Types of Malwares, Information security.
- 1. INTRODUCTION 20XX • Malware : Malware, short for malicious software, is a broad term used to describe any software intentionally designed to cause damage to a computer, server, client, or computer network. Malware encompasses various types, each with its own methods of infiltration and objectives. Understanding the different types of malware is crucial in comprehending the threats posed to information security. • Significance of Information Security : In today's interconnected world, where digital data is the lifeblood of businesses and individuals, protecting sensitive information is paramount. Information security refers to the practice of safeguarding data from unauthorized access, disclosure, disruption, modification, or destruction. Malware poses a significant threat to information security, capable of causing financial losses, privacy breaches, and operational disruptions. • The purpose of this presentation is to delve into the different types of malware, including viruses, worms, Trojan horses, rootkits, and bots. By exploring their characteristics, behaviors, and potential impacts, we aim to enhance our understanding of these threats and bolster our defenses against them.
- 2. “"The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards." - Gene Spafford” GENE SPAFFORD
- 3. WHAT IS A VIRUS? • A malicious software program that attaches itself to a legitimate program or file. • Needs user interaction to spread (downloading infected files, opening attachments). • Can replicate itself and damage or delete files. • Viruses need to infect a host program or file in order to replicate 20XX
- 4. HOW VIRUSES INFECT COMPUTERS CLICKING ON MALICIOUS LINKS IN EMAILS OR WEBSITES. DOWNLOADING INFECTED FILES OR ATTACHMENTS. OPENING INFECTED REMOVABLE MEDIA (USB DRIVES, CDS). EXPLOITING SOFTWARE VULNERABILITIES (UNPATCHED SOFTWARE). 20XX
- 5. DAMAGE CAUSED BY VIRUSES DATA CORRUPTION AND DELETION SYSTEM SLOWDOWN AND CRASHES IDENTITY THEFT AND FINANCIAL LOSS SPAM EMAILS AND DENIAL-OF- SERVICE ATTACKS 20XX
- 6. WHAT IS A WORM? • A STANDALONE MALICIOUS PROGRAM THAT REPLICATES ITSELF AND SPREADS THROUGH A NETWORK. • DOES NOT NEED USER INTERACTION TO SPREAD (EXPLOITS NETWORK VULNERABILITIES). • CAN CONSUME SYSTEM RESOURCES AND CLOG NETWORKS. • MAY ALSO CARRY A PAYLOAD TO DAMAGE DATA OR STEAL INFORMATION. 20XX
- 7. HOW WORMS INFECT COMPUTERS o Exploiting network vulnerabilities (unpatched software, weak passwords). o Spreading through email attachments (often disguised as legitimate files). o Utilizing social engineering tactics (tricking users into clicking malicious links). 20XX
- 8. THREATS POSED BY WORMS NETWORK CONGESTION AND SLOWDOWN SYSTEM CRASHES AND INSTABILITY INCREASED VULNERABILITY TO OTHER MALWARE ATTACKS DATA THEFT AND PRIVACY BREACHES 20XX
- 9. DETECTING VIRUSES AND WORMS SLOWER COMPUTER PERFORMANCE FREQUENT CRASHES OR FREEZES UNUSUAL POP-UP MESSAGES OR ERROR MESSAGES UNKNOWN PROGRAMS RUNNING IN THE BACKGROUND DISAPPEARANCE OF FILES OR FOLDERS 20XX UNEXPLAINED CHANGES TO YOUR WEB BROWSER SETTINGS A SURGE IN SPAM EMAILS OR SOCIAL MEDIA MESSAGES UNEXPECTED POP-UP ADS DIFFICULTY ACCESSING THE INTERNET MAXED OUT STORAGE SPACE
- 10. REMOVING VIRUSES AND WORMS UTILIZE A REPUTABLE ANTIVIRUS PROGRAM ISOLATE OR REMOVE INFECTED FILES CONDUCT REGULAR SYSTEM SCANS SEEK PROFESSIONAL HELP IN SEVERE CASES Antivirus software can scan your system for malicious code and remove it. Regularly update your antivirus software's definitions to ensure it can detect the latest threats. If a virus or worm is detected, your antivirus program may prompt you to remove the infected file. In some cases, quarantining the file might be an option, preventing it from causing harm but keeping a copy for potential analysis. Schedule regular scans with your antivirus software to proactively identify and remove potential threats. Early detection is crucial to minimize damage. In severe infections, a professional data recovery service may be necessary to salvage compromised data. This is typically a last resort after attempting other removal methods. 20XX
- 11. 20XX Malware Prevention • Keep your software up to date Always install the latest security updates for your operating system, apps and browsers to patch vulnerabilities. • Use antivirus software Use a reputable antivirus program to detect and remove malware. • Be cautious with downloads Only download apps from official stores and websites you trust. Avoid torrents and illegal downloads. • Use ad blockers Block potentially malicious ads by using ad blocking browser extensions and tools. • Backup your data Regularly back up your important data to an external hard drive or cloud storage. • Avoid suspicious links/attachments Don't open links or attachments in unsolicited emails, messages or popups as they may contain malware.
