1 00:00:00,120 --> 00:00:01,290 In this section of the course, 2 00:00:01,290 --> 00:00:03,420 we're going to be covering malware. 3 00:00:03,420 --> 00:00:05,910 So what exactly is malware? 4 00:00:05,910 --> 00:00:07,770 Well, malware is a shorthand way 5 00:00:07,770 --> 00:00:09,870 of talking about malicious software. 6 00:00:09,870 --> 00:00:12,150 Malware is really any software that is designed 7 00:00:12,150 --> 00:00:14,850 to infiltrate a computer system and possibly damage it 8 00:00:14,850 --> 00:00:17,130 without the user's knowledge or consent. 9 00:00:17,130 --> 00:00:19,260 When I think of malware, I like to think about it 10 00:00:19,260 --> 00:00:22,290 as a broad category of software code that includes a lot 11 00:00:22,290 --> 00:00:23,370 of bad things that are out there 12 00:00:23,370 --> 00:00:25,440 on the internet that can harm our computers, 13 00:00:25,440 --> 00:00:29,400 things like viruses, worms, Trojans, ransomware, spyware, 14 00:00:29,400 --> 00:00:31,920 rootkits, spam, and much more. 15 00:00:31,920 --> 00:00:34,110 But for the malware to infect your system, 16 00:00:34,110 --> 00:00:36,240 it needs to be able to create a threat vector 17 00:00:36,240 --> 00:00:37,830 and an attack vector. 18 00:00:37,830 --> 00:00:40,050 Now, a threat vector is a specific method used 19 00:00:40,050 --> 00:00:42,990 by an attacker to infiltrate a victim system. 20 00:00:42,990 --> 00:00:43,860 Now, some examples 21 00:00:43,860 --> 00:00:46,110 of threat vectors include unpatched software, 22 00:00:46,110 --> 00:00:48,450 installing code using a USB thumb drive, 23 00:00:48,450 --> 00:00:50,550 a phishing campaign where one of your users clicks 24 00:00:50,550 --> 00:00:51,960 on a link to install some kind 25 00:00:51,960 --> 00:00:54,690 of malware into your system and many other vulnerabilities 26 00:00:54,690 --> 00:00:57,360 and exploits that can be taken advantage of. 27 00:00:57,360 --> 00:00:58,860 Now, the second thing the attacker needs 28 00:00:58,860 --> 00:01:01,200 in order to infiltrate your system is what's known 29 00:01:01,200 --> 00:01:02,640 as an attack vector. 30 00:01:02,640 --> 00:01:04,230 An attack vector is the means 31 00:01:04,230 --> 00:01:06,120 by which the attacker is going to gain access 32 00:01:06,120 --> 00:01:07,110 to that computer 33 00:01:07,110 --> 00:01:09,540 in order to infect your system with malware. 34 00:01:09,540 --> 00:01:11,760 Now, I know these two terms sound pretty similar 35 00:01:11,760 --> 00:01:13,980 but there is a distinct difference between them. 36 00:01:13,980 --> 00:01:16,260 When we talk about a threat vector, we are focused 37 00:01:16,260 --> 00:01:19,140 on how the attacker plans to break into a given system. 38 00:01:19,140 --> 00:01:21,510 But when we talk about the attack vector, we're talking 39 00:01:21,510 --> 00:01:24,180 about both the way the attacker might get into your system 40 00:01:24,180 --> 00:01:27,240 and how they're going to infect that system. 41 00:01:27,240 --> 00:01:29,040 Now, let me provide you with a silly example 42 00:01:29,040 --> 00:01:31,320 to hopefully clarify this concept a little bit. 43 00:01:31,320 --> 00:01:32,880 Let's pretend for a moment that your house 44 00:01:32,880 --> 00:01:34,200 is going to be our computer 45 00:01:34,200 --> 00:01:37,200 and I have a cupcake and I want to represent that as malware 46 00:01:37,200 --> 00:01:39,870 or malicious software, and I want to put that inside 47 00:01:39,870 --> 00:01:41,820 of your house or inside of your computer. 48 00:01:41,820 --> 00:01:44,820 Now, my job as the attacker is to get my cupcake 49 00:01:44,820 --> 00:01:46,830 from my house over to your house 50 00:01:46,830 --> 00:01:48,360 and onto your kitchen table. 