Malware, short for malicious software, is software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems. It can appear in the form of code, scripts, active content, and other software. 'Malware' is a general term used to refer to a variety of forms of hostile or intrusive software.
Malware includes computer viruses, ransomware, worms, trojan horses, rootkits, keyloggers, dialers, spyware, adware, malicious BHOs, rogue security software, and other malicious programs; the majority of active malware threats are usually worms or trojans rather than viruses. In law, malware is sometimes known as a computer contaminant, as in the legal codes of several U.S. states. Malware is different from defective software, which is a legitimate software but contains harmful bugs that were not corrected before release. However, some malware is disguised as genuine software, and may come from an official company website in the form of a useful or attractive program which has the harmful malware embedded in it along with additional tracking software that gathers marketing statistics.
Software such as anti-virus, anti-malware, and firewalls are relied upon by users at home, small and large organizations around the globe to safeguard against malware attacks which helps in identifying and preventing the further spread of malware in the network.
- 1 Purposes
- 2 Proliferation
- 3 Infectious malware: viruses and worms
- 4 Concealment: Viruses, trojan horses, rootkits, and backdoors
- 5 Vulnerability to malware
- 6 Anti-malware strategies
- 7 Grayware
- 8 History of viruses and worms
- 9 Academic research
- 10 See also
- 11 References
- 12 External links
Many early infectious programs, including the first Internet Worm, were written as experiments or pranks. Today, malware is used by both black hat hackers and governments alike primarily to steal sensitive information of personal, financial, or business importance.
Malware is sometimes used broadly against government or corporate websites to gather guarded information, or to disrupt their operation in general. However, malware is often used against individuals to gain personal information such as social security numbers, bank or credit card numbers, and so on. Left unguarded, personal and networked computers can be at considerable risk against these threats. (These are most frequently counter-acted by various types of firewalls, anti-virus software, and network hardware).
Since the rise of widespread broadband Internet access, malicious software has more frequently been designed for profit. Since 2003, the majority of widespread viruses and worms have been designed to take control of users' computers for black-market exploitation. Infected "zombie computers" are used to send email spam, to host contraband data such as child pornography, or to engage in distributed denial-of-service attacks as a form of extortion.
Another category of malware has emerged, called spyware. These programs are designed to monitor users' web browsing, display unsolicited advertisements, or redirect affiliate marketing revenues to the spyware creator. Spyware programs do not spread like viruses; instead they are generally installed by exploiting security holes. They can also be packaged together with user-installed software, such as peer-to-peer applications.
Preliminary results from Symantec published in 2008 suggested that "the release rate of malicious code and other unwanted programs may be exceeding that of legitimate software applications." According to F-Secure, "As much malware [was] produced in 2007 as in the previous 20 years altogether." Malware's most common pathway from criminals to users is through the Internet: primarily by e-mail and the World Wide Web.
The prevalence of malware as a vehicle for Internet crime, along with the challenge of anti-malware software to keep up with the continuous stream of new malware, has seen the adoption of a new mindset for individuals and businesses using the Internet. With the amount of malware currently being distributed, some percentage of computers will always be infected. For businesses, especially those that sell mainly over the Internet, this means they need to find a way to operate despite security concerns. The result is a greater emphasis on back-office protection designed to protect against advanced malware operating on customers' computers. A 2013 Webroot study shows that 64% of companies allow remote access to servers for 25% to 100% of their workforce and that companies with more than 25% of their employees accessing servers remotely have higher rates of malware threats.
On March 29, 2010, Symantec Corporation named Shaoxing, China, as the world's malware capital. A 2011 study from the University of California, Berkeley, and the Madrid Institute for Advanced Studies published an article in Software Development Technologies, examining how entrepreneurial hackers are helping enable the spread of malware by offering access to computers for a price. Microsoft reported in May 2011 that one in every 14 downloads from the Internet may now contain malware code. Social media, and Facebook in particular, are seeing a rise in the number of tactics used to spread malware to computers.
