Malware

Malware is a term that refers to any malicious software that is unintentionally installed on a computer system. Malware can be distributed in various ways: viruses, worms, unintentional downloads, or trojan horses. It may spy on user actions and collect information on them (spyware), or present unwanted ads (adware). It may disable components of the system or encrypt files, undoing its damage if the owner pays money (ransomware). The software may sit dormant and wait for directives from some coordinator (a command and control server), who assembled an arsenal of hundreds of thousands of computers ready to do its bidding (for example, launch a distributed denial of service, DDoS, attack). Some software might be legitimate but may contain backdoors – undocumented ways to allow an outsider to use that software to perform other operations on your system.

Malware Motivation

A saying often paraphrased from Sun Tzu’s The Art of War is “know your enemy.” In the case of malware, it helps to understand why someone would want to install malicious software on your computer. There are numerous reasons. We examined this in greater detail at the start of the course. Some of the reasons are:

Steal account credentials

If an attacker can obtain someone’s login and password credentials on one system, there is a good chance that those same credentials will work on other systems.

Espionage

An attacker may have an interest in spying on the activities of a particular person. Traditionally, this would have been done through planting covert cameras and recording devices. Now it is often easier to accomplish the same results - and more - by installing software on the target’s computer. Such software is called spyware.

Data theft

An attacker may target a person at a specific company (or a student taking a certain class) in an attempt to exfiltrate data of strategic interest. Alternatively, an attacker may target people anonymously, with the hope of obtaining information of value, such as credit card data or bank account information.

Sabotage

There’s vengeance or vandalism: the attacker may want to destroy a target’s content or devices.

Host services

An attacker may need to harness computing, storage, or network resources. This can help hide the owner’s identity or amass a large collection of computers. An attacker can set up servers to host contraband data (e.g., stolen credit cards, login credentials, illegal material), send spam email on a large scale, mine cryptocurrency for free, or create a botnet for DDoS (distributed denial of service) attacks.

Adware and ad clicking

An attacker may add software to a system or reconfigure a browser or hosts file to present unwanted advertising in the form of pop-up windows or banners. Additionally, the malware may redirect search requests or create click-throughs on ads that the user never wanted.

Ransomware

Finally, the attacker may want to extract money from the victim directly. Ransomware installs software to encrypt files that will be (hopefully) decrypted if ransom is paid. The emergence of cryptocurrencies led to a huge increase in ransomware since they enabled anonymous payments. Ransomware is a reversible form of sabotage coupled with extortion.

Another saying paraphrased from The Art of War is “all warfare is based on deception.” This is also useful to consider with malware since it is most often installed willingly by the user of the system via some form of deception rather than through the exploitation of bugs in the system.

Malware Infiltration

There are several ways in which malware gets onto a system.

An attacker can exploit vulnerabilities in system services, particularly network services, to inject code that will download the malware. Zero-day vulnerabilities are particularly useful to attackers. These are bugs that have been discovered but not yet reported to the software vendor or the general public and hence are not fixed. They are typically known only to those who discovered and exploited the vulnerability … or sold the exploit.

As such, an attacker can be confident that the exploit will work on virtually all systems running the software and does not have to rely on targets who were not diligent enough to keep their systems patched. Ideally (for the attacker), the vulnerabilities will allow malware to run with elevated privileges so they can access all parts of a system or conceal itself more effectively.

Related to this are N-day vulnerabilities. N-day vulnerabilities are known vulnerabilities. Because they are known, developers have the opportunity to patch the code with a fix and IT administrators have the ability to apply a patch, shut off services, or put some detection mechanisms in place. However, all this does not happen instantly. Attackers have a period of time — N days — between the time that a vulnerability is disclosed and the time that most systems have been patched to avoid the vulnerability.

Malware might be installed unknowingly via infected removable media, most commonly USB flash drives (in earlier years, it would have been CDs or floppy disks).

Older and Internet-Connected Devices

While most people keep their PCs up to date with the latest security patches, the same cannot be said for other internet-connected devices, which can include routers, printers, kitchen appliances, security cameras, industrial control equiptment, and many other devices.

These devices often lack necessary updates and security features, making them prime targets for cyber attackers. They be often be easily exploited and added to botnets—a network of compromised devices used to execute malicious activities such as DDoS attacks and data theft.

One example (November 2024) of a threat actor exploiting these vulnerabilities is Volt Typhoon, a state-sponsored hacking group linked to China. Known for its sophisticated and stealthy operations, Volt Typhoon focuses on cyber-espionage and targets critical infrastructure in the United States. The group uses a tactic known as “living-off-the-land” (LotL), relying on legitimate administrative tools already present on systems to avoid detection. By compromising outdated devices, Volt Typhoon can build large botnets without leaving obvious traces, enabling them to disrupt communication channels, access sensitive information, and execute large-scale attacks.

Manufacturers of devices stop support at a certain time: it simply does not make economic sense to maintain software for older devices even if they are still in widespread use. In November 2024, for example, D-Link announced that it no longer supports over 60,000 deployed network-attached storage devices even though they are vulnerable to a command injection vulnerability with a published exploit that allows an attacker to send HTTP GET messages to run arbutrary shell commands on these devices. With access to the network, an attacker can simply run a curl command to target the device:

curl "http://[Target-IP]/cgi-bin/account_mgr.cgi cmd=cgi_user_add&name=%27;<INJECTED_SHELL_COMMAND>;%27"

Social engineering

By far the most common way that malware enters a system is via deception: the legitimate user of the system installed it unknowingly. This uses a social engineering attack to convince the user that it is in his or her interest to install the software.

Social engineering is the art of manipulating, influencing, or deceiving a user into taking some action that is not in his/her or the organization’s best interest. The goal of social engineers is to obtain your trust and get you to divulge information or provide them with some form of access. In computers, social engineering refers to any techniques used by an adversary to trick you into disclosing information, opening an attachment, downloading a file, reading a message, clicking on a link, installing a program, or running a command.