51 00:01:48,360 --> 00:01:50,910 If I can do that, we're going to say that I was successful 52 00:01:50,910 --> 00:01:53,700 in my cupcake infiltration attack in this scenario 53 00:01:53,700 --> 00:01:54,900 and I've infected your house 54 00:01:54,900 --> 00:01:57,060 with this malware or this cupcake. 55 00:01:57,060 --> 00:01:58,440 So your job now 56 00:01:58,440 --> 00:02:00,600 as a cybersecurity professional is to stop me 57 00:02:00,600 --> 00:02:01,740 from getting that cupcake 58 00:02:01,740 --> 00:02:04,350 onto your kitchen table or in the real world, 59 00:02:04,350 --> 00:02:07,410 you want to stop me from infecting your system with malware. 60 00:02:07,410 --> 00:02:09,930 Now, the threat vector that I might choose could be 61 00:02:09,930 --> 00:02:11,130 to drive right up to your house 62 00:02:11,130 --> 00:02:13,680 because maybe your house isn't inside of a gated community 63 00:02:13,680 --> 00:02:15,600 with a security guard patrolling the streets. 64 00:02:15,600 --> 00:02:18,960 So you have a very unhardened system that might make it easy 65 00:02:18,960 --> 00:02:21,420 for me to infiltrate and get into your house. 66 00:02:21,420 --> 00:02:23,880 Now, in this example, that unguarded neighborhood 67 00:02:23,880 --> 00:02:26,160 would be considered our threat vector. 68 00:02:26,160 --> 00:02:28,260 Now, I know I can drive right over to your house 69 00:02:28,260 --> 00:02:30,540 but I still need to determine the attack vector 70 00:02:30,540 --> 00:02:32,520 that I'm going to use to get inside the house 71 00:02:32,520 --> 00:02:34,380 and that way I can put my cupcake, 72 00:02:34,380 --> 00:02:36,870 this malware, onto your kitchen table. 73 00:02:36,870 --> 00:02:39,510 Now, if I decide that I want to walk up to your front door, 74 00:02:39,510 --> 00:02:42,060 pick your lock and enter your house to place the cupcake 75 00:02:42,060 --> 00:02:44,370 on your kitchen table, that entire sequence 76 00:02:44,370 --> 00:02:47,010 of actions from walking to the door, picking the lock 77 00:02:47,010 --> 00:02:50,490 and entering the home would be considered my attack vector. 78 00:02:50,490 --> 00:02:51,323 That's the difference 79 00:02:51,323 --> 00:02:53,580 between the threat vector and the attack vector. 80 00:02:53,580 --> 00:02:55,770 It's the vulnerabilities that could be exploited 81 00:02:55,770 --> 00:02:58,530 and the way that they're actually going to be exploited. 82 00:02:58,530 --> 00:03:00,120 Now, let's go back to the world of computers 83 00:03:00,120 --> 00:03:01,020 for a moment. 84 00:03:01,020 --> 00:03:02,670 Let's pretend that you have an older computer 85 00:03:02,670 --> 00:03:03,720 that's running Windows 10 86 00:03:03,720 --> 00:03:04,890 and you haven't bothered installing 87 00:03:04,890 --> 00:03:06,810 or downloading the latest security patches 88 00:03:06,810 --> 00:03:09,270 because you've just been busy and you haven't had time to. 89 00:03:09,270 --> 00:03:10,830 Well, maybe it's been a really long time 90 00:03:10,830 --> 00:03:12,180 since you've installed those patches, 91 00:03:12,180 --> 00:03:14,520 that it's been three months or six months, or 12 months, 92 00:03:14,520 --> 00:03:16,020 and now you have a computer 93 00:03:16,020 --> 00:03:18,030 that is missing a critical security patch, 94 00:03:18,030 --> 00:03:20,880 like the MS17-010 security patch 95 00:03:20,880 --> 00:03:24,240 from Microsoft that came out all the way back in 2017 96 00:03:24,240 --> 00:03:26,400 to patch the EternalBlue vulnerability. 