In this section of the course,
we're going to be covering malware.
So what exactly is malware?
Well, malware is a shorthand way
of talking about malicious software.
Malware is really any software that is designed
to infiltrate a computer system and possibly damage it
without the user's knowledge or consent.
When I think of malware, I like to think about it
as a broad category of software code that includes a lot
of bad things that are out there
on the internet that can harm our computers,
things like viruses, worms, Trojans, ransomware, spyware,
rootkits, spam, and much more.
But for the malware to infect your system,
it needs to be able to create a threat vector
and an attack vector.
Now, a threat vector is a specific method used
by an attacker to infiltrate a victim system.
Now, some examples
of threat vectors include unpatched software,
installing code using a USB thumb drive,
a phishing campaign where one of your users clicks
on a link to install some kind
of malware into your system and many other vulnerabilities
and exploits that can be taken advantage of.
Now, the second thing the attacker needs
in order to infiltrate your system is what's known
as an attack vector.
An attack vector is the means
by which the attacker is going to gain access
to that computer
in order to infect your system with malware.
Now, I know these two terms sound pretty similar
but there is a distinct difference between them.
When we talk about a threat vector, we are focused
on how the attacker plans to break into a given system.
But when we talk about the attack vector, we're talking
about both the way the attacker might get into your system
and how they're going to infect that system.
Now, let me provide you with a silly example
to hopefully clarify this concept a little bit.
Let's pretend for a moment that your house
is going to be our computer
and I have a cupcake and I want to represent that as malware
or malicious software, and I want to put that inside
of your house or inside of your computer.
Now, my job as the attacker is to get my cupcake
from my house over to your house
and onto your kitchen table.
If I can do that, we're going to say that I was successful
in my cupcake infiltration attack in this scenario
and I've infected your house
with this malware or this cupcake.
So your job now
as a cybersecurity professional is to stop me
from getting that cupcake
onto your kitchen table or in the real world,
you want to stop me from infecting your system with malware.
Now, the threat vector that I might choose could be
to drive right up to your house
because maybe your house isn't inside of a gated community
with a security guard patrolling the streets.
So you have a very unhardened system that might make it easy
for me to infiltrate and get into your house.
Now, in this example, that unguarded neighborhood
would be considered our threat vector.
Now, I know I can drive right over to your house
but I still need to determine the attack vector
that I'm going to use to get inside the house
and that way I can put my cupcake,
this malware, onto your kitchen table.
Now, if I decide that I want to walk up to your front door,
pick your lock and enter your house to place the cupcake
on your kitchen table, that entire sequence
of actions from walking to the door, picking the lock
and entering the home would be considered my attack vector.
That's the difference
between the threat vector and the attack vector.
It's the vulnerabilities that could be exploited
and the way that they're actually going to be exploited.
Now, let's go back to the world of computers
for a moment.
Let's pretend that you have an older computer
that's running Windows 10
and you haven't bothered installing
or downloading the latest security patches
because you've just been busy and you haven't had time to.
Well, maybe it's been a really long time
since you've installed those patches,
that it's been three months or six months, or 12 months,
and now you have a computer
that is missing a critical security patch,
like the MS17-010 security patch
from Microsoft that came out all the way back in 2017
to patch the EternalBlue vulnerability.
Now, this unpatched vulnerability represents a threat vector
but I still don't have an attack vector quite yet.
Now, as an attacker, my goal is to infect as many systems
as possible using this vulnerability.
That way I can gain access to all of them.
So I'm going to sit here all day scanning the internet
and try to identify any unpatched computers that are online.
And once I do that, I can then attack that system
because that missing security patch is going to be vulnerable
for that system
and I already have a known exploit that I can plug
against your system to be able to break in because the file
and printer services that operate over the SMB Protocol
are vulnerable on your system
because you're missing that security patch.
Now, once I find this vulnerable computer,
I can run this exploit to gain access
to the vulnerable machine
and install some kind of malware on it.
This entire series of events I just talked about
can now be referred simply as my attack vector.
This attack vector is the exact same one
that was used widely by the WannaCry ransomware
to wreak havoc across the internet.