For example, the May 2024 cyberattack on the Ascension healthcare facilities in the U.S. began when an employee downloaded a malicious file they thought was legitimate. It led to the installation of ransomware and propagation to multiple servers, impacting pharmacies and hospitals across. 19 states.

Websites may offer downloads of “security” software, system “cleaner” software, or software “updates,” none of which will do their purported task. An attacker may convince a user to click on a URL in an email attachment or a web page. Software obtained from file sharing services are also excellent venues for distributing malware. A user may try to avoid spending $4,000 for an AutoCAD license or $240/year for an Adobe Illustrator license and turn to a file sharing site to download a patched copy or a crack for the software that bypasses license checks. Quite often, these downloads contain malware instead of the desired software (what do you expect – the user is acting as a thief by downloading software from thieves).

Downloads can also be initiated by tricking users into thinking they’re dismissing an error or downloading something innocuous. For instance, attackers have been found to use JavaScript to overlay fake error messages from Google Chrome, Microsoft Word, and Microsoft OneDrive. These “errors” direct the user to copy a PowerShell fix. Into a clipboard and then run it.

Attackers have also emailed HTML attachments that look like Microsoft Word Documents that, when opened, present a prompt asking the user to install a “Word Online” extension to be able to view the document. The download is, of course, not an extension and directs users to run the attacker’s script. The unsuspecting user believes they’re installing a legitimate Microsoft extension.

Any information the attacker can get about a user can help an attacker create a more convincing social attack. The term pretexting refers to using a concocted scenario to contact a user and get additional information (e.g., an attacker can pretend to be a caller from the IT department or a high-level manager from another location to try to extract information; with some rudimentary information, the attacker can mention some employee, department, or project names to sound like a true insider).

Luring developers – 2024
Social engineering may involve winning someone’s trust by appearing to be helpful. Offering security updates is a form of that. A more direct example surfaced in mid 2024 where a user on Stack Overflow offered to “help” developers on Stack Overflow by telling them to install the pytoileur package, which purports to be an API management tool written in Python. If someone inspects the code, it will look innocent unless they notice that there’s a lot of whitespace with the code appearing far to the right, requiring horizontal scrolling and will likely be unnoticed by the victim.

The package targets Windows systems and downloads a malicious program called Runtime.exe that is then run via the Windows PowerShell and VBScript commands. The package also installs additional executables and modifies registry settings. One of these packages tries to upload user profiles from browsers and crypto services.

Dev Popper – 2024
As an example of a novel but uncommon type of social engineering, a malware campaign called Dev Popper was documented in April 2024 that targeted software developers with fake interviews and got them to install a remote access trojan, which would allow intruders future access to their computers. This is a social engineering attack where the victims believed they were participating in a job interview. They willingly downloaded a zip file in order to demonstrate that they can download and run code from Github. Note that, although the software is described as a trojan, it’s not clear that it presented any useful purpose but did have the property that the user installed it willingly.

Supply Chain Attacks in Distributing Malware

Supply chain attacks exploit vulnerabilities in the production, distribution, or deployment of software or hardware by compromising a trusted third-party component. Attackers target dependencies to inject malicious code, which is then propagated through the supply chain, allowing malware to be distributed through widely trusted channels. These attacks are particularly dangerous as they undermine trust in legitimate software, potentially impacting thousands or millions of users.

We’ll examine a few common types of supply chain attacks in software distribution, including typosquatting, infected development tools, and malicious packages.

Typosquatting

Typosquatting involves creating malicious software packages with names similar to legitimate packages, hoping that developers will accidentally download and use the harmful version due to a minor typo in the name. This attack leverages human error to infiltrate systems by mimicking legitimate dependencies.

An example of typosquatting occurred when malicious packages were uploaded to the Python Package Index (PyPI) under names similar to popular packages. Attackers exploited minor misspellings or alternative naming conventions, causing unsuspecting developers to download and install these malicious packages, which often contained data exfiltration or credential-stealing code (DataBreachToday, 2024).

XcodeGhost

XcodeGhost is an example of an attack targeting a development tool. In this case, a modified version of Apple’s Xcode development environment was distributed through third-party websites. XcodeGhost included malicious code that was injected into any app compiled with the infected version of Xcode, allowing it to compromise applications distributed via Apple’s App Store. The malware gathered device information, including the app’s bundle identifier, network information, and other sensitive data, and sent it to the attacker’s server.

Developers in regions with slower internet connections sometimes downloaded Xcode from unofficial sources, unknowingly downloading XcodeGhost instead of the legitimate package. Once an app was compiled with this infected version of Xcode, it was virtually impossible for developers or users to detect that it contained malware (Wikipedia, 2024).

Malicious Packages Repositories

Repositories for open-source software packages, such as GitHub and PyPI, are frequent targets of malicious actors. Attackers upload packages that contain malware, either by creating new, seemingly useful packages or by compromising existing packages. When developers include these packages in their projects, they unknowingly introduce malware.

1. GitHub and Other DevOps Platforms: Malicious actors exploit platforms like GitHub by uploading harmful repositories or modifying dependencies in existing projects. Attackers may hijack inactive or poorly maintained repositories, injecting malicious code that is automatically pulled in by any projects relying on these dependencies (SentinelOne, 2024).

2. Malicious Python Packages on PyPI: The Python Package Index (PyPI) has seen numerous instances of malicious packages that exfiltrate credentials. For example, a recent malicious package was found to exfiltrate AWS credentials when installed. Attackers exploited developers’ reliance on PyPI, which often handles trusted packages, to insert malware and gain unauthorized access to sensitive cloud environments (Fortinet, 2024).

