Cybersecurity Fundamentals: Malware, Viruses, Worms, and APTs

Some of the designs that took priority over cybersecurity in early internet

Cost, Speed, Convenience, Open Architecture, Backwards Compatibility

Some early cybersecurity roadblocks

No metrics to measure insecurity,

internet is international,

Private sector owns most of the infrastructure,

cost effectiveness/ incentive to secure the web

The Achilles Heel of the internet

Asymmetric cyberattacks

cybersecurity; ie Information security

The protection of information against unauthorized disclosure, transfer, modification, or destruction, whether accidental or intentional

Corporate cybersecurity

Availability, integrity, and secrecy of information systems and networks in the face of attacks, accidents and failures with the goal of protecting a corporations operations and assets

national cybersecurity

availability, integrity and secrecy of the information systems and networks in the face of attacks, accidents, and failures with the goal of protecting a nations operations and assets

Four factors that must be understood to achieve cybersecurity success

Technology, Economics (of stakeholders and incentives), Social Influences, and Public Policy

Cybersecurity infrastructure

equipment that is integral to research and education capabilities in cybersecurity, and technology support staff that is integral to research and education capabilities in cybersecurity

Malware

A program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victims data, applications, or operating system or otherwise annoying or disrupting the victim.

Backdoor

Any mechanisms that bypasses a normal security check, it may allow unauthorized access to functionality in a program, or onto a compromised system

Virus

Malware that, when executed, tries to replicate itself into other executable machine or script code. when it succeeds the code is said to be infected, when the infected code is executed, the virus executes and continues replicating.

Worm

A computer program that can run independently and can propagate a complete working version of itself onto other hosts on a network, usually by exploiting software vulnerabilities in the target system

Trojan horse

A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the malicious program

Bot / zombie

Program activated on an infected machine that is activated to launch attacks on other machines

Adware (Malvertizing)

Advertizing that is integrated into software. It can result in popup ads or redirection of a browser to a commercial site

Auto Rooter

Malicious hacker tools used to break into new machines remotely

Downloaders

Code that installs other items on a machine that is under attack. It is normally included in the malware code first inserted on to a compromised system to then import a larger malware package

Flooders (DoS client)

Used to generate a large volume of data to attack networked computer systems, by carrying out some form of denial-of-service attack.

Keyloggers

Captures keystrokes on a compromised system

Malware is classified by

First, on how it spreads or propagates to reach the desired targets,

then, on the actions or payloads it performs once a target is reached

Attack Kits

The software that handles the development and deployment of malware

Attack Sources (Attackers)

Politically motivated attackers, Criminals, Organized crime, Organizations that sell services to companies and nations, National government agencies

Advanced Persistent Threats

Well resourced, persistent application of a wide variety of intrusion technologies and malware to selected targets

APT Attacks

Vary from theft of intellectual property or data, use social engineering, phishing emails, and drive by downloads, and intend to infect the target with sophisticated malware with multiple propagation mechanisms and payloads

Dormant Virus phase (not all viruses)

Virus is idle, It will eventually be activated by some event

Triggering virus phase

Virus is activated to perform its function, Can be caused by a variety of system events

Propagation virus phase

Virus places a copy of itself into other programs, May not be identical to the propagating version, Each infected program will now contain a clone of the virus which will start another propagation phase

Execution virus phase

Function is performed and executed, which may be harmless, but could also be damaging

Macro virus

A virus that attaches itself to documents and uses the macro programming capabilities of the documents application to execute and propagate

Virus Classification by Target: Boot sector infector

Infects a master boot record and spreads when a system is booted from the disk containing the virus

Virus Classification by Target: File infector

Infects files that the operating system considers to be executable

Virus Classification by Target: Macro virus

Infects files with macro or scripting code

Virus Classification by concealment strategy: Encrypted virus

A portion of the virus creates a random encryption key and encrypts the remainder of the virus

Virus Classification by concealment strategy: Stealth virus

A form of virus explicitly designed to hide itself from detection by anti virus software

Virus Classification by concealment strategy: Polymorphic virus

A virus that mutates with every infection

Virus Classification by concealment strategy: Metamorphic virus

A virus that mutates and rewrites itself completely at each iteration and may change behavior as well as appearance

Worm Target Discovery: Scanning (Fingerprinting)

First function in the propagation phase for a network worm, it searches for other systems to infect

Worm Target Discovery: Random

Each compromised host probes random addresses in the IP address space

Worm Target Discovery: Hit-List

The attacker first compiles a list of vulnerable systems, then begins infecting machines on that list, each infected machine is provided with a portion of the list to scan

Worm Target Discovery: Topological

This method uses information contained on an infected victim machine to find more hosts to scan

Worm Target Discovery: Local subnet

If a host can be infected behind a firewall, the host then looks for targets in its own network, the host uses the subnet address to find other hosts that would otherwise be protected by the firewall

Morris Worm

The earliest significant infection of this kind, made and released by Robert Morris in 1988 it was designed to spread on UNIX systems, where successful attacks got communication with the OS and command interpreter

WannaCry

Ransomware attack that spread as a worm in may 2017 that spread fast over days, infecting hundreds of thousands of both public and private systems. once installed, it encrypted files, then required a ransom payment to recover them.