Recent studies show that malware evolution is tending towards a mobile nature due to the popularity of devices such as smartphones.
Infectious malware: viruses and worms
The best-known types of malware, viruses and worms, are known for the manner in which they spread, rather than any specific types of behavior. The term computer virus is used for a program that has infected some executable software and, when run, causes the virus to spread to other executables. On the other hand, a worm is a program that actively transmits itself over a network to infect other computers. These definitions lead to the observation that a virus requires user intervention to spread, whereas a worm spreads itself automatically.
Using this distinction, infections transmitted by email or Microsoft Word documents, which rely on the recipient opening a file or email to infect the system, would be classified as viruses rather than worms.
Concealment: Viruses, trojan horses, rootkits, and backdoors
For a malicious program to accomplish its goals, it must be able to run without being detected, shut down, or deleted. When a malicious program is disguised as something normal or desirable, users may willfully install it without realizing it. This is the technique of the Trojan horse or trojan. In broad terms, a Trojan horse is any program that invites the user to run it, concealing harmful or malicious code. The code may take effect immediately and can lead to many undesirable effects, such as deleting the user's files or installing additional harmful software.
One of the most common ways that spyware is distributed is as a Trojan horse, bundled with a piece of desirable software that the user downloads from the Internet. When the user installs the software, the spyware is installed along with it. Spyware authors who attempt to act in a legal fashion may include an end-user license agreement that states the behavior of the spyware in loose terms, which users may not read or understand.
Once a malicious program is installed on a system, it is essential that it stays concealed, to avoid detection. Software packages known as rootkits allow this concealment, by modifying the host's operating system so that the malware is hidden from the user. Rootkits can prevent a malicious process from being visible in the system's list of processes, or keep its files from being read.
Some malicious programs contain routines to defend against removal, not merely to hide themselves. An early example of this behavior is recorded in the Jargon File tale of a pair of programs infesting a Xerox CP-V time sharing system:
- Each ghost-job would detect the fact that the other had been killed, and would start a new copy of the recently-stopped program within a few milliseconds. The only way to kill both ghosts was to kill them simultaneously (very difficult) or to deliberately crash the system.
A backdoor is a method of bypassing normal authentication procedures. Once a system has been compromised, one or more backdoors may be installed in order to allow easier access in the future. Backdoors may also be installed prior to malicious software, to allow attackers entry.
The idea has often been suggested that computer manufacturers preinstall backdoors on their systems to provide technical support for customers, but this has never been reliably verified. Recently it came to light that government agencies have been preinstalling backdoors on private computers purchased online. Backdoors secure remote access to a computer, while attempting to remain hidden from casual inspection. To install backdoors crackers may use Trojan horses, worms, implants or other methods.
Vulnerability to malware
- In this context, as throughout, it should be borne in mind that the “system” under attack may be of various types, e.g. a single computer and operating system, a network or an application.
- Various factors make a system more vulnerable to malware:
Security defects in software
Malware exploits security defects (security bugs, or vulnerabilities) in the design of the operating system, in applications (such as browsers—avoid using Internet Explorer 8 or earlier, e.g. on Windows XP), or in (old versions of) browser plugins such as Adobe Flash Player, Adobe Acrobat / Reader, or Java (see Java SE critical security issues). Sometimes even installing new versions of such plugins does not automatically uninstall old versions. Security advisories from such companies announce security-related updates. Common vulnerabilities are assigned CVE IDs and listed in the US National Vulnerability Database. Secunia PSI is an example of software, free for personal use, that will check a PC for vulnerable out-of-date software, and attempt to update it.
Most systems contain bugs, or loopholes, which may be exploited by malware. A typical example is a buffer-overrun vulnerability, in which an interface designed to store data, in a small area of memory, allows the caller to supply more data than will fit. This extra data then overwrites the interface's own executable structure (past the end of the buffer and other data). In this manner, malware can force the system to execute malicious code, by replacing legitimate code with its own payload of instructions (or data values) copied into live memory, outside the buffer area.