These malicious packages are especially dangerous because they directly attack software that developers trust and frequently rely on. Once a developer incorporates a malicious package, it often goes undetected until the malware is triggered, allowing attackers to access confidential information, disrupt services, or compromise data integrity.

Supply chain attacks are an increasingly prevalent threat. Defending against these attacks requires careful verification of package authenticity, vigilance in downloading tools from official sources, and consistent monitoring of dependencies.

Credential stuffing

An attacker may obtain collections of stolen email addresses (or usernames) and passwords. Since people often use the same name and password on multiple systems, this often give the attacker access to services on other websites on which the user has accounts. Accounts for banking sites are, of course, particularly valuable since they can be a direct conduit for transferring money. This attack is called credential stuffing.

In some situations, such as getting access to a user’s email accounts, an attacker can log onto the systems or services as the owner of the account and install malware, monitor the internal organization, and even send email, disguised as the user (e.g., contact other employees or friends), which becomes a powerful social engineering attack.

Types of Malware

Worms and viruses

A virus is software that attaches itself to another piece of software. It may also be content, such as scripts inside a Microsoft Word document or PDF file, that will be accessed and hence executed by some software. It may also be an email attachment that contains a document or software with the malware or a link to the malware.

It might even be a modification of the boot loader of a computer or the firmware on a flash drive. The key point is that it does not run as an independent process. A virus may spread automatically by trying to

A virus is executed because another program ran. Viruses are often spread by sharing files or software. On a computer, a virus may replicate itself onto other files or software to maximize its chance of spreading and reduce its chance of being removed.

A worm is conceptually similar in that it can do the same damage to the computer as a virus can. The distinction from a virus is that a worm runs as a standalone process while a virus requires a host program.

The popular use of both terms, worm and virus, has often blurred the distinctions between them. People often refer to any malware as a virus. Their malicious effects can be similar.

When using non-legitimate ways of getting into a system or elevating their privileges, attackers often try to find zero-day vulnerabilities. These are vulnerabilities (bugs or configuration errors) that have not been publicly reported, or are newly discovered, and hence are unpatched. They are referred to as “zero-day” because developers have zero days to fix the problem.

Malware components

Viruses and worms contains three components:

Infection mechanism

The infection mechanism is the component of a worm or virus that enables it to spread. It can exploit software vulnerabilities to connect to other systems, patch certain files, or alter start-up scripts.

Payload

This is the malicious part of the virus and contains the code that does the actual harm to the system such as uploading personal information or deleting files. In some cases, the payload may be a generic service that contacts a command and control server from which it gets specific instructions on what to do (e.g., mine cryptocurrency, send spam, participate in a DDoS attack).

Trigger

The trigger, also called a logic bomb, is code that is run whenever a file containing the virus is run. It makes the decision whether the payload should be executed. For example, some viruses may stay dormant until a particular date, number of runs, or upon getting directives from a command and control server.

Malware residence: where does it live?

File infector virus

A file infector virus is a virus that adds itself to an executable program. The virus patches the program so that, upon running, control will flow to the the virus code. Ideally, the code will install itself in some unused area of the file so that the file length will remain unchanged. A comparison of file sizes with the same programs on other systems will not reveal anything suspicious. When the virus runs, it will run the infector to decide whether to install itself on other files. The trigger will then decide whether the payload should be executed. If not, the program will appear to run normally.

Bootloader malware

Bootkits, also known as boot sector viruses, are malware that targets the booting process of a system. The malware has an infector that installs itself in the Master Boot Record (MBR) of a disk. In older BIOS-based PC systems, the first sector of the bootable storage device is read into memory and executed when the system boots, Normally, the code that is loaded is the boot loader that then loads the operating system. By infecting the master boot record, the virus can repeatedly re-infiltrate the operating system or files on the disk even if any malware on the system was previously detected and removed.

Boot sector viruses were common in the early days of PCs when users often booted off floppy disks and shared these disks. The virus would often use DOS commands to install itself onto other disks that it detects. Users on those systems had full administrative rights to modify any part of the system.

These viruses have diminished as attackers found more appealing targets. However, attacks on the bootloader are a continued threat. 2011 saw the emergence of ransomware that modified the boot loader to prevent the operating system from booting unless a ransom was paid. In 2016, Petya Trojan ransomware was deployed, which also infects the MBR and encrypts disk contents.

Infected flash drives

In the early days of PCs, people would share content by passing around floppy disks. This became a means for viruses to spread, which could be planted in either the boot sector or in files. These days, people share USB flash drives the way they used to share floppies.

Autorun

In earlier Windows systems, Microsoft provided a feature called AutoRun. It was designed to make the CD (and, later, DVD and flash drive) experience better for users, particularly when using CDs for software installation. If the CD contained a file called autorun.inf, Windows would automatically execute a program identified within that file. While this made the experience of figuring out what to do after a CD is inserted easier for most users, it created a horrific security vulnerability: all that an adversary had to do was to get you to insert the media. Moreover, this functionality worked with any removable storage so that inserting a flash drive would automatically run a program defined within autorun.inf on the drive.

Microsoft eventually removed this capability from flash drives but some manufacturers created USB drives that emulated a CD drive to offer the “convenience” of AutoRun. Microsoft ultimately removed this functionality altogether in Windows 7. However, there are still old, unpatched versions of Windows out there that can be exploited with this vulnerability.

A similar problem occurs in the KDE framework. KDE is a desktop environment widely used on Linux systems. Malicious .desktop and .directory files can be created to run malicious code. Whenever the user uses the KDE file viewer to navigate to the directory where these files are stored, the code contained within these files will execute without any user interaction. This problem has not been fixed as of August 2019.

