nation-states.

(y) Deepfake

• • AI-generated fake media, such as videos or images, is created by manipulating existing media to show events or actions that didn’t happen.

(z) Hacking 

• • It is unauthorized access to computer systems or networks to steal or manipulate data.

(a1) Identity Theft 

• • Stealing personal information, such as name, bank account details, and social security numbers, to commit fraud or other crimes.

(b1) Cyberstalking 

• • Harassing or threatening behavior online, such as sending unwanted messages or posting harmful content.

(c1) Cyberbullying

• • The use of technology to harass, intimidate, or humiliate another person.

(d1) Online Fraud/Scams

• • Any type of fraud or deception is carried out by using the internet, including fake online shopping sites, fraudulent investment schemes, and fake job postings.

(e1) Denial-of-service (DoS) attacks 

• • It is a type of cyber attacks that aim to disrupt the normal functioning of a targeted system/server, service, or network. They achieve this by overwhelming the target with excessive requests or traffic, rendering it unable to handle legitimate requests from users.
  • A DoS attack involves a single source (often one computer or network) flooding a target system with a high volume of requests, with the goal of making it unavailable to legitimate/real users.
  • In this, the attacker sends a large number of fake requests to the target to consume its resources, such as CPU, memory, or bandwidth, causing it to slow down, crash, or become unresponsive.
  • Here, an attacker flooding a website’s server with excessive HTTP requests, causing the website to become unavailable to regular visitors.

(f1) Cyber Espionage

• • Stealing confidential information, such as trade secrets or intellectual property, from individuals or organizations.

(g1) Child exploitation

• • Using the internet to exploit children for sexual purposes, such as producing, distributing, or accessing child pornography.

(h1) Cyberterrorism

• • Using the internet or other electronic means to intimidate (threaten somebody) or coerce (to force somebody to do something)governments or societies.

Prevention from Malicious Software

• • Block unwanted email viruses by installing a spam filter and spam blocker.
  • When browsing the internet, always watch what one clicks and installs.
  • Do not simply click OK to dismiss pop-up windows. Install anti-virus software; scan and update regularly. It can, in most cases, remove and prevent viruses, worms, trojans, and (depending on the software) some spyware.
  • Install anti-spyware/anti-adware; scan and update regularly. It will remove and (depending on the software) prevent future adware and spyware.