- 12. NOTABLE EXAMPLES First virus to a ttack IBM PC BRAIN V i r u s s p r e a d t h r o u g h e m a i l a d d r e s s b o o k MELLISA Worm atta cks SCADA autom ate d p roce ssing syste m: zero- day atta ck STUXNET 1985 2001 2010 1982 1988 2000 2008 ELK CLONER Fi rst viru s: ta rg ets APPLE II COM PU TER S CONFICKER Wo r m t h a t I n f e c t e d m i l l i o n s o f W i n d o w s m a c h i n e s 20XX MORRIS M or ri s wor m i n f e c ts ~ 1 0 % of e a r l y i nt e r ne t n o de s 1999 ILoveYou Wo r m w h i c h s p re a d v i a e m a i l s w i t h i n f e c t e d a t t a c h m e n t A worm which att acks white house .gov web site CODE RED
- 13. • A Trojan Horse is a deceptive type of malware that poses significant risks to computer users. • Trojans present themselves as harmless or beneficial software, enticing users to install them. TROJAN HORSE: What Is a Trojan Horse ? • Once activated, they can execute harmful actions such as stealing data, spying, or installing other malware. • Unlike viruses, Trojans require user interaction to be executed.
- 14. HISTORY OF TROJAN HORSE: • Trojan War Story: Greeks and Trojans were at war for a long time. Greeks couldn't break through Troy's defenses. • Deceptive Plan: Greeks built a giant wooden horse. They hide soldiers inside it. • Fake Peace Offering: Greeks left the horse at Troy's gates. They pretended to sail away, making it look like a peace offering. • Trojan's Mistake: Trojans thought Greeks had given up. They brought the horse into the city as a trophy. • Surprise Attack: Greek soldiers inside the horse sneaked out at night. They opened the gates for the Greek army, which had secretly returned. • City Sacked: Greeks entered Troy and defeated the Trojans. They sacked the city, winning the war. • Relation to Information Security: In the digital world, a "Trojan horse" is a type of malicious software. It pretends to be harmless but contains harmful code. When executed, it can steal information or harm computer systems. Just like the Trojan Horse in the story, it tricks users into letting it in, bypassing security measures.
- 15. HOW DO TROJAN WORKS? 1. Disguise: Trojans present themselves as harmless or useful software, such as a game, an update, or a utility program. 2. Delivery: They are often delivered through email attachments, software downloads, or operating system vulnerabilities. 3. Execution: When the user executes the file, thinking it’s safe, the Trojan activates and carries out its malicious functions. 4. Malicious Actions: These actions can include stealing data, installing more malware, creating backdoors for hackers to access the system. 5. Avoidance: Trojans often try to avoid detection by security software, making them a persistent threat. 6. User Role: Unlike viruses, Trojans do not replicate themselves. They rely on users to install them, often through social engineering tactics.
- 16. HOW TO PROTECT YOURSELF FROM TROJAN HORSE: 1. Use Reliable Antivirus Software 2. Keep Software Updated 3. Be Cautious with Downloads 4. Email Vigilance 5. Use Strong Passwords 6. Secure Your Network
- 17. E X A M P L E S O F T R O J A N H O R S E A T T A C K S I N I N D I A : Operation Hangover: This was a cyber campaign discovered in 2013 that targeted Indian government and military organizations. It utilized Trojan horses to infiltrate systems and steal sensitive information. Trojan Kasidet : This Trojan was used in targeted attacks against Indian organizations, particularly in the banking sector. It was designed to steal sensitive banking information and credentials. ATM Malware: In recent years, there have been reports of Trojan malware being used to target ATMs in India. These Trojans are often designed to infect ATM systems and allow attackers to steal cash or sensitive financial data.
- 18. BOTS: Bots – meaning & definition: • A ‘bot’ – short for robot – is a software program that performs automated, repetitive, pre-defined tasks. • Bots typically imitate or replace human user behavior. Because they are automated, they operate much faster than human users. • They carry out useful functions, such as customer service or indexing search engines, but they can also come in the form of malware – used to gain total control over a computer.