USB Firmware

The more insidious problem with USB flash drives now is unprotected firmware. A USB flash drive is a bunch of memory as well as firmware – embedded software on the chip. The firmware runs when you plug the drive into your computer. It identifies the drive as a USB storage device and manages the transferring of data. You don’t see this firmware and cannot tell if it has been changed. Because the firmware defines what the USB device is, modified firmware on the flash drive could present the drive as a keyboard and send a set of keyboard commands to the host system (for example, commands to open the terminal window and delete files).

A USB device can have multiple profiles associated with it and thus present itself as multiple devices, so the flash drive can tell the computer it is a keyboard but also a flash drive, so the user will still be able to use the device as a storage device. The firmware could also modify file contents as they pass between the USB storage device and host computer. The same attack can be user on other USB devices. For example, an ethernet adapter can redirect network messages to an attacker’s site.

Reprogramming the firmware has not been exploited by malware thus far, at least not in a widespread manner, but the vulnerability has been demonstrated and the source code to do this is freely and readily available.

Data leakage

The most common problem with flash drives is their portability and small size: they are easy to lose and easy to borrow. This makes them vulnerable to data leakage, which is just a fancy term that means some adversary may access your data simply by borrowing your flash drive.

In 2016, researchers at the University of Illinois ran an experiment where they scattered nearly 300 USB drives in public areas through the campus. Each of those drives was loaded with files that, when opened on a network-connected computer, would contact a server to tell it that the drive has been picked up and the file was opened. The results of the study showed that 98% of the drives were picked up and someone opened up at least one file on 45% of them¹. Because of the risk of malicious firmware, even formatting a drive does not make it safe to use.

Inadvertent program execution

The portability of flash drives makes them a distribution mechanism. Experiments of scattering a number of them in parking lots revealed that many people are all too willing to plug a random drive into their system.

Even without automatic execution capabilities enabled, attackers can use flash drives as a distribution mechanism for malware. The Stuxnet attack exploited a windows bug in rendering shortcut icons where just viewing them in Windows Explorer enabled the execution of arbitrary code. Others have exploited a bug in video playback that allowed code execution. Even something as simple as an HTML file on a drive may direct the target to a website that can launch an attack.

There are many other USB device-based attacks. Take a look here if you’re curious.

Macro viruses

Some applications have support for macros, which allow the user to define a set of commands to avoid repetitive tasks and improve productivity. They are particularly common in text editors but are present in other applications as well, such as Photoshop and Microsoft Word and Excel. In some cases, as with Microsoft Office applications, macros are embedded in the document, which means they can be passed on to other users who access that document. Some macro capabilities are far more powerful than simply defining repetitive commands. Microsoft Office products, for example, provide Visual Basic scripting, which effectively allows users to embed complete programs into their documents. VBScript is based on Visual Basic and provides features that make it easy to access network printers, network files, special folders, user information, and even execute scripts on remote systems.

Scripts in Office documents can spread not only by having the user pass the original infected document around but by modifying the default template file, normal.dot. This will affect every other document on the system. With operating systems providing better access controls and users not running with administrative privileges, embedded scripts are a ripe area for attack. If you can convince somebody to open a document, they will run your program on their machine.

The challenge, of course, is to get a file with a malicious macro to target users and get them to open it. One of the most common techniques is to send it as an email attachment with some inducement to get the user to click on the document. This is an example of social engineering.

One hugely-successful virus that did this was the ILOVEYOU virus from 2000. The subject of the message stated that it is a letter from a secret admirer. The attachment wasn’t even a document; it was a visual basic script. To provide a better user experience, Microsoft would hide file extensions by default (macOS does this too). The file was named LOVE-LETTER-FOR-YOU.TXT.vbs but the .vbs suffix, which indicated that the file was a visual basic script, was hidden from users, so they only saw LOVE-LETTER-FOR-YOU.TXT. Not being aware of when extensions are hidden and when they are not, millions of users assumed they received an innocuous text file and clicked on it. Upon execution, the script would copy itself into various folders, modify and add new entries to the system registry, replace various types of files with copies of itself (targeting music and video files), and try to propagate itself through Internet relay Chat clients as well as email. If that wasn’t enough, it would download a file called WIN-BUGFIX.EXE and execute it. This was not a bug fixing program but rather a program that extracted user passwords and mailed them to the hacker.

The ILOVEYOU virus transmitted itself largely through email to contacts in infected computers, so your “secret admirer” message came from someone you knew and hence you were more likely to click on it. An earlier highly successful virus, Melissa, spread by offering a list of passwords for X-rated web sites. Email-based virus transmission is still a dominant mechanism. Sender headers and links are often disguised to make it look like the content is from a legitimate party.

JavaScript and PDF files

JavaScript, like Visual Basic, has evolved into a full programming language. Most browsers have security holes that involve Javascript. JavaScript can not only modify the content and structure of a web page but can connect to other sites. This allows any malicious site to leverage your machine. For example, systems can perform port scans on a range of IP addresses and report any detected unsecured services.

PDF (Portable Document Format) files, would seem to be innocent printable documents, incapable of harboring executable code. However, PDF is a complex format that can contain a mix of static and dynamic elements. Dynamic elements may contain Javascript, dynamic action triggers (e.g., “on open”), and the ability to retrieve “live” data via embedded URLs. As with Visual Basic scripts, PDF readers warn users of dynamic content but, depending on the social engineering around the file, the user may choose to trust the file … or not even pay attention to the warning in yet-another-dialog-box.

Trojans

A Trojan Horse is a program with two purposes: an overt purpose and a covert one. The overt purpose is what compels the user to get and run the program in the first place. The covert purpose is unknown to the user and is the malicious part of the program.

For example, a script with the name of a common Linux command might be added to a target user’s search path. When the user runs the command, the script is run. That script may, in turn, execute the proper command, leading the user to believe that all is well. As a side effect, the script may create a setuid shell to allow the attacker to impersonate that user or mail copy over some critical data. Users install Trojans because they believe they are installing useful software, such as an anti-virus tool (BTW, a lot of downloadable hacker tools contain Trojans: hackers hacking wannabe hackers). The side-effect of this software can activate cameras, enable key loggers, or deploy bots for anonymization servers, DDoS attacks, or spam attacks.

