-: Malware. 2 2
In this lesson, 3 3
we're going to discuss some different types 4 4
of malware that you may come across 5 5
while working as a cyber security or network technician. 6 6
So, what is malware? 7 7
Well, malware is a shorthand term for malicious software. 8 8
This is software that's designed 9 9
to infiltrate a computer system 10 10
and possibly damage it without 11 11
the user's knowledge or consent. 12 12
Simply put, malware is some kind of bad software code 13 13
that wants to do harm to our computers and our networks. 14 14
Malware comes in many varieties, including viruses, worms, 15 15
Trojan horses, ransomware, spyware, and rootkits. 16 16
The first type of malware we have is known as viruses. 17 17
A computer virus is simply made up of malicious code 18 18
that's run on a machine without the user's knowledge. 19 19
This code allows it to infect the computer 20 20
whenever that code is run. 21 21
Now, what does this look like in the real world? 22 22
Well, one of your users may have gone 23 23
to a website to download a new game, 24 24
and when they did that, 25 25
they actually download an installation file 26 26
that contained a virus or malicious code inside of it. 27 27
When they ran that program to install the game, 28 28
they actually just installed the virus onto 29 29
the client machine, 30 30
and now, that virus has taken hold. 31 31
At this point, 32 32
the virus is going to want to reproduce and spread, 33 33
and it does this because you had a user action occur. 34 34
This was namely the opening 35 35
and running of the game's install file. 36 36
Once this has been done, 37 37
the virus can now begin to replicate 38 38
and attempt to spread further across the network. 39 39
Our second type of malware is known as a worm. 40 40
Now a worm is a piece of malicious software, 41 41
much like a virus. 42 42
But it can replicate itself without any user interaction. 43 43
This is a key distinction between a virus and a worm. 44 44
Remember, I said the user had 45 45
to install the program or open a file 46 46
in order to have the virus take action 47 47
and begin its replication. 48 48
But with worms, this simply isn't the case. 49 49
Worms are able to self-replicate 50 50
and they spread throughout your network 51 51
without a user's consent or action. 52 52
This occurs because worms take advantage 53 53
of security vulnerabilities that exist 54 54
within operating systems, 55 55
network protocols, and other applications. 56 56
If the warm determines 57 57
that there is a computer on the network 58 58
that doesn't have the latest security patch installed, 59 59
it can then take advantage of that 60 60
and exploit that vulnerability 61 61
to spread from victim to victim across the entire network, 62 62
or even across the internet and the entire world. 63 63
Because of this, 64 64
worms can cause disruption to your normal network traffic 65 65
and your computing activities, 66 66
because as they're spreading and replicating 67 67
from victim to victim, 68 68
they're also using its processing power, 69 69
its memory, and its network traffic, 70 70
it's going to be using all these different resources, 71 71
and not for something that you want them to do. 72 72
Eventually, this can start slowing down your systems, 73 73
or in some cases, 74 74
it can cause your systems or your networks to crash. 75 75
Worms are known for spreading far and wide over 76 76
the internet in a relatively short amount of time. 77 77
Back in 2001, there was a worm named Nimda, 78 78
which is admin spelled backwards. 79 79
Now it was able to propagate across 80 80
the entire internet in just 22 minutes. 81 81
Then in 2009, we had another worm. 82 82
This one was known as Conficker. 83 83
This was probably one of the largest worms 84 84
that we as cybersecurity professionals 85 85
have seen to date. 86 86
Conficker was able to infect between nine 87 87
and 15 million machines worldwide. 88 88
This worm was infecting as many machines 89 89
as it could by leveraging exploit 90 90
against a missing Microsoft Windows security patch. 91 91
This was specifically the patch associated 92 92
with the MS-08-067 eight security bulletin. 93 93
Now, the vulnerability was a coding error 94 94
with the way Microsoft Windows 95 95
was performing file and printer sharing. 96 96
Conficker sought out those machines 97 97
that were missing the security patch, 98 98
installed this piece of code on them, 99 99
and then those machines became part of a botnet. 100 100
Ultimately, this botnet was able 101 101
to be shut down before it was used 102 102
for negative or malicious purposes, 103 103
but it does show the true power of these worms, 104 104
and how they can gather up lots 105 105
and lots of zombies for a botnet really quickly 106 106
for use later on. 107 107
The third type of malware we have 108 108
is known as a Trojan horse. 109 109
A Trojan horse gets his name 110 110