Insecure design or user error
Over-privileged users and over-privileged code
- Over-privileged users: some systems allow all users to modify their internal structures. This was the standard operating procedure for early microcomputer and home computer systems, where there was no distinction between an Administrator or root, and a regular user of the system. In some systems, non-administrator users are over-privileged by design, in the sense that they are allowed to modify internal structures of the system. In some environments, users are over-privileged because they have been inappropriately granted administrator or equivalent status.
- Over-privileged code: some systems allow code executed by a user to access all rights of that user. Also standard operating procedure for early microcomputer and home computer systems. Malware, running as over-privileged code, can use this privilege to subvert the system. Almost all currently popular operating systems, and also many scripting applications allow code too many privileges, usually in the sense that when a user executes code, the system allows that code all rights of that user. This makes users vulnerable to malware in the form of e-mail attachments, which may or may not be disguised.
Use of the same operating system
- Homogeneity: e.g. when all computers in a network run the same operating system; upon exploiting one, one worm can exploit them all: For example, Microsoft Windows or Mac OS X have such a large share of the market that concentrating on either could enable an exploited vulnerability to subvert a large number of systems. Instead, introducing diversity, purely for the sake of robustness, could increase short-term costs for training and maintenance. However, having a few diverse nodes would deter total shutdown of the network, and allow those nodes to help with recovery of the infected nodes. Such separate, functional redundancy could avoid the cost of a total shutdown.
As malware attacks become more frequent, attention has begun to shift from viruses and spyware protection, to malware protection, and programs that have been specifically developed to combat malware. (Other preventive and recovery measures, such as backup and recovery methods, are mentioned in the computer virus article).
Anti-virus and anti-malware software
A specific component of the anti-virus and anti-malware software commonly referred as the on-access or real-time scanner, hooks deep into the operating system's core or kernel functions in a manner similar to how certain malware itself would attempt to operate, though with the user's informed permission for protecting the system. Any time the operating system accesses a file, the on-access scanner checks if the file is a 'legitimate' file or not. If the file is considered a malware by the scanner, the access operation will be stopped, the file will be dealt by the scanner in pre-defined way (how the Anti-virus program was configured during/post installation) and the user will be notified. This may considerably slow down the operating system depending on how well the scanner was programmed. The goal is to stop any operations the malware may attempt on the system before they occur, including activities which might exploit bugs or trigger unexpected operating system behavior.
Anti-malware programs can combat malware in two ways:
- They can provide real time protection against the installation of malware software on a computer. This type of malware protection works the same way as that of antivirus protection in that the anti-malware software scans all incoming network data for malware and blocks any threats it comes across.
- Anti-malware software programs can be used solely for detection and removal of malware software that has already been installed onto a computer. This type of anti-malware software scans the contents of the Windows registry, operating system files, and installed programs on a computer and will provide a list of any threats found, allowing the user to choose which files to delete or keep, or to compare this list to a list of known malware components, removing files that match.
Real-time protection from malware works identically to real-time antivirus protection: the software scans disk files at download time, and blocks the activity of components known to represent malware. In some cases, it may also intercept attempts to install start-up items or to modify browser settings. Because many malware components are installed as a result of browser exploits or user error, using security software (some of which are anti-malware, though many are not) to "sandbox" browsers (essentially isolate the browser from the computer and hence any malware induced change) can also be effective in helping to restrict any damage done.
Examples of Microsoft Windows anti virus and anti-malware software include the optional Microsoft Security Essentials (for Windows XP, Vista, Windows 7 and Windows 8) for real-time protection, the Windows Malicious Software Removal Tool (now included with Windows (Security) Updates on "Patch Tuesday", the second Tuesday of each month), and Windows Defender (an optional download in the case of Windows XP). Additionally, several capable antivirus software programs are available for free download from the Internet (usually restricted to non-commercial use). Tests found some free programs to be competitive with commercial ones. Microsoft's System File Checker can be used to check for and repair corrupted system files.
