Malware Primer Smart Computing Article - August 2004

Transcription

1 Malware Primer Smart Computing Article - August 2004 Before you can defeat an enemy, you have to name it. Unfortunately, too many computer users remain woefully ignorant of the digital thugs that imperil the stability of their systems. These users can't identify the threats and so remain vulnerable to data loss, identity theft, and poor performance. It doesn't have to be this way. The list of common cyberhazards is brief, and anyone can learn to recognize the basic characteristics of each type of threat. Once you become familiar with the various manifestations of malware (software designed for a malicious purpose), you can take measures to protect your system from all of them. Viruses The oldest and most obvious form of malware, viruses are small programs designed to infect other programs (which are thereafter referred to as hosts) and then replicate. A typical virus also executes a particular function, such as deleting key system files or sending infected messages to everyone listed in an address book. The most successful viruses work quietly in the background. As a result, you may not know you have a virus infection until the damage is done. Infections typically manifest themselves through data corruption and loss, error messages, and sudden strange system behavior. Every virus is unique, but most fall into one of three common categories: boot, macro, and file. A boot virus attacks a computer's master boot record (the section of a hard drive containing information about the OS [operating system] and other files required during startup) for the purpose of disrupting a computer's boot (startup) routine. A macro virus inserts itself into popular applications by posing as a macro (a customizable keyboard or mouse command that performs a particular function within an application). File viruses go after executable files (files typically identified by.exe or.com extensions that contain coded instructions for the computer to perform). A virus must first infect another file before it can wreak havoc on a computer system. The infected file, which is thereafter referred to as the host, serves as the

2 launching pad for the virus' wicked deeds. The Melissa virus, for instance, must first infect Microsoft Word before it can attack Microsoft Outlook for the purpose of replicating itself. Unlike a virus, a worm does not need a host in order to cause trouble. The Hybris worm, for instance, heads straight for the Wsock32.dll file, which it then modifies for the purpose of usurping the system's client. There are more than 60,000 known viruses in existence, but less than 1% of those are in the wild (actively spreading from one system to another) at any given time. The widespread implementation of antivirus utilities in homes and businesses has greatly reduced the spread of viruses. Indeed, the most notorious viruses such as the Melissa virus, a macro virus that infects Microsoft Word, and the Michelangelo virus, a boot virus that overwrites critical system data are those that were introduced during the 1990s. Worms Computer users often speak of viruses and worms as if they were the same thing. They are not. Unlike viruses, which require a host, worms can replicate without first infecting any other file on a system. In this way, worms are more insidious and potentially more devastating than viruses. To understand why, consider how viruses and worms would spread if they were infectious diseases. The virus would spread through contact between an infected individual and one or more uninfected individuals. The worm, on the other hand, would simply spread. Imagine if you could catch a cold, the flu, smallpox, or something worse just by walking down an empty street or sitting alone on a park bench. You could if infectious diseases spread like worms. Thankfully, they don't. Worms are often identified as either active or passive. A passive worm is one that is unleashed by a precipitating action, such as a double-click. They are typically distributed as attachments or disguised as Trojan horses (see below for details). In contrast, an active worm can spring into action without any apparent precipitating action. They can embed themselves in s or Web pages, where they lie dormant until an innocent bystander opens the infected or accesses the infected Web page. Fighting passive worms, such as the notorious Goner, a worm that disables antivirus utilities, and Hybris, a worm that transmits itself to the recipients of the messages you send, is a relatively easy task: Avoid opening or downloading any file unless it comes from a reputable source and you know exactly what it contains. Unfortunately, such measures will not fend off active worms, such as Code Red, a worm that instigates DoS attacks (denial of service attacks; a tactic for disrupting a network that involves flooding a network server with bogus traffic until the server collapses), and Sasser, a worm that exploits a known Windows security flaw. The best way to combat these rascals is to regularly update your OS and antivirus utility. Trojan Horses According to Greek legend, the Achaeans built a large wooden equine structure, filled it with soldiers, and left it in the plain before Troy. The remaining Achaeans then burnt their encampment and sailed out of view. When the Trojans noticed that the Achaeans had fled, they approached the strange edifice and brought it into their walled city. That night, the Achaean warriors emerged from the horse and destroyed the city of Troy.