Trojans may include programs (games, utilities, anti-malware programs), downloading services, rootkits (see next) and backdoors (see next). They appear to perform a useful task that does not raise suspicion on the part of the victim.

For example, an April 2024 report showed that eight out of nine Pinyin apps, used to enter Chinese characters into mobile devices, are vulnerable to attacks that enable an attacker to capture keystrokes. These apps are used by 76% of keyboard app users in China.

Backdoors

A backdoor is software that is designed with some undocumented mechanism to allow someone who knows about it to be able to access the system or specific functions in a way that bypasses proper authentication mechanisms. In many cases, they are not designed for malicious use: they may allow a manufacturer to troubleshoot a device or a software author to push an update. However, if adversarial parties discover the presence of a backdoor, they can use it for malicious purposes. It is common for trojans to contain backdoors as part of the covert component.

An old, but famous, example of a backdoor is the sendmail mail delivery server. The author of sendmail wanted to have development access on a production system that had the program installed so that he can continue to improve it. The system administrator refused such access. His next release of sendmail contained a password-protected backdoor that gave him access to the system via the sendmail server. The password was hard-coded in the program and soon became well-known. Robert Morris used the knowledge of this backdoor as one of the mechanisms for his worm to propagate to other systems. More recently, in 2014, some Samsung Galaxy phones were delivered with backdoors that provide remote access to the data on the phone.

Example: the JAVS Viewer

As another example, let’s look at some of the basic eception techniques used in the JAVS Viewer. You’ve most likely never heard of this software, but it is used by courtrooms to record and play back audio and video from court proceedings. It is used in more than 10,000 courtrooms in the U.S. and 11 other countries.

In May of 2024, security researchers at Rapid7 reported that a version of the JAVS Viewer 8 available for download on the company’s website contained a backdoor that gives a threat actor access to devices that installed the software.

• The installer copied a binary file called fffmpeg.exe. Note that ffmpeg is the name of a popular video decoder. On casual inspection, one might not notice the extra f in the name and assume it’s simply a legitimate video decoder.
• The software was digitally signed but the certificate containing the public key was issued to a company called “Vanguard Tech Limited” and not the legitimate provider, which is “Justice AV Solutions Inc.”. Most users will just assume the software was signed by the legitimate publisher.
• When fffmpeg.exe runs, it connects to a command-and-control server using Windows Sockets and WinHTTP. Using HTTP for communications will often not cause intrusion detection services to detect suspicious activity. The command-and-control server is the remote service that will allow the attacker to dispatch commands to the infected clients that connect to it.
• fffmpeg.exe also downloaded a file named chrome_installer.exe. This also looks like a legitimate-sounding program, presumably one that downloads Google’s Chrome browser. In reality, it executes a binary program and several Python scripts that steal passwords saved in browsers.

You can read the full discussion here: Crooks plant backdoor in software used by courtrooms around the world.

Rootkits

A rootkit is software that is designed to allow an attacker to access a computer and hide the existence of the software … and sometimes hide the presence of the user on the system.

Historically, a basic rootkit would replace common administration commands (such as ps, ls, find, top, netstat, etc.) with commands that mimic their operation but hide the presence of intruding users, intruding processes, and intruding files. The idea is that a system administrator should be able to examine the system and believe that all is fine and the system is free of malware (or of unknown user accounts).

User mode rootkits

The rootkit just described is a user mode rootkit and involves replacing commands, intercepting messages, and patching commonly-used APIs that may divulge the presence of the malware. A skilled administrator may find unmodified commands or import software to detect the intruding software.

Kernel mode rootkits

A kernel mode rootkit is installed as a kernel module. Being in the kernel gives the rootkit unrestricted access to all system resources and the ability to patch kernel structures and system calls. For example, directory listings from the getdents64 system call may not report any names that match the malware. Commands and libraries can be replaced and not give any indication that malicious software is resident in the system.

Hypervisor rootkits

The most insidious rootkits are hypervisor rootkits. A hypervisor sits below the operating system and is responsible for translating between virtual device operations from operating systems and the underlying hardware. All I/O flows through the hypervisor. Most computer systems do not run virtual machines and hence have no hypervisor. These systems are prime targets for a hypervisor-based rootkit. Now you can have an environment where the entire operating system can run unmodified - or even be reinstalled - and be unaware that its operations are being intercepted at a lower level. The hypervisor does not have to virtualize all hardware interactions: just the ones it cares about. For example, it might want to grab keyboard events to record passwords and messages.

Hypervisor attacks have not been deployed but have been demonstrated as a proof of concept. The challenge in detecting their presence is that operating systems are unaware if they are running under a hypervisor, so if a malicious hypervisor is installed, the operating system needs to detect that it is running under a hypervisor rather than directly on the computer system. Detection is difficult and often relies on measuring completion times of certain system calls. If they go through a hypervisor, they will take a longer time and the on-chip Time Stamp Counter (TSC), which counts CPU cycles, will show a longer value with a hypervisor in place. An alternative, and far more obscure, method of detection, is the use of an instruction that stores the interrupt descriptor table register (IDTR) into a memory location (the SIDT instruction). The hypervisor changes the register’s value and the instruction can detect that. However, this does not have to take place on a system with only one operating system, so measuring timing differences may still be the more foolproof approach.

Ransomware

If we think back to the goals of malware, one common goal was to extract money: even hackers need to monetize their efforts. An indirect way of accomplishing this was by collecting information to gain access to bank account data, PayPal data, or modifying accounts that may take money, such as eBay accounts. A more direct way of getting money is to demand it from the victim. Ransomware is a relatively new form of malware that locks a computer, keeps it from booting, or encrypts all files on the system. It then asks the victim to pay a ransom (usually via bitcoin) to get a decryption program.