from the legendary trick that was used during 111 111
the Trojan War back in ancient Greece. 112 112
Greece and Troy were at war for 10 years, 113 113
and there was no end in sight. 114 114
After a long siege, 115 115
the Greeks decided they were getting restless, 116 116
and they decided they wanted 117 117
to try something a little different 118 118
to get this war over with. 119 119
So, they decided to construct a large wooden horse, 120 120
and they gave it to the city of Troy as a peace offering, 121 121
or so the story goes. 122 122
Now, this seemingly harmless gift 123 123
was actually filled with Greek soldiers. 124 124
And once it was wheeled inside the city, 125 125
day turned to night, 126 126
and the soldiers emerged from within the horse. 127 127
These soldiers immediately opened 128 128
the walled city gates and began letting 129 129
in their fellow soldiers 130 130
that were from the invading Greek army. 131 131
They got into the city and they laid waste to it. 132 132
This was the first example of a Trojan horse. 133 133
Now in the world of cybersecurity and computer networking, 134 134
Trojan horses work much the same way. 135 135
Trojan horses are pieces of malicious code 136 136
that's disguised as a piece of harmless 137 137
or desirable software. 138 138
Basically, a Trojan says I'm going 139 139
to perform this function for you. 140 140
And it may very well perform that desired function. 141 141
But it can also perform a malicious function too. 142 142
Now, when I was a kid, 143 143
there was a new game out called Tetris 144 144
that you probably have heard of at this point, 145 145
and it was extremely popular, 146 146
everybody wanted to get a copy of it. 147 147
So a lot of times, 148 148
you might have a friend who put a copy of it 149 149
on a disc, and they handed it to you so you can install it 150 150
at home, and you could play this great new game to. 151 151
Well, one person was really smart 152 152
and they used a copy of Tetris 153 153
and embedded a Trojan horse inside that copy of Tetris. 154 154
Now, if you took that disc and installed 155 155
that game on your computer, 156 156
that game would launch and play just like normal. 157 157
You could play Tetris, no issue at all. 158 158
But in the background, the Trojan horse part of this, 159 159
opened up something that allowed a connection 160 160
between your system and the attacker's system, 161 161
allowing them to have remote control 162 162
and steal your information or destroy your data. 163 163
This is one of the earliest examples 164 164
of what we now refer to 165 165
as a RAT, or Remote Access Trojan. 166 166
A RAT is a common type of Trojan 167 167
that's still widely used today. 168 168
It provides the attacker with remote control 169 169
of a victim system. 170 170
These techniques are still really used a lot today, 171 171
but instead of somebody handing you a disc, 172 172
they instead post the file 173 173
on a website and they wait for you to download it. 174 174
Remember, whenever you're downloading 175 175
a program from the internet, 176 176
always be careful, 177 177
because you don't know what other code 178 178
is inside of that lurking there. 179 179
Anytime you or your users are downloading a file, 180 180
you have to make sure you check it for viruses, worms, 181 181
and Trojans before you install it. 182 182
The fourth type of malware we have is known as ransomware. 183 183
If you've watched the news 184 184
or scrolled Facebook in the last year or two, 185 185
you probably already know what ransomware is 186 186
because it keeps showing up all over our news feeds. 187 187
Ransomware is a type of malware 188 188
that restricts access to a victim's computer system 189 189
or their files until a ransom or payment is received. 190 190
Essentially, someone's going to break into a network, 191 191
a server or a computer, 192 192
and then they're going to encrypt all 193 193
the files or change the passwords, 194 194
or do something else to hold that system hostage 195 195
until you pay up. 196 196
One day, you may reboot your computer 197 197
and it says something like this, 198 198
your computer has been locked. 199 199
You have to pay a fine of $200 200 200
and be able to pay it through this link using Bitcoin 201 201
and able to get access back. 202 202
If you pay me, 203 203
I'll give you a secret unlock code, 204 204
and you can put it in that white box, 205 205
and you can hit OK, and have access to all your stuff. 206 206
This is what ransomware looks like 207 207
when it targets end users. 208 208
But even more recently, 209 209
we're seeing large-scale ransom attacks 210 210
against large corporations and local governments, 211 211
including oil pipelines, 212 212
hospital systems, and even city governments. 213 213
Back in 2018, the city of Atlanta 214 214
got infected with the SamSam ransomware. 215 215
This started spreading across 216 216
a lot of their systems throughout the city, 217 217