- 19. Malware bots and the dangers of internet bots: • Malware bots are automated programs designed to perform repetitive tasks but are used for malicious purposes. • They aim to gain full system control and can be deployed for unauthorized system access, phishing campaigns, and more. Danger of Internet- Bots: • Internet bots can be programmed to break into user accounts, scan for contact information, send spam, or perform other harmful acts. • They can form botnets, which are networks of infected devices used to carry out large-scale attacks, making it difficult to trace the source of the attack Protection Measures: To protect against these threats, it’s important to use: • up-to-date security software, • practice safe browsing habits, • and be cautious with downloads and email attachments
- 20. WHY DO CYBERCRIMINALS USE BOTS? 1. Financial Gain: Theft: Cybercriminals access and drain financial accounts, causing direct monetary loss. Extortion: They disrupt services to demand ransom, leveraging the urgency of service restoration for payment. 2. Information Theft: Identity Fraud: Personal information is stolen to impersonate individuals and commit fraud. Corporate Espionage: Sensitive business data is targeted to gain competitive advantages or for sale to the highest bidder. 3. Service Disruption: Website Downtime: Overloading websites with traffic to force them offline, impacting business operations. Email Overload: Flooding inboxes with spam, which can also distribute malware and disrupt communication.. 4. Computing Power Misuse: Cryptocurrency Mining: Hijacking processing power from multiple devices to mine cryptocurrency, generating profit. Botnet Leasing: Renting the botnet’s capabilities to other criminals, offering a service for various cyberattacks.
- 21. How to tell if your computer is infected by bots: • Your computer keeps crashing without an identifiable reason. • Applications that previously worked seamlessly now work in fits and starts. • Programs which previously loaded quickly are now slow to start. • The computer takes a long time to shut down or does not shut down properly. • Your internet access slows to a crawl. • The browser features components you didn’t download. • Windows Task Manager shows programs with cryptic names or descriptions. • Settings have changed, and there is no way to reverse them. • Pop-up windows and advertisements appear even when you are not using a web browser. • The fan goes into overdrive when the device is idle. • Friends and family report receiving email messages from you, but you did not send them. • You cannot download operating system updates.
- 22. How to protect your computer from bots: Install anti-malware software Ensure all your software is up to date Use a strong password Only click on links you trust Avoid untrustworthy websites and ads Only click on links you trust Install a firewall
- 23. ROOTKITS • Rootkits represent a particularly insidious form of malware that operates by concealing its presence on a system, allowing unauthorized access and control without detection. Unlike other types of malware that focus on causing immediate damage or disruption, rootkits are designed to establish persistent and stealthy access to a compromised system. 20XX 23 Characteristics of Rootkits: • Stealth: Rootkits are adept at hiding their presence by manipulating system functions and evading detection by traditional antivirus software. • Privilege Escalation: Rootkits often exploit vulnerabilities to gain elevated privileges on a system, enabling them to execute commands and access sensitive data. • Persistence: Once installed, rootkits typically establish persistence by embedding themselves deep within the operating system, making them difficult to remove. • Remote Control: Some rootkits include remote control capabilities, allowing attackers to manipulate infected systems remotely without the user's knowledge.
- 24. 20XX Pitch Deck 24 Modes of Infection: • Exploiting vulnerabilities in software or operating systems. • Piggybacking on legitimate software installations. • Social engineering tactics, such as phishing emails or malicious links. Detection and Mitigation: Several strategies can help mitigate the risks posed by rootkits: • Regularly updating software and operating systems to patch known vulnerabilities. • Implementing security measures such as intrusion detection systems (IDS) and endpoint security solutions. • Conducting regular malware scans using reputable antivirus software capable of detecting rootkit behavior. • Employing network segmentation and access controls to limit the spread of rootkit infections within an organization.
- 25. TYPES OF ROOTKITS 20XX 25 User Mode Rootkits Operate at the user level, modifying system libraries or processes to conceal their presence. Kernel Mode Rootkits Operate at the kernel level, intercepting system calls and modifying kernel data structures. Hardware/ Firmware Rootkits Target system firmware or hardware components, persisting even if the operating system is reinstalled. Bootloader Rootkits Infect the Master Boot Record or boot sector, controlling the operating system from the earliest stage. Memory Rootkits Exist only in system memory, intercepting and modifying data passing through without leaving disk traces.
- 26. CONCLUSION In conclusion, the digital age offers a wealth of opportunities for connection, information, and progress. However, this vast online landscape also harbors malicious software like viruses and worms, posing a significant threat to our devices and data. These threats can disrupt system functionality, corrupt valuable information, and even compromise our privacy. The good news is that we are not powerless against these digital adversaries. By understanding the methods employed by viruses and worms, we can take proactive measures to safeguard our digital lives. Regularly updating software with the latest security patches, implementing strong passwords with two-factor authentication, and exercising caution when interacting with online content are all essential lines of defense. Additionally, maintaining data backups ensures you have a safety net in case of an attack. By prioritizing these cybersecurity best practices, we can create a more secure digital environment and empower ourselves to navigate the online world with greater confidence.
- 27. THANK YOU