Definition. Malware should not be confused with defective software, that is, software which has a legitimate purpose but contains harmful bugs.

Transcription

1 By Paul Clarke

2 Definition Malware is software designed to infiltrate or damage a computer system without the owner's informed consent. It is a portmanteau of the words malicious and software. The expression is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code. Many normal computer users are however still unfamiliar with the term, and most never use it. Instead, "computer virus" is incorrectly used in common parlance and even in the media to describe all kinds of malware, though not all malware are viruses. Software is considered malware based on the perceived intent of the creator rather than any particular features. Malware includes computer viruses, worms, trojan horses, most rootkits, spyware, dishonest adware, and other malicious and unwanted software. In law, malware is sometimes known as a computer contaminant, for instance in the legal codes of California, West Virginia, and several other American states.[1] Malware should not be confused with defective software, that is, software which has a legitimate purpose but contains harmful bugs.

3 Purpose Many early infectious programs, including the first Internet Worm and a number of MS- DOS viruses, were written as experiments or pranks generally intended to be harmless or merely annoying rather than to cause serious damage. Young programmers learning about viruses and the techniques used to write them wrote them only to prove that they could or to see how far it could spread. As late as 1999, widespread viruses such as the Melissa virus appear to have been written chiefly as pranks. However, since the rise of widespread broadband Internet access, more malicious software has been designed for a profit motive. For instance, since 2003, the majority of widespread viruses and worms have been designed to take control of users' computers for black-market exploitation.[citation needed] Infected "zombie computers" are used to send spam, to host contraband data such as child pornography[2], or to engage in distributed denial-of-service attacks as a form of extortion. Another strictly for-profit category of malware has emerged in spyware -- programs designed to monitor users' web browsing, display unsolicited advertisements, or redirect affiliate marketing revenues to the spyware creator. Spyware programs do not spread like viruses; they are generally installed by exploiting security holes or are packaged with user-installed software, such as Kazaa, Limewire, or other Peer to Peer applications.

4 Concealment For a malicious program to accomplish its goals, it must be able to do so without being shut down, or deleted by the user or administrator of the computer it's running on. Concealment can also help get the malware installed in the first place. By disguising a malicious program as something innocuous or desirable, users may be tempted to install it without knowing what it does. This is the technique of the Trojan horse or trojan. Broadly speaking, a Trojan horse is any program that invites the user to run it, but conceals a harmful or malicious payload. The payload may take effect immediately and can lead to many undesirable effects, such as deleting all the user's files, or more commonly it may install further harmful software into the user's system to serve the creator's longer-term goals. Trojan horses known as droppers are used to start off a worm outbreak, by injecting the worm into users' local networks. One of the most common ways that spyware is distributed is as a Trojan horse, bundled with a piece of desirable software that the user downloads from the Internet. When the user installs the software, the spyware is installed alongside. Spyware authors who attempt to act in a legal fashion may include an end-user license agreement which states the behaviour of the spyware in loose terms, but knowing that users are unlikely to read or understand it.

5 Once a malicious program is installed on a system, it is often useful to the creator if it stays concealed. The same is true when a human attacker breaks into a computer directly. Techniques known as rootkits allow this concealment, by modifying the host operating system so that the malware is hidden from the user. Rootkits can prevent a malicious process from being visible in the system's list of processes, or keep its files from being read. Originally, a rootkit was a set of tools installed by a human attacker on a Unix system where the attacker had gained administrator (root) access. Today, the term is used more generally for concealment routines in a malicious program. Some malicious programs contain routines to defend against removal: not merely to hide themselves, but to repel attempts to remove them. An early example of this behaviour is recorded in the Jargon File tale of a pair of programs infesting a Xerox CP-V timesharing system: Each ghost-job would detect the fact that the other had been killed, and would start a new copy of the recently slain program within a few milliseconds. The only way to kill both ghosts was to kill them simultaneously (very difficult) or to deliberately crash the system. Similar techniques are used by some modern malware, wherein the malware starts a number of processes which monitor one another and restart any process which is killed off by the operator.

6 Backdoor A backdoor is a method of bypassing normal authentication procedures. Once a system has been compromised (by one of the above methods, or in some other way), one or more backdoors may be installed, in order to allow the attacker access in the future. The idea has often been suggested that computer manufacturers preinstall backdoors on their systems to provide technical support for customers, but this has never been reliably verified. Crackers typically use backdoors to secure remote access to a computer, while attempting to remain hidden from casual inspection. To install backdoors crackers may use Trojan horses, worms, or other methods.

7 What is a virus? Viruses are computer programs or scripts that attempt to spread from one file to another on a single computer and/or from one computer to another, using a variety of methods, without the knowledge and consent of the computer user. A worm is a specific type of virus that propagates itself across many computers, usually by creating copies of itself in each computer s memory. Many users define viruses simply as trick programs designed to delete or move hard drive data, which, strictly speaking, is not correct. From a technical viewpoint, what makes a virus a virus is that it spreads itself. The damage it does is often incidental when making a diagnosis. Obviously, any incidental damage is important, even when authors do not intend to create problems with their viruses; they can still cause harm unintentionally because the author did not anticipate the full effect or unintentional side effects. The most common method used for spreading a virus is through attachment. Sending a virus, even if designed to be harmless, can cause unforeseen damage.