Mobile Code

Programs that can be used unchanged on many different platforms and executed with the same results

Mobile Phone Worms

Can communicate through Bluetooth wireless connection and MMS where the target IS the device. It can completely disable the device, delete data, or force the device to send costly messages.

Drive by Downloads

Exploits browser and plugin vulnerabilities so when the user views a webpage, it contains code that installs malware on the system without the users knowledge.

Watering-Hole Attacks

A variant of drive by downloads, the attacker researches their intended victims to find which websites they are likely to visit, then implements vulnerabilities in these sites.

Clickjacking

A vulnerability used by an attacker to collect an infected user's clicks

Social engineering

Tricking users to assist in the compromise of their own systems

Payload system corruption

Causes real world damage to physical equipment, concerns about this being used for industrial sabatoge

First Generation Anti-Virus Software

Scanners: Requires a malware signature to identify the malware, and is limited to the detection of known malware

Second Generation Anti-Virus Software

Heuristic scanners: Uses heuristic rules to search for probable malware instances

Third Generation Anti-Virus Software

Activity Traps: programs that identify malware by its actions rather than its structure in an infected programs

Fourth Generation Anti-Virus Software:

Full featured protection: Packages consisting of a variety of anti-virus techniques used in conjunction, Including scanning and activity trap components and access control capabilities

Sandbox Analysis

Running malicious code in a controlled environment like a VM for purpose of monitoring and detecting

Perimeter Scanning

Anti virus software typically included in email services, scans incoming and outgoing traffic as it leaves for suspicious behavior.

Cybersecurity Principles: Simplicity

Less to go wrong, fewer possible inconsistencies, easier to understand

Cybersecurity Principles: Restriction

Minimize access, inhibit communication

Principle of Least Privilege

A subject should be given only the privileges necessary to complete its task

Principle of Least Authority

Often considered the same as Principle of Least Privilege, give a subject the least amount of authority possible

Principle of Fail-Safe Defaults

The Default action is to deny access, if the action fails, the system locks into a secure state

Principle of Economy of Mechanism

Keep a software as simple as possible. Simpler means less can go wrong, and when errors occur they are easier to understand and fix.

Principle of Complete Mediation

Check every access permission, if permissions change after, may get unauthorized access

Principle of Open Design

Security should not depend of the secrecy of design. This does not mean that source code should be public, but instead means that the design should be so good, that even if you give out the design to the public, then it should still be secure

Principle of Separation of Privilege

Requires multiple conditions to grant access

Principle of Least Common Mechanisms

Mechanisms should not be shared. For example operating System Memory Isolation, since key pieces are kept apart, if one of them suffers a blow, then they are all not compromised

Principle of Least Astonishment

Security mechanisms should be designed so users understand why the mechanism works the way it does, and using the mechanism is simple

Principle of Psychological Acceptability

Security mechanisms should not add to difficulty of accessing resources. Related to Principle of Least Astonishment

The ______ dependence on the internet is a risk as security is not often a top priority of most of the communication and computing systems

Increasing

T/F: Many metrics exist to measure (in)security

True

T/F: Vulnerabilities are not just technical

True

_____: a program that is inserted into a system, usually covertly with the intent of compromising the confidentiality, integrity, or availability of the victims data, application , or operating system or otherwise annoying or disrupting the victim

Malware

The typical phases of a virus or worm are: dormant, propagation, triggering, and ______ phase

Execution

A ______ exploits browser vulnerabilities so that when the user views a page, it exploits a browser bug which allows itself to install malware on the system without the users knowledge

Drive By Download

A _____ is code embedded in the malware that is set to "explode" when certain conditions are met.

Logic Bomb

A _____ Captures keystrokes on the infected machine

Keylogger

Phishing

mass attack that sends the same fake message to many people

Spear Phishing

fake mail attack targeted at a specific person or organization, using personal details to make the message believable

A ______ is a set of programs installed on a system to keep access to the systems administrator privileges, while hiding evidence of its presence

Rootkit

The cybersecurity principles draw on the ideas of _____ and restriction

Simplicity

The cybersecurity principle that restricts how privileges are granted

Principle of Least Privilege

T/F: The Principle of Fail Safe Defaults states that unless a subject is given explicit access to an object, it should be allowed access to that object

False

The Principle of ______ implies that security should not depend of secrecy of design or implementation

Open Design

Principle of _____ often stresses the idea of "keep it as simple as possible"

Economy of Mechanism

In a UNIX system the access is checked only on startup, and not checked again after. What security principle is violated by the UNIX system here?

the Principle of Complete Mediation

T/F: The Principle of Fail Safe Defaults states that the default action is to deny access

True