97 00:03:26,400 --> 00:03:29,940 Now, this unpatched vulnerability represents a threat vector 98 00:03:29,940 --> 00:03:32,850 but I still don't have an attack vector quite yet. 99 00:03:32,850 --> 00:03:36,210 Now, as an attacker, my goal is to infect as many systems 100 00:03:36,210 --> 00:03:38,430 as possible using this vulnerability. 101 00:03:38,430 --> 00:03:40,800 That way I can gain access to all of them. 102 00:03:40,800 --> 00:03:43,530 So I'm going to sit here all day scanning the internet 103 00:03:43,530 --> 00:03:46,710 and try to identify any unpatched computers that are online. 104 00:03:46,710 --> 00:03:49,680 And once I do that, I can then attack that system 105 00:03:49,680 --> 00:03:52,500 because that missing security patch is going to be vulnerable 106 00:03:52,500 --> 00:03:53,400 for that system 107 00:03:53,400 --> 00:03:55,890 and I already have a known exploit that I can plug 108 00:03:55,890 --> 00:03:58,980 against your system to be able to break in because the file 109 00:03:58,980 --> 00:04:01,590 and printer services that operate over the SMB Protocol 110 00:04:01,590 --> 00:04:03,180 are vulnerable on your system 111 00:04:03,180 --> 00:04:05,280 because you're missing that security patch. 112 00:04:05,280 --> 00:04:07,590 Now, once I find this vulnerable computer, 113 00:04:07,590 --> 00:04:09,690 I can run this exploit to gain access 114 00:04:09,690 --> 00:04:10,860 to the vulnerable machine 115 00:04:10,860 --> 00:04:13,020 and install some kind of malware on it. 116 00:04:13,020 --> 00:04:15,270 This entire series of events I just talked about 117 00:04:15,270 --> 00:04:18,540 can now be referred simply as my attack vector. 118 00:04:18,540 --> 00:04:20,700 This attack vector is the exact same one 119 00:04:20,700 --> 00:04:23,370 that was used widely by the WannaCry ransomware 120 00:04:23,370 --> 00:04:25,590 to wreak havoc across the internet. 121 00:04:25,590 --> 00:04:27,150 With the WannaCry ransomware, 122 00:04:27,150 --> 00:04:29,220 the attackers ran automated scans all day 123 00:04:29,220 --> 00:04:32,250 and all night to find as many unpatched Windows machines 124 00:04:32,250 --> 00:04:36,060 running Windows 7, Windows 8, Windows 8.1, and Windows 10. 125 00:04:36,060 --> 00:04:37,620 And when they found those systems 126 00:04:37,620 --> 00:04:40,113 that were missing that patch, MS17-010 dash, 127 00:04:41,010 --> 00:04:42,570 they ran an exploit against it 128 00:04:42,570 --> 00:04:44,910 to gain administrative rights over that system. 129 00:04:44,910 --> 00:04:46,770 Then they would encrypt the user's files 130 00:04:46,770 --> 00:04:48,510 and display a message on the user's screen 131 00:04:48,510 --> 00:04:51,510 saying your computer is locked, and if you want to access it, 132 00:04:51,510 --> 00:04:52,800 you're going to pay us X amount 133 00:04:52,800 --> 00:04:54,900 of Bitcoin for that decryption key. 134 00:04:54,900 --> 00:04:56,850 So as we go through this section of the course, 135 00:04:56,850 --> 00:04:59,100 we're going to be focused on the different types of malware, 136 00:04:59,100 --> 00:05:00,540 the different infection vectors 137 00:05:00,540 --> 00:05:03,390 and how to prevent malware from infecting your systems. 138 00:05:03,390 --> 00:05:04,920 Our focus is solely going to be 139 00:05:04,920 --> 00:05:07,050 on domain two inside of this section 140 00:05:07,050 --> 00:05:10,470 and we'll be singularly focused on objective 2.4. 141 00:05:10,470 --> 00:05:13,230 Now, objective 2.4 states that given a scenario, 142 00:05:13,230 --> 00:05:15,120 you must be able to analyze indicators 143 00:05:15,120 --> 00:05:17,040 of malicious activity, and then it goes on 144 00:05:17,040 --> 00:05:18,090 to list all the different types 145 00:05:18,090 --> 00:05:21,030 of malware attacks that you need to know for the exam. 146 00:05:21,030 --> 00:05:23,160 First, we're going to be covering viruses. 