and it ended up costing them over $17 million to fix it. 218 218
They ended up not paying the ransom, 219 219
but instead, they spent about $6 million 220 220
in services and contracts and software upgrades, 221 221
and another $11 million in hardware upgrades 222 222
to be able to deal with the SamSam ransomware. 223 223
This made it the costliest cyber attack 224 224
affecting the government in 2018. 225 225
And this was despite them not paying 226 226
the ransom demanded by the attackers. 227 227
Usually, ransomware is going to get 228 228
a foothold into your network somewhere 229 229
because of a vulnerability 230 230
in a piece of software on one 231 231
of your servers or your clients. 232 232
Once it gets into the network though, 233 233
it's going to attempt to steal your data 234 234
and hold it hostage. 235 235
Once they do that, 236 236
you have no way to decrypt that data 237 237
unless you pay the ransom or restore from an offline backup. 238 238
The fifth type of malware we have is known as spyware. 239 239
Spyware is a type of malicious software 240 240
that's installed on your system, 241 241
and it gathers information about you without your consent. 242 242
Normally, this will be installed either 243 243
from a website or some third-party software 244 244
that you have installed on your system. 245 245
That software is going to look through all your files. 246 246
It's going to look through all your emails, 247 247
all of your instant messages, 248 248
all your calendar invites, 249 249
and what other information you may have on your system, 250 250
it's going to look through that together information 251 251
and build a profile on you. 252 252
This is the best case scenario. 253 253
Now, after all, 254 254
spyware may just be trying to figure out things 255 255
they can advertise to you. 256 256
And in this case, 257 257
we call this a thing called adware. 258 258
Now, this allows you to display advertisements 259 259
to you based on what they think you'd like best 260 260
and what you're most likely to buy. 261 261
Now, in the worst case, 262 262
spyware could include a key logger. 263 263
Now, a key logger can allow an attacker 264 264
to capture any keystrokes you make on a victim machine, 265 265
such as the website addresses you type in, 266 266
the usernames, and even the password you enter. 267 267
Spyware and key loggers 268 268
can collect those details 269 269
and send it all back to the attacker, 270 270
complete with screenshots that they're taking 271 271
on a regular interval of your computer screen. 272 272
Now our sixth type of malware we have 273 273
is known as a rootkit. 274 274
A rootkit is a specific type of software 275 275
that's designed to gain administrative level control 276 276
over a computer system or network device 277 277
without being detected. 278 278
Now, this is really important 279 279
because when we talk about root 280 280
or administrator level permissions, 281 281
this is the highest level of permissions 282 282
that someone can have on a system. 283 283
If you're using a Windows machine, 284 284
for example, that will be your administrator account 285 285
that allows somebody to install programs, 286 286
delete programs, open ports, and shut ports. 287 287
Basically, they can do whatever they want on your system. 288 288
This type of access is known as root access 289 289
if you're using Unix, Linux or OS X, 290 290
which is a Mac operating system. 291 291
Either way, gaining administrative 292 292
or root access is great for an attacker, 293 293
but it is horrible for you and your security. 294 294
Now in our networks, 295 295
the most common place to find a rootkit would be 296 296
if the attacker was able 297 297
to compromise the firmware on our routers or switches. 298 298
There have been documented cases 299 299
of this for pretty much every brand 300 300
of router and switch out there. 301 301
So it's important to keep up to date 302 302
with the latest threats based 303 303
on the type of equipment 304 304
that you're using inside your networks. 305 305
Rootkits are extremely powerful, 306 306
and they're really difficult 307 307
to detect, because the operating system itself 308 308
can be blinded to them, 309 309
since they're loaded before the operating system itself is. 310 310
To detect them, the best way is to boot 311 311
from an external device, 312 312
and then scan the device to ensure 313 313
that you can probably detect those rootkits. 314 314
As I said earlier in this lesson, 315 315
there are lots of different types of malware. 316 316
In this lesson, we discussed just a few of them. 317 317
We talked about viruses and worms, and Trojan horses, 318 318
and ransomware, and spyware, and rootkits. 319 319
But there are many others out there 320 320
that you're going to learn 321 321
about as you continue 322 322
to advance in your cybersecurity career. 323 323
(offbeat motivating music)