Gathering information

Malware has varying goals. These goals may include spying on user activity, destroying content, assembling a collection of servers, or extracting money from a victim. One common goal is to gather information … or get the user to provide information. Your computer might not have anything of direct value to an adversary, but your PayPal, bank, Amazon, or eBay credentials might be useful.

Phishing

Phishing is a social engineering attack whose most common purpose is to get personal information from someone, usually login credentials to some service. These are often carried out vie email with similar techniques that are used to spread infected files. A message announcing that your PayPal account is being canceled, that your bank detected a fraudulent transaction, or that FedEx could not deliver a package may prompt the receiver to panic and immediately click on a link in the message, which may result in the browser displaying a site crafted to look like PayPal, the bank, or FedEx and prompt the user for login and password information.

A 2023 OpenText Cybersecurity Threat Report identifies email phishing as the primary vector for infection (followed by accessing Microsoft’s Remote Desktop Protocol, RDP).

Phishing attacks are surprisingly effective. A 2018 study by Proofpoint found that 52% of all successful phishing emails are clicked on within one hour of being sent.

A 2017 report by Webroot found that 1.385 million new and unique phishing sites are created each month. Their 2019 report pointed out that phishing attacks increased 36 percent over 2018 and the number of phishing sites grew over 220 percent.

Spear phishing is a targeted form of phishing. A phishing attack sends the same message to a large set of users, hoping that some percentage of them will be fooled. A spear phishing attack sends a customized message that demonstrates some knowledge of the target, which will usually lead the target to think that the message is legitimate.

For example, the 2016 Democratic National Committee (DNC) was facilitated by spear phishing. Targets were sent a message containing bit.ly links, which is a common URL shortening service that hid the actual underlying URLs. Once clicked, the web site would display what looked like a legitimate Google accounts login page, already pre-populated with the victim’s GMail address.

More recent GMail spear phishing attacks send email to contacts of compromised accounts. The email contains an innocent-looking attachment: a thumbnail image of a document. When the victim clicks on the attachment, a web page that looks like a legitimate Google sign-in page is presented. As soon as the victim enters a name and password, the attackers get the credentials, log into the account, and target people in the victim’s contact list. They use an image of an actual attachment in the victim’s email and an actual subject line to make the email look more legitimate.

A recent example of a sophisticated spear phishing campaign is the attack conducted by the Advanced Persistent Threat (APT) group Midnight Blizzard, detailed in a report by Security Affairs. The group targeted over 100 organizations across multiple sectors. Attackers crafted messages that appeared to be from a trusted source, using tailored information to increase credibility. These emails contained links leading to websites that mirrored legitimate services, enticing recipients to provide sensitive information or download malware.

The 2023 OpenText Cybersecurity Threat Report states that spear phishing attacks account for 8.3% of all email traffic.

Phishing attacks have evolved significantly, becoming more personalized and harder to detect. Attackers now use generative AI to craft convincing messages that mimic legitimate communication, making it challenging for recipients to spot inconsistencies. This shift is aided by the vast amount of compromised personal data available, allowing attackers to tailor messages specifically to the recipient’s interests, activities, or affiliations. As a result, large-scale spear phishing campaigns can target individuals with a high degree of customization, increasing the likelihood of success.

Recently, attackers have begun embedding QR codes in phishing messages as an alternative to traditional links. By using QR codes, they bypass email filters that might otherwise detect or flag suspicious URLs. When recipients scan these codes, they are directed to malicious sites or applications without the protections that might be in place for regular links, making this tactic particularly effective at evading security systems and deceiving users.

Some warning signs that a mail message may be a phishing attack are:

1. From header: is it from an unknown or suspicious address?

2. To header: if the message is sent to multiple people, do you recognize any other names on the header?

3. Date header: if the message purports to be a personal message, was it sent during normal business hours?

4. Subject header: is the suspicious and is it relevant to your activities?

5. Message content: is the message a request to click on a link in order to avoid a negative consequence?

6. Embedded links: are there any links that you are asked to click? If you look at the target of those links, are they misspelled, suspicious, or for a site different from that of the sender?

7. Attachments: is there an unexpected attachment that you are expected to open, such as a Microsoft Word document or PDF file?

Embedded URLs

Astute users who are aware of phishing attacks have become accustomed to examining the targets of a link rather than just blindly clicking on a link (unfortunately, this may not be possible on mobile devices in many cases). If the link looks suspicious, the likelihood of it being clicked diminished. In addition to setting up misspelled and authentic-sounding domain names, attackers found it convenient to simply use URL shortening services, such as bit.ly. For example, a link to poopybrain.com may appear suspicious but a link to https://bit.ly/30zQv0u disguises the target and users are accustomed to receiving shortened URLs for legitimate content.

Mail servers, such as Microsoft’s Office 365 service, build up lists of known malicious links and attackers need to get through those systems. They recently realized that they could get around filtering services by using IP addresses instead of domain names in URLs. On top of that, the IP address need not be presented in the standard dotted-decimal notation but may be in octal or hexadecimal as well as non-dotted formats. All of the following addresses are equivalent:

Voice phishing

The huge shift to work-at-home environments in 2020 led to attackers trying to get access credentials to corporate networks from employees working from home. One technique that was created was voice phishing.

A voice phishing attack involves an attacker contacting employees at home and using pretexting to convince them that they are calling from the company’s IT department to troubleshoot connectivity problems on the corporate VPN. The attacker may create plausible-looking LinkedIn profiles to help in this deception.

In its simplest form, the attacker may simply obtain access credentials via the voice call. To improve the odds of success, attackers have created phishing pages that look like they belong to many of the world’s biggest companies. These pages request login credentials, including one-time passwords or any special access codes required by the company. When an victim enters data in that page, the attacker can immediately log into the corporate network.