147 00:05:23,160 --> 00:05:25,200 A computer virus is a malicious software 148 00:05:25,200 --> 00:05:26,970 that attaches itself to a clean file 149 00:05:26,970 --> 00:05:28,740 and spreads throughout a computer system, 150 00:05:28,740 --> 00:05:31,920 often corrupting or damaging the host files in the process. 151 00:05:31,920 --> 00:05:33,780 Next, we'll discuss worms. 152 00:05:33,780 --> 00:05:35,940 Now, worms are standalone pieces of malware 153 00:05:35,940 --> 00:05:38,280 that replicate themself and spread to other computers 154 00:05:38,280 --> 00:05:40,260 that often exploit software vulnerabilities 155 00:05:40,260 --> 00:05:42,630 to propagate themselves across a network. 156 00:05:42,630 --> 00:05:44,820 Then we'll talk about Trojans. 157 00:05:44,820 --> 00:05:47,280 Trojans are malicious programs that disguise themself 158 00:05:47,280 --> 00:05:49,950 as legitimate software, but when they're executed, 159 00:05:49,950 --> 00:05:51,840 they grant the attackers unauthorized access 160 00:05:51,840 --> 00:05:53,370 to the victim's system. 161 00:05:53,370 --> 00:05:55,200 After that, we'll look at how easy it is 162 00:05:55,200 --> 00:05:57,090 to create a virus to infect a system 163 00:05:57,090 --> 00:05:59,970 and how an attack can be remotely controlled with a computer 164 00:05:59,970 --> 00:06:03,240 by using a remote access Trojan known as a RAT. 165 00:06:03,240 --> 00:06:05,460 Next, we're going to be looking at ransomware. 166 00:06:05,460 --> 00:06:06,750 Now, ransomware is a type 167 00:06:06,750 --> 00:06:08,550 of malware that encrypts the user's data 168 00:06:08,550 --> 00:06:10,800 and holds it hostage until the ransom is paid 169 00:06:10,800 --> 00:06:12,990 to the attacker for that decryption key. 170 00:06:12,990 --> 00:06:14,220 After that, we'll talk 171 00:06:14,220 --> 00:06:16,350 about the world of zombies and botnets. 172 00:06:16,350 --> 00:06:18,060 Zombies are compromised computers 173 00:06:18,060 --> 00:06:18,893 that are remotely controlled 174 00:06:18,893 --> 00:06:20,340 by attackers and are often used 175 00:06:20,340 --> 00:06:23,280 in coordination with other zombies to form a botnet. 176 00:06:23,280 --> 00:06:24,510 A botnet is a network 177 00:06:24,510 --> 00:06:26,040 of compromised computers that are controlled 178 00:06:26,040 --> 00:06:28,470 by an attacker and are often used for distributed denial 179 00:06:28,470 --> 00:06:30,450 of service attacks, spam distribution 180 00:06:30,450 --> 00:06:32,370 or crypto mining operations. 181 00:06:32,370 --> 00:06:34,230 Then we'll discuss rootkits. 182 00:06:34,230 --> 00:06:36,480 And rootkits are malicious tools that hide their presence 183 00:06:36,480 --> 00:06:37,890 and activities on a computer 184 00:06:37,890 --> 00:06:39,840 and they often operate at the operating system 185 00:06:39,840 --> 00:06:42,210 or below the operating system level to be able 186 00:06:42,210 --> 00:06:44,970 to have ongoing privileged access to that system. 187 00:06:44,970 --> 00:06:47,580 Next, we'll explore backdoors and logic bombs. 188 00:06:47,580 --> 00:06:49,050 Backdoors are malicious means 189 00:06:49,050 --> 00:06:51,390 of bypassing normal authentication processes 190 00:06:51,390 --> 00:06:52,920 in order to gain unauthorized access 191 00:06:52,920 --> 00:06:55,110 to a system which are often going to be implanted 192 00:06:55,110 --> 00:06:58,230 by malware or during an attack by a threat actor. 