3 Inspired by this ancient myth, modern-day crackers often hide damaging code inside files that promise access to exciting games, titillating images, cool screen savers, and necessary software updates, among other things. When unsuspecting computer users open these files, which are referred to as Trojan horses, they unwittingly launch the destructive code, known as the payload, contained inside. The results can be devastating. Users who fell victim to the Polyglot Trojan horse, for instance, thought they were getting a free millennium countdown utility but ended up installing a program that monitored their Internet activity. Another Trojan horse known as AOL4Free promised users free access to America Online but actually executed a DOS command that systematically deleted data from the hard drive. Not all spyware is illegal. You can deploy a legitimate spyware program, such as Rampell Software's ViewRemote ($69.95; remote.com), on your personal computer system for the purpose of monitoring the computing behavior of your spouse, children, or employees. Trojan horses are frequently distributed as attachments or Web downloads. They're difficult to spot because they can change forms quickly. Indeed, Trojan horses can manifest themselves in several forms over a period of many years. In this way, they differ from other malware threats, which often have a limited lifespan. Adware & Spyware Viruses, worms, and Trojan horses represent the historical axis of computer malware. Although they remain a threat, you can mitigate these 20th century bogies quite effectively with the help of an updated antivirus utility. The latest generation of malware demands all of the attention you can give it. Adware (software that displays targeted ads on a user's computer) and spyware (software that surreptitiously installs itself on a computer for the purpose of tracking a user's online behavior), in particular, reveal the sophisticated mindset of modern crackers. It's not enough for these mischief-makers to inflict impersonal vandalism on far-flung computer systems for a mere thrill. Crackers of the 21st century prefer to track the behavior of particular users, cultivate key pieces of information from these users, and employ the information for personal financial gain. Adware is probably the most common form of malware these days. Typically entering your PC on the back of a freeware application, adware embeds itself for the purpose of delivering pop-up and pop-under advertisements (unsolicited advertisements that appear in separate windows on top of or below the currently active browser window) to your Windows Desktop. The adware may function as a browser hijacker (a JavaScript or ActiveX control that modifies your browser in some way), as well. As a browser hijacker, the adware will change the browser's default home page or add unwanted sites to your Favorites folder. These changes occur without your knowledge, although you may find a description of them in the documentation that came with the hosting freeware application. Interestingly, much of the adware that infiltrates your system is perfectly legal. Unlike other forms of malware, adware is a commercial endeavor instigated by money-hungry companies looking to capitalize on your attention. The companies contract with freeware

4 software developers for the opportunity to blitz your PC with unsolicited ads. As long as they inform the audience of their purpose and somewhere within licensing agreement they generally do these companies have the right to persevere in their vexing objective. Some of the most visible adware clients include Aureate (also known as Radiate), which identifies the ads you click and measures how much time you spend reading them; Comet Cursor, which allows third-party Web developers to replace your default cursor with their own creations; New.Net (also referred to as NewDotNet), which delivers targeted pop-up ads to the Desktop; and the Xupiter Toolbar, which not only delivers pop-up ads but also modifies your Favorites folder and changes your home page. If adware is annoying, spyware is criminal. Designed and distributed by crafty individuals, spyware enters your system through dishonest measures such as Trojan horses or drive-by downloads (unsolicited file downloads). Once on your PC, the spyware monitors system activity, often via a keystroke logger (a program that creates a record of every key a user types). The stolen data is recorded to a log file, where it resides until the spyware developer retrieves it from your system by exploiting a backdoor (a bug or security flaw) in Windows or some other program. Spyware can reconfigure the Registry, commandeer your Internet connection, and do about anything else that lets it establish a pathway between your PC and the spyware developer. When he gets information, he'll scan it for Social Security numbers, passwords, account numbers, and more. The Bonzi Buddy ( may look adorable, but he's really a symptom of adware. Pop-up ad developers will do just about anything to get their commercials on your Desktop. Spyware clients are often linked with Trojan horses as part of a blended threat (a Trojan horse that carries another piece of malware as its payload). Two of the most nefarious blended threats involve spyware: Back Orifice, which contains a spyware payload that lets crackers control a system from a remote location, and SubSeven, which contains a spyware payload that lets crackers access files on a remote system. Adware may be distributed as a blended threat, too. (NOTE: Technically speaking, adware is a form of spyware in that it monitors online behavior for to deliver targeted pop-up ads or other services to your system. Therefore, the terms are often used interchangeably.) Beyond Malware Malware doesn't represent the only threat to your PC. Lowlifes have figured out how to cause all sorts of mischief. These expanded threats include online hoaxes ( s and Web sites produced to convince gullible readers that fraudulent information is true), DoS attacks, and dialers (programs that hijack PCs and network access devices so third parties can place long-distance or toll telephone calls). The existence of so many threats is just one reason you should take measures to protect your PC. See "Keep It Clean" on page 68 for more details about protecting your PC.

5 by Jeff Dodd