Some viruses disable System Restore and other important Windows tools such as Task Manager and Command Prompt. Many such viruses can be removed by rebooting the computer, entering Windows safe mode with networking, and then using system tools or Microsoft Safety Scanner.
Currently, no method is known for detecting hardware implants.
Typical malware products detect issues based on heuristics or signatures – i.e., based on information that can be assessed to be bad. Some products take an alternative approach when scanning documents such as Word and PDF, by regenerating a new, clean file, based on what is known to be good from schema definitions of the file (a patent for this approach exists).
Website security scans
As malware also harms the compromised websites (by breaking reputation, blacklisting in search engines, etc.), some websites offer vulnerability scanning. Such scans check the website, detect malware, may note outdated software, and may report known security issues.
Eliminating over-privileged code
Over-privileged code dates from the time when most programs were either delivered with a computer or written in-house, and repairing it would serve to render most antivirus software essentially redundant. It would, however, have appreciable consequences for the user interface and system management.
The system would have to maintain privilege profiles, and know which to apply for each user and program.
In the case of newly installed software, an administrator would need to set up default profiles for the new code.
Eliminating vulnerability to rogue device drivers is probably harder than for arbitrary rogue executable. Two techniques, used in VMS, that can help are memory mapping only the registers of the device in question and a system interface associating the driver with interrupts from the device.
Other approaches are:
- Various forms of virtualization, allowing the code unlimited access only to virtual resources
- Various forms of sandbox or jail
- The security functions of Java, in
Such approaches, however, if not fully integrated with the operating system, would reduplicate effort and not be universally applied, both of which would be detrimental to security.
Grayware is a general term that refers to applications or files that are not directly classified as malware (like worms or trojan horses), but can still negatively affect the performance of computers and involve significant security risks.
It describes applications that behave in an annoying or undesirable manner, and yet are less serious or troublesome than malware. Grayware encompasses spyware, adware, dialers, joke programs, remote access tools and any other program apart from a virus, that is designed to harm the performance of computers. The term is in use since around 2004.
Another term, PUP, which stands for Potentially Unwanted Program (or PUA Potentially Unwanted Application), refers to applications that would be considered unwanted despite having been downloaded by the user (users may fail to read a download agreement). PUPs include spyware, adware, and dialers.
History of viruses and worms
Before Internet access became widespread, viruses spread on personal computers by infecting the executable boot sectors of floppy disks. By inserting a copy of itself into the machine code instructions in these executables, a virus causes itself to be run whenever a program is run or the disk is booted. Early computer viruses were written for the Apple II and Macintosh, but they became more widespread with the dominance of the IBM PC and MS-DOS system. Executable-infecting viruses are dependent on users exchanging software or boot-able floppies and thumb drives so they spread rapidly in computer hobbyist circles.
The first worms, network-borne infectious programs, originated not on personal computers, but on multitasking Unix systems. The first well-known worm was the Internet Worm of 1988, which infected SunOS and VAX BSD systems. Unlike a virus, this worm did not insert itself into other programs. Instead, it exploited security holes (vulnerabilities) in network server programs and started itself running as a separate process. This same behavior is used by today's worms as well.
With the rise of the Microsoft Windows platform in the 1990s, and the flexible macros of its applications, it became possible to write infectious code in the macro language of Microsoft Word and similar programs. These macro viruses infect documents and templates rather than applications (executables), but rely on the fact that macros in a Word document are a form of executable code.
Today, worms are most commonly written for the Windows OS, although a few like Mare-D and the Lion worm are also written for Linux and Unix systems. Worms today work in the same basic way as 1988's Internet Worm: they scan the network and use vulnerable computers to replicate. Because they need no human intervention, worms can spread with incredible speed. The SQL Slammer infected thousands of computers in a few minutes.