193 00:06:58,230 --> 00:06:59,700 Logic bombs, on the other hand, 194 00:06:59,700 --> 00:07:02,040 are pieces of embedded code that's placed inside 195 00:07:02,040 --> 00:07:03,210 of a legitimate program 196 00:07:03,210 --> 00:07:05,310 and can be executing a malicious action 197 00:07:05,310 --> 00:07:07,920 whenever a specific condition or trigger occurs. 198 00:07:07,920 --> 00:07:09,930 Then we'll cover keyloggers. 199 00:07:09,930 --> 00:07:11,340 Keyloggers are stealthy tools 200 00:07:11,340 --> 00:07:14,010 or malware variants that record a user's keystrokes 201 00:07:14,010 --> 00:07:15,690 and are often used to capture passwords 202 00:07:15,690 --> 00:07:18,720 and other sensitive information on a victimized system. 203 00:07:18,720 --> 00:07:21,510 After that, we'll discuss spyware and bloatware. 204 00:07:21,510 --> 00:07:23,730 Spyware is software that secretly monitors 205 00:07:23,730 --> 00:07:26,610 and gathers user information on a system or its activities 206 00:07:26,610 --> 00:07:27,630 and then sends that data 207 00:07:27,630 --> 00:07:30,510 to third parties without the user's knowledge or consent. 208 00:07:30,510 --> 00:07:31,650 Bloatware, on the other hand, 209 00:07:31,650 --> 00:07:33,960 refers to unnecessary or pre-installed software 210 00:07:33,960 --> 00:07:36,090 on devices that are often going to be consuming 211 00:07:36,090 --> 00:07:37,860 your system resources and space 212 00:07:37,860 --> 00:07:40,440 without offering any value to you in return. 213 00:07:40,440 --> 00:07:42,600 Next, we'll cover some malware attack techniques 214 00:07:42,600 --> 00:07:44,130 and infection vectors. 215 00:07:44,130 --> 00:07:46,530 Malware exploitation techniques involve methods 216 00:07:46,530 --> 00:07:49,500 by which malware can infiltrate and infect a targeted system 217 00:07:49,500 --> 00:07:51,660 and have been evolving from file-based tactics 218 00:07:51,660 --> 00:07:53,490 to modern fireless techniques that leave 219 00:07:53,490 --> 00:07:56,160 behind minimal traces on an infected machine. 220 00:07:56,160 --> 00:07:58,290 These advanced malwares are often going to use 221 00:07:58,290 --> 00:07:59,550 multi-stage deployments 222 00:07:59,550 --> 00:08:01,650 that leverage your own built-in system tools 223 00:08:01,650 --> 00:08:04,140 and various obfuscation techniques to challenge us 224 00:08:04,140 --> 00:08:05,460 as cybersecurity professionals 225 00:08:05,460 --> 00:08:06,810 as we're attempting to detect 226 00:08:06,810 --> 00:08:09,150 and counteract these different types of malware. 227 00:08:09,150 --> 00:08:11,100 Then we'll explore various indications 228 00:08:11,100 --> 00:08:12,750 of a successful malware attack. 229 00:08:12,750 --> 00:08:14,580 And every cybersecurity professional needs 230 00:08:14,580 --> 00:08:17,370 to be able to recognize the indications of malware attacks, 231 00:08:17,370 --> 00:08:20,370 including account lockouts, concurrent session utilization, 232 00:08:20,370 --> 00:08:23,790 blocked content, impossible travel, resource consumption, 233 00:08:23,790 --> 00:08:26,520 resource inaccessibility, out-of-cycle logging, 234 00:08:26,520 --> 00:08:28,560 missing logs, and documented attacks 235 00:08:28,560 --> 00:08:31,230 in order to better secure your enterprise networks. 236 00:08:31,230 --> 00:08:33,120 Now, finally, we're going to take a short quiz 237 00:08:33,120 --> 00:08:35,100 to see what you learned in this section of the course 238 00:08:35,100 --> 00:08:36,960 and review each of those quiz questions fully 239 00:08:36,960 --> 00:08:39,480 to ensure you can explain why each answer was right. 240 00:08:39,480 --> 00:08:41,280 So if you're ready, let's get started 241 00:08:41,280 --> 00:08:44,212 with our coverage of malware in this section of the course.