8 How can I detect and remove a virus? A virus scanner is the most common tool for prevention. This utility attempts to scan a computer program before it runs, and if it recognizes the signature of a malicious code, it shuts it down. Many scanners also evaluate programs to determine if it contains any virus-related characteristics. The best way to stop viruses is to use common sense. If an executable computer program is attached to your and you are unsure of the source, then it should be deleted immediately. Do not download any applications or executable files from unknown sources, and be careful when trading files with other users. A virus scanner must be updated regularly. On average 40 new variants are released daily. Unless your AV program updates regularly you may miss these new exploits. A free virus scanner can be downloaded at

9 What is a Trojan Horse A Trojan Horse meets the definition of virus that most people use, in the sense that it attempts to infiltrate a computer without the user s knowledge or consent. A Trojan Horse, similar to its Greek mythological counterpart, often presents itself as one form while it is actually another. A recent example of malware acting as a Trojan horse is the recent version of the "Swen" virus, which falsely claimed to be a Microsoft update application. Trojans typically do one of two things: they either destroy or modify data the moment they launch, such as erase a hard drive, or they attempt to ferret out and steal passwords, credit card numbers, and other such confidential information. Trojan Horses can be a bigger problem than other types of viruses as they are design to be destructive or disruptive, as opposed to viruses and worms where the coder may not intend to do any harm at all. Essentially this distinction does not matter in the real world. You can lump viruses, Trojans, and worms together as "things I don't want on my computer or my network".

10 How can I deal with a Trojan Horse? The methods for dealing with Trojans are generally the same as for those for dealing with viruses. Most virus scanners attempt to deal with some of the common Trojans with varying degrees of success. There are also specific "anti-trojan" scanners available, and your best weapon is common sense yet again. Score another point for safe computing! The method of delivery for Trojans varies. They can be bundled with a Patch or Crack these are programs designed to circumvent the copyright or cd protection on popular software such as Games, or other pirated software including Windows XP, Windows Vista and Microsoft Office. A free Trojan scanner can be downloaded from

11 Cookie or Spyware? A cookie is just a bit of text in a file on your computer, containing a small amount of information that identifies you to a particular website, and whatever information that site wanted to retain about the user when they are visiting. Cookies are a legitimate tool used by many websites to track visitor information. As an example, I might go to an online computer store and place an item in the basket, but decide not to buy it right away because I want to compare prices. The store can choose to put the information about what products I put into my basket in a cookie stored on my computer. This is an example of a good use of cookies to help the user experience. The only websites that are supposed to be able to retrieve the information stored in a cookie are the websites that wrote the information in that particular cookie. This should ensure your privacy by stopping anyone other than the site you are visiting from being able to read any cookies left by that site.

12 Friend or Foe? Q. Do some websites use cookies to exploit user information? A. Unfortunately, yes. Some may deceive users or omit their policies. For example, they may track your Web surfing habits across many different websites without informing you, and then use this data to customize the advertisements you see on websites, etc., typically considered as an invasion of privacy. It is difficult to identify this and other forms of "cookie abuse," which makes it difficult to decide if, when, and how to block them from ones system. In addition, the acceptable level of shared information varies between users, so it is difficult to create an "anticookie" program to meet the needs of everyone. Q. How does spyware exploit user information? The spyware problem is similar to the cookie problem from the point of view that both are an invasion of privacy, although spyware is different from cookies, technically speaking. Spyware is a program that runs on your computer and, again, tracks your habits and tailors these patterns for advertisements, etc. Because it is a computer program rather than just a bit of text in a cookie, spyware can also do some nasty things to ensure that the spyware keeps running and keeps influencing what you see.

13 How do I know if spyware is running on my computer? You can use detection programs such as Ad Aware and others. Similar to antivirus software, these programs compare a list of known spyware with files on your computer and can remove any that it detects. But again, what some consider unacceptable is perfectly acceptable to others. You may notice excessive popup adverts or browser windows. You may also notice that your internet download speed has fallen or that your computer runs slower than normal. Q. How does spyware install itself on computers? Common tactics for surreptitious installation include rolling up advertising programs into "free" shareware program downloads, and once the spyware is installed it can download advertisements 24 hours a day and overlay them on websites and programs you are using. Anti-spyware programs can combat spyware from being installed, but the best strategy is to discriminate what you choose to download and install.

14 Browser Attack? Another method of attack is by attacking your Internet Browser. These take the form of ActiveX programs or Scripts such as Java or Visual Basic. Internet Explorer 6 and 7 will alert you if a program is attempting to install an ActiveX component. If you are unsure as to the nature of the program then do not allow the program to be installed. You may also wish to consider changing your Internet Browser. There are many alternatives such as Opera and Firefox. Firefox also supports additional security plugins that will allow you to block adverts and other scripts that may display banners.

15 Rogue Software Rogue software, this is usually software that tells you that you have a malware infection and requests a payment to clean the infection. The cause of the infections is the actual software itself and it uses social engineering to generate revenue for the creator.

16 So what are the real dangers? Other than slowing your PC down, delivering adverts and the invasion of your privacy you may feel that there is no REAL risk from Malware. However, the real risks include: Your PC being used to send SPAM s on a BOTNET Your PC being used in illegal file hosting such as copyright material, information relevant to criminal organisations such as terrorists. Your PC being used to PROXY pornographic images, both adult and child. An operator may be using your PC to pass on images that may be illegal. Your PC being used to attack other web sites in a Distributed Denial Of Service attack (DDOS) Your PC being used to steal your financial information and identity.

17 Prevention Two of the biggest concerns for computer users today are viruses and spyware. In both cases, we have seen that while these can be a problem, you can defend yourself against them easily enough with just a little bit of planning: Keep your computer s software patched and current. Both your operating system and your anti- virus application must be updated on a regular basis. Only download updates from reputable sources. For Windows operating systems, always go to and for other software always use the legitimate websites of the company or person who produces it. Always think before you install something, weigh the risks and benefits, and be aware of the fine print. Does the lengthy license agreement that you don t want to read conceal a warning that you are about to install spyware? Install and use a firewall. If you are running Windows XP you can use the built-in software firewall under Control Panel, and there are free versions of firewalls that work on all versions of Windows. Prevention is always better than cure.