Calendar injection

A social engineering attack that has gained popularity in 2020 and the expanded use of video conferencing is calendar injection.

An attacker inserts a calendar event into the victim’s calendar. The event is a plausible-sounding video conference (think of topics such as staff meeting, all-hands meeting, company update, performance review, or corporate restructuring and workforce adjustment). When the victim clicks on the link, the browser may present a dialog box asking the user for permission to “open” the program needed to run the conference … or to download the conference program. These are expected events in normal conferences. In reality, of course, the link or the downloaded program will be malicious.

Attackers can install these injections via various forms of malware or via a malicious website that would download a calendar invitation. More commonly, the calendar event can be sent in a spoofed mail message and the mail client software may automatically parse the message, see the invitation, and add it to the calendar.

Deceptive web sites

Quite often, malicious links in phishing attacks direct the user to a web site in order to obtain their login credentials. These sites masquerade as legitimate sites. The Proofpoint study mentioned earlier found that for every legitimate website, there are 20 malicious sites that mimic it. This is known as typosquatting. Such sites can be masqueraded banking sites, Google/Microsoft/Apple authentication pages, videoconferencing plugin-software downloads, etc.

File serving sites, including those that host software or those that provide services such as PDF or mp3 conversion are often ad-sponsored. Some of the ads on these sites, however, often look like download links and can trick a user into clicking on the ad instead of the link for the actual content. The

Keyloggers

Another way of obtaining information is to snoop on a user’s actions. Keyloggers record everything a victim types and allow a user to extract login names, passwords, and entire messages.

Keyloggers can be implemented in several ways:

Malicious hypervisor

Since a hypervisor provides virtual interfaces for all the resources of a computer, it can capture all keyboard, mouse, and even video data. These attacks are difficult since they rely on the ability to install a hypervisor.

Kernel-based rootkit

All input/output operations go through the operating system kernel. Modifying the kernel allows malicious software to log and upload keystroke data.

System call hooking

Some operating systems provide a system call hooking mechanism that allows data to and from system calls to be intercepted. We saw how this was used to implement sandboxing. Windows enables this without having to install any kernel-level drivers. The SetWindowsHookEx system call can be used to report WH_KEYBOARD and WH_MOUSE events, capturing keyboard and mouse activity.

Browser-based logging

JavaScript can be used to capture onKeyUp() events. These events will be captured for one page but other hacks can be used to create a broader context with embedded pages. Form submission can also be intercepted to get populated form data without having to reassemble key presses into coherent account credentials.

Hardware loggers

Although visible to the user, hardware key loggers can be used for USB-connected keyboards. Some of these have embedded Wi-Fi transceivers that enable an attacker to collect the data from a distance.

Defenses

Malware was particularly easy to spread on older Windows systems since user accounts, and hence processes, ran with full administrative rights, which made it easy to modify any files on the system and even install kernel drivers. Adding file protection mechanisms, such as a distinction between user and administrator accounts added a significant layer of protection. However, malware installed by the user would run with that user’s privileges and would have full access to all of a user’s files. If any files are read or write protected, the malware can change DAC permissions.

Systems took the approach of warning users if software wanted to install software or asked for elevated privileges. Social engineering hopes to convince users that they actually want to install the software (or view the document). They will happily grant permissions and install the malware. MAC permissions can stop some viruses as they will not be able, for instance, to override write permissions on executable files but macro viruses and the user files are still a problem.

In general, however, studies have shown that by simply taking away admin rights (avoiding privilege escalation) from users, 94% of the 530 Microsoft vulnerabilities that were reported in 2016 could be mitigated and 100% of vulnerabilities in Office 2016 could be mitigated.

Anti-virus (anti-malware) software

There is no way to recognize all possible viruses. Anti-virus software uses two strategies: signature-based and behavior-based approaches.

With signature-based systems, anti-virus programs look for byte sequences that match those in known malware. Each bit pattern is an excerpt of code from a known virus and is called a signature. A virus signature is simply a set of bytes that make up a portion of the virus and allow scanning software to see whether that virus is embedded in a file. The hope is that the signature is long enough and unique enough that the byte pattern will not occur in legitimate programs. This scanning process is called signature scanning. Lists of signatures (“virus definitions”) have to be updated by the anti-virus software vendor as new viruses are discovered. Signature-based detection is used by most anti-virus products.

With Heuristic analysis, the system monitors the activities of a process (typically the system calls or standard library calls that it makes). This is a behavior-based technique.

With static heuristic analysis, the potentially malicious code is not run but is decompiled to source code. The source code is compared with source code in a database of known malicious code. The analyzer looks for suspicious operations, such as attempts to access specific files, certain system calls, use of packers, attempts to create self-modifying code. Each of these can increase the “score” of the item being scanned. If the score is high enough, it can be market as suspicious.

With dynamic heuristic analysis, the code is executed. Some form of isolation is required. Sandboxing is usually employed, to ensure that the suspected code is run within a sandbox or even in an interpreted environment within a sandbox to ensure that it cannot cause real damage. Behavior-based systems try to perform anomaly detection. If the observed activity is deemed suspicious, the process is terminated and the user alerted. Sandboxed, behavior-based analysis is often run by anti-malware companies to examine what a piece of suspected malware is actually doing and whether it should be considered to be a virus. A behavior-based can identify previously-unseen malware but these systems tend to have higher false positive rates of detection: it is difficult to characterize exactly what set of operations constitute suspicious behavior.

Windows Defender, as an example, makes use of both signature-based scanning, static heuristic analysis, as well as dynamic process monitoring. It uses signature-based scanning on files and behavior-based analysis for running processes. Behavior monitoring includes scanning for suspicious file and registry changes (e.g., ransomware may try to encrypt all the files on a system and a lot of malware may try to modify the registry so that the software runs when the system is rebooted.