With the WannaCry ransomware,
the attackers ran automated scans all day
and all night to find as many unpatched Windows machines
running Windows 7, Windows 8, Windows 8.1, and Windows 10.
And when they found those systems
that were missing that patch, MS17-010 dash,
they ran an exploit against it
to gain administrative rights over that system.
Then they would encrypt the user's files
and display a message on the user's screen
saying your computer is locked, and if you want to access it,
you're going to pay us X amount
of Bitcoin for that decryption key.
So as we go through this section of the course,
we're going to be focused on the different types of malware,
the different infection vectors
and how to prevent malware from infecting your systems.
Our focus is solely going to be
on domain two inside of this section
and we'll be singularly focused on objective 2.4.
Now, objective 2.4 states that given a scenario,
you must be able to analyze indicators
of malicious activity, and then it goes on
to list all the different types
of malware attacks that you need to know for the exam.
First, we're going to be covering viruses.
A computer virus is a malicious software
that attaches itself to a clean file
and spreads throughout a computer system,
often corrupting or damaging the host files in the process.
Next, we'll discuss worms.
Now, worms are standalone pieces of malware
that replicate themself and spread to other computers
that often exploit software vulnerabilities
to propagate themselves across a network.
Then we'll talk about Trojans.
Trojans are malicious programs that disguise themself
as legitimate software, but when they're executed,
they grant the attackers unauthorized access
to the victim's system.
After that, we'll look at how easy it is
to create a virus to infect a system
and how an attack can be remotely controlled with a computer
by using a remote access Trojan known as a RAT.
Next, we're going to be looking at ransomware.
Now, ransomware is a type
of malware that encrypts the user's data
and holds it hostage until the ransom is paid
to the attacker for that decryption key.
After that, we'll talk
about the world of zombies and botnets.
Zombies are compromised computers
that are remotely controlled
by attackers and are often used
in coordination with other zombies to form a botnet.
A botnet is a network
of compromised computers that are controlled
by an attacker and are often used for distributed denial
of service attacks, spam distribution
or crypto mining operations.
Then we'll discuss rootkits.
And rootkits are malicious tools that hide their presence
and activities on a computer
and they often operate at the operating system
or below the operating system level to be able
to have ongoing privileged access to that system.
Next, we'll explore backdoors and logic bombs.
Backdoors are malicious means
of bypassing normal authentication processes
in order to gain unauthorized access
to a system which are often going to be implanted
by malware or during an attack by a threat actor.
Logic bombs, on the other hand,
are pieces of embedded code that's placed inside
of a legitimate program
and can be executing a malicious action
whenever a specific condition or trigger occurs.
Then we'll cover keyloggers.
Keyloggers are stealthy tools
or malware variants that record a user's keystrokes
and are often used to capture passwords
and other sensitive information on a victimized system.
After that, we'll discuss spyware and bloatware.
Spyware is software that secretly monitors
and gathers user information on a system or its activities
and then sends that data
to third parties without the user's knowledge or consent.
Bloatware, on the other hand,
refers to unnecessary or pre-installed software
on devices that are often going to be consuming
your system resources and space
without offering any value to you in return.
Next, we'll cover some malware attack techniques
and infection vectors.
Malware exploitation techniques involve methods
by which malware can infiltrate and infect a targeted system
and have been evolving from file-based tactics
to modern fireless techniques that leave
behind minimal traces on an infected machine.
These advanced malwares are often going to use
multi-stage deployments
that leverage your own built-in system tools
and various obfuscation techniques to challenge us
as cybersecurity professionals
as we're attempting to detect
and counteract these different types of malware.
Then we'll explore various indications
of a successful malware attack.
And every cybersecurity professional needs
to be able to recognize the indications of malware attacks,
including account lockouts, concurrent session utilization,
blocked content, impossible travel, resource consumption,
resource inaccessibility, out-of-cycle logging,
missing logs, and documented attacks
in order to better secure your enterprise networks.
Now, finally, we're going to take a short quiz
to see what you learned in this section of the course
and review each of those quiz questions fully
to ensure you can explain why each answer was right.
So if you're ready, let's get started
with our coverage of malware in this section of the course.