The notion of a self-reproducing computer program can be traced back to initial theories about the operation of complex automata. John von Neumann showed that in theory a program could reproduce itself. This constituted a plausibility result in computability theory. Fred Cohen experimented with computer viruses and confirmed Neumann's postulate and investigated other properties of malware such as detectability, self-obfuscation using rudimentary encryption, and others. His Doctoral dissertation was on the subject of computer viruses.
|This article needs additional citations for verification. (July 2013)|
- "Malware definition". techterms.com. Retrieved 26 August 2013.
- "An Undirected Attack Against Critical Infrastructure" (PDF). United States Computer Emergency Readiness Team(Us-cert.gov). Retrieved 20 February 2013.[dead link]
- "Defining Malware: FAQ". technet.microsoft.com. Retrieved 10 September 2009.
- "Virus/Contaminant/Destructive Transmission Statutes by State". National Conference of State Legislatures. 2012-02-14. Retrieved 26 August 2013.
- "§18.2-152.4:1 Penalty for Computer Contamination" (PDF). Joint Commission on Technology and Science. Retrieved 17 September 2010.
- "Evolution of Malware-Malware Trends". Microsoft Security Intelligence Report-Featured Articles. Microsoft.com. Retrieved 28 April 2013.
- "Protect Your Computer from Malware". OnGuardOnline.gov. Retrieved 26 August 2013.
- Another way Microsoft is disrupting the malware ecosystem - Microsoft Malware Protection Center - Site Home - TechNet Blogs
- "Malware". FEDERAL TRADE COMMISSION- CONSUMER INFORMATION. Retrieved 27 March 2014.
- Hernandez, Pedro. "Microsoft Vows to Combat Government Cyber-Spying". eWeek. Retrieved 15 December 2013.
- Kovacs, Eduard. "MiniDuke Malware Used Against European Government Organizations". Softpedia. Retrieved 27 February 2013.
- "South Korea network attack 'a computer virus'". BBC. Retrieved 20 March 2013.
- "Malware Revolution: A Change in Target". March 2007.
- "Child Porn: Malware's Ultimate Evil". November 2009.
- PC World - Zombie PCs: Silent, Growing Threat.
- "Peer To Peer Information". NORTH CAROLINA STATE UNIVERSITY. Retrieved 25 March 2011.
- Symantec Internet Security Threat Report: Trends for July–December 2007 (Executive Summary) (PDF) XIII. Symantec Corp. April 2008. p. 29. Retrieved 11 May 2008.
- "F-Secure Reports Amount of Malware Grew by 100% during 2007" (Press release). F-Secure Corporation. December 4, 2007. Retrieved 11 December 2007.
- "F-Secure Quarterly Security Wrap-up for the first quarter of 2008". F-Secure. March 31, 2008. Retrieved 25 April 2008.
- "Continuing Business with Malware Infected Customers". Gunter Ollmann. October 2008.
- "New Research Shows Remote Users Expose Companies to Cybercrime". Webroot. April 2013.
- "Symantec names Shaoxing, China as world's malware capital". Engadget. Retrieved 15 April 2010.
- Rooney, Ben (2011-05-23). "Malware Is Posing Increasing Danger". Wall Street Journal.
- Suarez-Tangil, Guillermo; Juan E. Tapiador, Pedro Peris-Lopez, Arturo Ribagorda (2014). "Evolution, Detection and Analysis of Malware in Smart Devices". IEEE Communications Surveys & Tutorials.
- "computer virus - Encyclopedia Britannica". Britannica.com. Retrieved 28 April 2013.
- McDowell, Mindi. "Understanding Hidden Threats: Rootkits and Botnets". US-CERT. Retrieved 6 February 2013.
- "Catb.org". Catb.org. Retrieved 15 April 2010.
- Vincentas (11 July 2013). "Malware in SpyWareLoop.com". Spyware Loop. Retrieved 28 July 2013.
