1 00:00:00,090 --> 00:00:02,969 In this lesson, we're going to explore viruses. 2 00:00:02,969 --> 00:00:05,910 Now, a computer virus is simply made up of malicious code 3 00:00:05,910 --> 00:00:08,280 that's run on a machine without the user's knowledge 4 00:00:08,280 --> 00:00:10,230 and this allows the code to infect the computer 5 00:00:10,230 --> 00:00:11,700 whenever it's been run. 6 00:00:11,700 --> 00:00:14,280 So what does this look like out in the real world? 7 00:00:14,280 --> 00:00:15,630 Well, maybe you're going to download 8 00:00:15,630 --> 00:00:17,250 a new video game from a website 9 00:00:17,250 --> 00:00:20,040 and when you download that installation file inside of it, 10 00:00:20,040 --> 00:00:22,050 there may have been some malicious code. 11 00:00:22,050 --> 00:00:24,090 Now, whenever you run the program to install it, 12 00:00:24,090 --> 00:00:25,950 you're actually allowing the code to be installed 13 00:00:25,950 --> 00:00:29,040 on your machine, and that virus can now take hold. 14 00:00:29,040 --> 00:00:31,620 At this point, the virus is going to want to reproduce 15 00:00:31,620 --> 00:00:32,970 and spread across the network, 16 00:00:32,970 --> 00:00:34,980 and it does this because you have taken 17 00:00:34,980 --> 00:00:36,480 some kind of user action, 18 00:00:36,480 --> 00:00:38,880 and in this case it was you installing the program 19 00:00:38,880 --> 00:00:40,920 and allowing that code to be run so that the virus 20 00:00:40,920 --> 00:00:43,110 can now start performing some malicious activities, 21 00:00:43,110 --> 00:00:45,390 including replicating across your network, 22 00:00:45,390 --> 00:00:46,860 deleting your critical files, 23 00:00:46,860 --> 00:00:48,930 and using a valuable computing resources 24 00:00:48,930 --> 00:00:50,370 within your systems. 25 00:00:50,370 --> 00:00:52,440 Now, there are 10 different types of viruses 26 00:00:52,440 --> 00:00:53,610 that you should be aware of, 27 00:00:53,610 --> 00:00:57,330 including boot sector, macro program, multipartite, 28 00:00:57,330 --> 00:01:00,810 encrypted, polymorphic, metamorphic, stealth, 29 00:01:00,810 --> 00:01:02,940 armor, and hoax viruses. 30 00:01:02,940 --> 00:01:05,519 Now, first, we have a boot sector virus. 31 00:01:05,519 --> 00:01:08,130 A boot sector virus is one that is going to be stored 32 00:01:08,130 --> 00:01:11,250 in the first sector of a hard disk or solid state device 33 00:01:11,250 --> 00:01:12,570 and is then loaded into memory 34 00:01:12,570 --> 00:01:14,580 whenever that can computer boots up. 35 00:01:14,580 --> 00:01:16,140 These boot sector viruses 36 00:01:16,140 --> 00:01:17,820 are actually very difficult to detect 37 00:01:17,820 --> 00:01:18,653 because they're installed 38 00:01:18,653 --> 00:01:20,490 before your operating system boots up 39 00:01:20,490 --> 00:01:22,590 and so it's able to hide itself from anti-virus 40 00:01:22,590 --> 00:01:25,080 that you may have installed inside your Windows, Linux, 41 00:01:25,080 --> 00:01:26,550 or Mac computer. 42 00:01:26,550 --> 00:01:28,500 To find and remove these types of viruses, 43 00:01:28,500 --> 00:01:30,120 you do need to use an anti-virus 44 00:01:30,120 --> 00:01:32,580 that specifically looks for boot sector viruses, 45 00:01:32,580 --> 00:01:33,990 and these usually are going to be run 46 00:01:33,990 --> 00:01:36,030 from a network anti-virus scanning engine 47 00:01:36,030 --> 00:01:37,920 or from an anti-virus that can be loaded 48 00:01:37,920 --> 00:01:39,990 from a Linux live boot disc. 49 00:01:39,990 --> 00:01:42,360 Second, we have a macro virus. 50 00:01:42,360 --> 00:01:44,190 Now, macros are a form of code 51 00:01:44,190 --> 00:01:47,130 that allows a virus to be embedded inside another document 52 00:01:47,130 --> 00:01:49,380 so that when that document is open by the user, 53 00:01:49,380 --> 00:01:51,420 the virus will then be executed. 54 00:01:51,420 --> 00:01:53,040 The most common examples of macros 55 00:01:53,040 --> 00:01:54,180 are the ones that are found inside 56 00:01:54,180 --> 00:01:57,090 of Microsoft Word documents, Microsoft Excel spreadsheets, 57 00:01:57,090 --> 00:01:59,610 and Microsoft PowerPoint presentations. 58 00:01:59,610 --> 00:02:02,730 By default, macros themself aren't actually malicious. 59 00:02:02,730 --> 00:02:04,470 In fact, macros are commonly used 60 00:02:04,470 --> 00:02:06,570 as a way for you to add specific functionality 61 00:02:06,570 --> 00:02:09,630 to your different documents, spreadsheets, and presentations 62 00:02:09,630 --> 00:02:11,880 without needing to create an entire program 63 00:02:11,880 --> 00:02:13,620 or application to do it. 64 00:02:13,620 --> 00:02:15,660 For example, I have a macro that I use 65 00:02:15,660 --> 00:02:17,250 inside of Microsoft Excel 66 00:02:17,250 --> 00:02:19,380 that allows me to do quicker calculations. 