Countermeasures

Some viruses will take measures to try to defend themselves from anti-virus software.

Signature scanning countermeasures

A common malware tactic is to use a packer on the malicious payload, unpacking it prior to execution. Packers play a crucial role in malware evasion techniques. A packer is a type of software used to compress and/or encrypt the malicious code in a file to change a virus’s signature.

Packing can done in several ways:

• Compress the code and then uncompress it upon loading it prior to execution. One can scan for a signature of a compressed version of the virus, but there are dozens of compression algorithms around, so the scanning process becomes more complicated.
• Simply obscure the malware payload by exclusive-oring (xor) with a repeating byte pattern (exclusive-oring the data with the same byte pattern reconstructs it. This is a simple version of a stream cipher.
• Encrypt the code and decrypt it prior to execution.

With encryption (xor is a simple form of encryption), only the non-encrypted part of the virus contains the unpacking software (decryption software and the key). A virus scanner will need to match the code for the unpacker component since the key and the encrypted components can change each time the virus propagates itself.

Polymorphic viruses mutate their code each time they run while keeping the algorithm the same. This involves replacing sequences of instructions with functionally-identical ones. For example, one can change additions to subtractions of negative numbers, invert conditional tests and branches, and insert or remove no-op instructions. This thwarts signature scanning software because the the byte pattern of the virus is different each time.

Access control countermeasures

Access controls help but do not stop the problem of malware. Containment mechanisms such as containers work well for server software but are usually impractical for user software (e.g., you want Microsoft Word to be able to read documents anywhere in a user’s directories). Application sandboxing is generally far more effective and is a dominant technique used in mobile software.

Trojans, deceptive downloads, and phishing attacks are insidiously difficult to defend against since we are dealing with human nature: users want to install the software or provide the data. They are conditioned to accepting pop-up messages and entering a password. Better detection in browsers & mail clients against suspicious content or URLs helps. However, malware distributors have been known to simply ask a user to rename a file to turn it into one that is recognized by the operating system as an executable file (or a disk image, PDF, or whatever format the malware come in and may otherwise be filtered by the mail server or web browser.

Sandboxing countermeasures

Viruses are unlikely to get through a sandbox (unless there are vulnerabilities or an improper configuration). However, there are areas where malware can address sandboxing:

1. Vendor examination
   Anti-virus vendors often test software within a tightly configured sandboxed environment so they can detect whether the software is doing anything malicious (e.g., accessing files, devices, or the network in ways it is not supposed to). If they detect that they do have malware, they will dig in further and extract a signature so they can update and distribute their list of virus definitions. Viruses can try to get through this examination phase by setting a trigger to keep the virus from immediately performing malicious actions or to stay dormant for the first several invocations. The hope is that the anti-virus vendors will not see anything suspicious and the virus will never be flagged as such by their software.

2. User configuration (entitlements)
   Virtually all mobile applications, and increasingly more desktop/laptop applications, are run with application sandboxes in place. These may disallow malware from accessing files, devices, or the network. However, it never hurts to ask. The software can simply ask the user to modify the sandbox settings. If social engineering is successful, the user may not even be suspicious and not wonder why a game wants access to contacts or location information.

Honeypots

Honeypots in Computer Security

Honeypots in computer security are decoy systems, applications, or data set up to gather information about attackers and their methods. They are designed to mimic real systems that attackers might target, but they’re isolated and monitored environments. Some ways that honeypots are used are:

Detection

Honeypots can detect malicious activity by monitoring for interactions that should only occur if an entity is attempting to probe, attack, or compromise a system. Diversion

By engaging attackers with fake systems, honeypots can divert their attention from real targets, potentially preventing actual breaches. Information Gathering

Since honeypots are designed to be attacked, they provide a valuable source of information about how attackers operate, including the tools they use, the vulnerabilities they exploit, and the types of data they seek. Research

Researchers use honeypots to study the behavior of cyber threats in a controlled environment. This research can lead to better defenses and understanding of cybercriminal tactics. Improving Security Response

The insights gained from honeypot interactions can help organizations improve their security posture. This includes refining security policies, patching vulnerabilities, and enhancing detection capabilities. Training

Honeypots offer a real-world environment for cybersecurity professionals to train in detecting and responding to threats without the risk of damage to the actual network.

There are various types of honeypots, ranging from low-interaction honeypots, which simulate only the services frequently scanned by attackers, to high-interaction honeypots, which are complex and fully-functional systems designed to engage attackers more deeply. The choice between them depends on the specific goals, such as whether the focus is on gathering intelligence or on diverting attackers from more valuable assets.

References

• 2022 BrightCloud® Threat Report, BrightCoud Threat Intelligence.

• Fedor Sinitsyn, Petya: the two-in-one trojan, SecureList, May 4, 2016

• hasherezade, Petya – Taking Ransomware To The Low Level, Malwarebytes Labs, April 1, 2016

• Don’t Panic, But All USB Devices Have a Massive Security Problem, How-To Geek, 2014.

• Hackers Exploit Legitimate Packer Software to Spread Malware Undetected, The Hacker News, June 6, 2024.

• Lavasoft, LNK Exploits, 2010

• IEEE Spectrum, The Real Story of Stuxnet, February 2013.

• Trend Micro SimplySecurity, Macro Malware: Here’s what you need to know in 2016, March 2016

• SANS, PDF Malware Overview, July 2010.

• George Ou, Blue Pill: The first effective Hypervisor Rootkit, ZDNet, August 15, 2006

• DataBreachToday. “Malicious Python Package Exfiltrates AWS Credentials”

• Fortinet. “Malicious Packages Hidden in PyPI”

• SentinelOne. “Exploiting Repos: 6 Ways Threat Actors Abuse GitHub & Other DevOps Platforms”

• Wikipedia. “XcodeGhost”