2.4 An Overview of Malware

Malware

A broad term that refers to any type of software designed to cause harm or perform malicious actions on your system. It encompasses a wide variety of malicious activities, including:

• Information gathering: Can collect sensitive data, such as keystrokes, and send it back to attackers, often without the user's knowledge.

• Advertising: Some malware displays unwanted ads, where the attacker profits each time you view or interact with them.

• Viruses and worms: These types of malware replicate themselves and spread across systems

• Data encryption: Some malware, like ransomware, encrypts your files and demands payment for their release

Malware Types & Methods

• Viruses

• Worms

• Ransomware

• Trojan Horse

• Rootkit Keylogger

• Spyware

• Bloatware

• Logic bomb

How You Get Malware

Malware is rarely just a single event; different types of malware often work together to compromise your system.

• For example, a worm might exploit a known vulnerability in your system and install itself onto your storage drive. Once it’s in place, it can install other types of malware, like a remote access backdoor, giving attackers the ability to control your system and install additional malicious software.

For malware to infect your system, it must find a way to run. Common entry points include:

• You might click on a link or attachment in an email,

• Malicious pop-ups that appear when visiting a website

• Visiting a compromised or malicious website can cause malware to be automatically downloaded to your system without any action on your part. These are referred to as drive-by downloads.

Keep your operating system and applications updated.

Your Data Is Valuable

The primary reason malware exists is because data is incredibly valuable.

• Whether it's personal data, such as family photos, videos, and important documents

• Or organizational data, such as planning documents, employee Personally Identifiable Information (PII), financial records, or private company information

• Attackers may target this information directly, or they may use tactics like ransomware, where they encrypt your data and demand a ransom for its release

Ransomware

A type of malware that infects your system, encrypts your files (such as pictures, documents, music, and videos), and then demands payment in exchange for the decryption key needed to restore access to your files.

• The operating system remains functional, the attacker wants you to be able to see the ransom message, telling you that your system has been infected

• The payment is requested through an untraceable payment system, such as cryptocurrency, making it difficult to track the attacker.

• An unfortunate example of public-key cryptography being used maliciously

Protecting Against Ransomware

• Regularly back up your data, ideally with an offline backup. This ensures that if your system is infected, the ransomware won’t be able to access or encrypt the backup, giving you a way to restore your files without paying the ransom.

• Ensure all applications are updated with the latest security patches

• Keep your operating system up to date:

• Keep your anti-virus and anti-malware programs updated with the latest signatures