- Staff, SPIEGEL. "Inside TAO: Documents Reveal Top NSA Hacking Unit". SPIEGEL. Retrieved 23 January 2014.
- Edwards, John. "Top Zombie, Trojan Horse and Bot Threats". IT Security. Retrieved 25 September 2007.
- Appelbaum, Jacob. "Shopping for Spy Gear:Catalog Advertises NSA Toolbox". SPIEGEL. Retrieved 29 December 2013.
- "Global Web Browser... Security Trends". Kaspersky lab. Nov 2012.[dead link]
- Rashid, Fahmida Y. (Nov 27, 2012). "Updated Browsers Still Vulnerable to Attack if Plugins Are Outdated". pcmag.com.
- Danchev, Dancho (Aug 18, 2011). "Kaspersky: 12 different vulnerabilities detected on every PC". pcmag.com.
- "Adobe Security bulletins and advisories". Adobe.com. Retrieved 19 January 2013.
- Rubenking, Neil J. "Secunia Personal Software Inspector 3.0 Review & Rating". PCMag.com. Retrieved 19 January 2013.
- "LNCS 3786 - Key Factors Influencing Worm Infection", U. Kanlayasiri, 2006, web (PDF): SL40-PDF.
- "Microsoft Security Essentials". Microsoft. Retrieved 21 June 2012.
- "Malicious Software Removal Tool". Microsoft. Retrieved 21 June 2012.
- "Windows Defender". Microsoft. Retrieved 21 June 2012.
- Rubenking, Neil J. (January 8, 2014). "The Best Free Antivirus for 2014". pcmag.com.
- "How do I remove a computer virus?". Microsoft. Retrieved 26 August 2013.
- "Microsoft Safety Scanner". Microsoft. Retrieved 26 August 2013.
- "Glasswall". Glasswall.
- "Nexor Merlin". Nexor.
- "RESISTING THE SPREAD OF UNWANTED CODE AND DATA". patentdocs.
- "An example of a website vulnerability scanner". Unmaskparasites.com. Retrieved 19 January 2013.
- "Redleg's File Viewer. Used to check a webpage for malicious redirects or malicious HTML coding". Aw-snap.info. Retrieved 19 January 2013.
- "Example Google.com Safe Browsing Diagnostic page". Google.com. Retrieved 19 January 2013.
- "Safe Browsing (Google Online Security Blog)". Retrieved 21 June 2012.
- Vincentas (11 July 2013). "Grayware in SpyWareLoop.com". Spyware Loop. Retrieved 28 July 2013.
- "Threat Encyclopedia - Generic Grayware". Trend Micro. Retrieved 27 November 2012.
- "Rating the best anti-malware solutions". Arstechnica. Retrieved 28 January 2014.
- Nick Farrell (20 February 2006). "Linux worm targets PHP flaw". The Register. Retrieved 19 May 2010.
- John Leyden (March 28, 2001). "Highly destructive Linux worm mutating". The Register. Retrieved 19 May 2010.
- "Aggressive net bug makes history". BBC News. February 3, 2003. Retrieved 19 May 2010.
- John von Neumann, "Theory of Self-Reproducing Automata", Part 1: Transcripts of lectures given at the University of Illinois, December 1949, Editor: A. W. Burks, University of Illinois, USA, 1966.
- Fred Cohen, "Computer Viruses", PhD Thesis, University of Southern California, ASP Press, 1988.
|Look up malware in Wiktionary, the free dictionary.|
- Malicious Software at DMOZ
- Home Computer Security - Carnegie Mellon Software Institute
- OnGuard Online.gov – How to Secure Your Computer
- Open Security Foundation Data Loss Database
- Internet Crime Complaint Center
- List of malware types
- APWG Unified Cybercrime Response and Education
- Video: Mark Russinovich – Advanced Malware Cleaning
- Video: TechED 2012: Mark Russinovich’s Malware Hunting with the Sysinternals Tools (Windows 8)
- The commercialization of malware distribution: Pay per install