In this lesson, we're going to explore viruses.
Now, a computer virus is simply made up of malicious code
that's run on a machine without the user's knowledge
and this allows the code to infect the computer
whenever it's been run.
So what does this look like out in the real world?
Well, maybe you're going to download
a new video game from a website
and when you download that installation file inside of it,
there may have been some malicious code.
Now, whenever you run the program to install it,
you're actually allowing the code to be installed
on your machine, and that virus can now take hold.
At this point, the virus is going to want to reproduce
and spread across the network,
and it does this because you have taken
some kind of user action,
and in this case it was you installing the program
and allowing that code to be run so that the virus
can now start performing some malicious activities,
including replicating across your network,
deleting your critical files,
and using a valuable computing resources
within your systems.
Now, there are 10 different types of viruses
that you should be aware of,
including boot sector, macro program, multipartite,
encrypted, polymorphic, metamorphic, stealth,
armor, and hoax viruses.
Now, first, we have a boot sector virus.
A boot sector virus is one that is going to be stored
in the first sector of a hard disk or solid state device
and is then loaded into memory
whenever that can computer boots up.
These boot sector viruses
are actually very difficult to detect
because they're installed
before your operating system boots up
and so it's able to hide itself from anti-virus
that you may have installed inside your Windows, Linux,
or Mac computer.
To find and remove these types of viruses,
you do need to use an anti-virus
that specifically looks for boot sector viruses,
and these usually are going to be run
from a network anti-virus scanning engine
or from an anti-virus that can be loaded
from a Linux live boot disc.
Second, we have a macro virus.
Now, macros are a form of code
that allows a virus to be embedded inside another document
so that when that document is open by the user,
the virus will then be executed.
The most common examples of macros
are the ones that are found inside
of Microsoft Word documents, Microsoft Excel spreadsheets,
and Microsoft PowerPoint presentations.
By default, macros themself aren't actually malicious.
In fact, macros are commonly used
as a way for you to add specific functionality
to your different documents, spreadsheets, and presentations
without needing to create an entire program
or application to do it.
For example, I have a macro that I use
inside of Microsoft Excel
that allows me to do quicker calculations.
Now, in my case, that piece of code works properly
and is safe and secure to use,
but just because we have the ability to add these codes
to our office documents,
it also means that threat actors can add code
to those documents too, including malicious code
into these types of documents, spreadsheets and PowerPoints
and then try to trick a user into opening those documents
by using social engineering techniques.
Third, we have a program virus.
Now program viruses try to find executables
or application files to infect with their malicious code.
For example, if you accidentally opened a program virus
while browsing the internet,
it can try to install itself into one of your programs,
like Microsoft Word,
that's already installed on your computer.
This way, every time you open up the infected application,
in this case Microsoft Word,
it will then infect your computer
each and every time you open it up.
This is why program viruses target programs or applications
because that virus can reinfect the system time after time,
anytime the user opens that compromised application.
Fourth, we have a multipartite virus.
Now, a multipartite virus is a combination
of a boot sector type of virus and a program type of virus.
By using this combination,
the virus can actually place itself in the boot sector
and then get loaded up every time the computer boots,
just like a boot sector virus would.
Now, once it's loaded up at boot time,
it can then install itself within a program
where it can be run every time the computer starts up
because that program is always started
whenever the computer is booted up.
Now, this allows a multipartite virus
to maintain a persistence on your infected machine.
And this way, even if a cybersecurity professional
finds that program that's part of the virus
and removes it from the system and cleans it out,
they still may have missed the boot sector portion
of that virus.
And so the next time the user reboots
their computer into Windows,
that computer will get infected once more.
Fifth, we have an encrypted virus.
Now, an encrypted virus is designed to hide itself
from being detected
by encrypting its malicious code or payloads
To avoid detection by any anti-virus software.
Since the anti-virus providers are getting better and better
all the time at understanding how viruses work,
they actually can stop a lot of them a lot of the time
from infecting our systems.
But as the defenders get better,
the attackers also get more creative
in their infection methods.
And so encrypted viruses make it harder
for anti-virus providers to find these types of viruses
because the malicious code is scrambled into cipher text
and it's unreadable to both the user
and the anti-virus software.
Sixth, we have polymorphic viruses.
Now, a polymorphic virus is an advanced version
of an encrypted virus,
but instead of just encrypting the contents,
it's actually going to change the virus's code
each time it's executed by altering the decryption module
in order for it to evade detection.
Now, I know this sounds really complicated,
but what it's really trying to do here
is morph the way the code looks
so that it's signature-based anti-virus applications
are not going to be able to detect it as being malicious.
Seventh, we have a metamorphic virus.
Now, metamorphic viruses are able to write itself entirely
before it attempts to infect a given file.
Essentially, this is a more advanced version
of a polymorphic virus.
Eighth, we have stealth viruses.
Now, a stealth virus isn't necessarily a type of virus
as much as a technique that's used to prevent viruses
from being detected by anti-virus software.
Stealth viruses are using different techniques
to avoid detection by an anti-virus software,
including things like encrypting its contents,
modifying its payload, and other methods to avoid detection.
Ninth, we have armored viruses.
Now, armored viruses have a layer of protection
that confuse a program or a person
who's trying to analyze it.
This is yet another way that virus creators
are trying to add in protections for their virus' code
to increase their odds of being able to spread that virus
to other users without being detected
by your organization's security appliances
or their anti-virus scanners.
The 10th and final virus we have
is what's known as a a hoax.
Now, interestingly enough, a hoax technically isn't a virus,
but instead, it's a form of technical social engineering
that attempts to scare our end users
into taking some kind of undesirable action on their system.
For example, you may have seen a message
or a website that pops up and claims that it's a message
from the Microsoft Tech support team
and that your machine has been infected by a virus
or other type of malware,
then they'll give you a few steps to follow
to remove that infection.
Unfortunately though,
your computer was never actually infected in the first place
when you got that message,
but by following their actions,
you actually will download and infect your computer
with a virus.
And this is what we're talking about
when we talk about a virus hoax.
Usually, a virus hoax is going to be used
to make somebody think their computer is infected,
but really, they're just trying to trick you
into installing a virus on your system
or to get you to pay them money
to remove that supposed virus from your computer.
Either way though, you should remember that a hoax
isn't really a virus
and you don't have a virus infection on your system,
unless you actually follow the directions
provided by that message or the popup,
or you allow somebody else
who's supposedly from tech support
to remotely access your computer
to provide virus remediation.
Either way, this really is just a technical form
of social engineering where the attacker
is trying to trick you into giving them access
or installing malicious programs on their behalf.
So remember, a virus is simply made up of malicious code
that's being run on a machine without the user's knowledge.
This allows the code to infect the computer
whenever it's been run,
and there are 10 different types of viruses
that you need to be aware of,
including boot sector, macro, program, multipartite,
encrypted, polymorphic, metamorphic, stealth, armor,
and hoax viruses.
Now, some modern viruses actually will combine
multiple categories of these
to create really powerful viruses,
such as an encrypted, metamorphic, multipartite virus
that is really going to grab a hold of your system
and attempt to avoid detection by your security appliances
and anti-virus software.
So you should be aware of this as well.