67 00:02:19,380 --> 00:02:21,690 Now, in my case, that piece of code works properly 68 00:02:21,690 --> 00:02:23,400 and is safe and secure to use, 69 00:02:23,400 --> 00:02:25,860 but just because we have the ability to add these codes 70 00:02:25,860 --> 00:02:27,090 to our office documents, 71 00:02:27,090 --> 00:02:29,220 it also means that threat actors can add code 72 00:02:29,220 --> 00:02:31,920 to those documents too, including malicious code 73 00:02:31,920 --> 00:02:34,920 into these types of documents, spreadsheets and PowerPoints 74 00:02:34,920 --> 00:02:36,851 and then try to trick a user into opening those documents 75 00:02:36,851 --> 00:02:39,450 by using social engineering techniques. 76 00:02:39,450 --> 00:02:41,580 Third, we have a program virus. 77 00:02:41,580 --> 00:02:43,920 Now program viruses try to find executables 78 00:02:43,920 --> 00:02:47,100 or application files to infect with their malicious code. 79 00:02:47,100 --> 00:02:49,890 For example, if you accidentally opened a program virus 80 00:02:49,890 --> 00:02:51,150 while browsing the internet, 81 00:02:51,150 --> 00:02:53,520 it can try to install itself into one of your programs, 82 00:02:53,520 --> 00:02:54,840 like Microsoft Word, 83 00:02:54,840 --> 00:02:56,760 that's already installed on your computer. 84 00:02:56,760 --> 00:02:59,670 This way, every time you open up the infected application, 85 00:02:59,670 --> 00:03:01,290 in this case Microsoft Word, 86 00:03:01,290 --> 00:03:03,030 it will then infect your computer 87 00:03:03,030 --> 00:03:05,010 each and every time you open it up. 88 00:03:05,010 --> 00:03:08,130 This is why program viruses target programs or applications 89 00:03:08,130 --> 00:03:11,250 because that virus can reinfect the system time after time, 90 00:03:11,250 --> 00:03:14,550 anytime the user opens that compromised application. 91 00:03:14,550 --> 00:03:17,040 Fourth, we have a multipartite virus. 92 00:03:17,040 --> 00:03:19,170 Now, a multipartite virus is a combination 93 00:03:19,170 --> 00:03:22,440 of a boot sector type of virus and a program type of virus. 94 00:03:22,440 --> 00:03:23,880 By using this combination, 95 00:03:23,880 --> 00:03:26,370 the virus can actually place itself in the boot sector 96 00:03:26,370 --> 00:03:28,620 and then get loaded up every time the computer boots, 97 00:03:28,620 --> 00:03:30,750 just like a boot sector virus would. 98 00:03:30,750 --> 00:03:32,820 Now, once it's loaded up at boot time, 99 00:03:32,820 --> 00:03:34,770 it can then install itself within a program 100 00:03:34,770 --> 00:03:37,170 where it can be run every time the computer starts up 101 00:03:37,170 --> 00:03:38,850 because that program is always started 102 00:03:38,850 --> 00:03:40,980 whenever the computer is booted up. 103 00:03:40,980 --> 00:03:43,020 Now, this allows a multipartite virus 104 00:03:43,020 --> 00:03:45,510 to maintain a persistence on your infected machine. 105 00:03:45,510 --> 00:03:47,940 And this way, even if a cybersecurity professional 106 00:03:47,940 --> 00:03:50,070 finds that program that's part of the virus 107 00:03:50,070 --> 00:03:52,440 and removes it from the system and cleans it out, 108 00:03:52,440 --> 00:03:54,270 they still may have missed the boot sector portion 109 00:03:54,270 --> 00:03:55,103 of that virus. 110 00:03:55,103 --> 00:03:56,370 And so the next time the user reboots 111 00:03:56,370 --> 00:03:57,630 their computer into Windows, 112 00:03:57,630 --> 00:04:00,480 that computer will get infected once more. 113 00:04:00,480 --> 00:04:02,790 Fifth, we have an encrypted virus. 114 00:04:02,790 --> 00:04:04,890 Now, an encrypted virus is designed to hide itself 115 00:04:04,890 --> 00:04:05,850 from being detected 116 00:04:05,850 --> 00:04:08,220 by encrypting its malicious code or payloads 117 00:04:08,220 --> 00:04:11,220 To avoid detection by any anti-virus software. 118 00:04:11,220 --> 00:04:13,410 Since the anti-virus providers are getting better and better 119 00:04:13,410 --> 00:04:15,840 all the time at understanding how viruses work, 120 00:04:15,840 --> 00:04:18,329 they actually can stop a lot of them a lot of the time 121 00:04:18,329 --> 00:04:19,800 from infecting our systems. 122 00:04:19,800 --> 00:04:21,720 But as the defenders get better, 123 00:04:21,720 --> 00:04:23,520 the attackers also get more creative 124 00:04:23,520 --> 00:04:25,110 in their infection methods. 125 00:04:25,110 --> 00:04:27,120 And so encrypted viruses make it harder 126 00:04:27,120 --> 00:04:30,000 for anti-virus providers to find these types of viruses 127 00:04:30,000 --> 00:04:32,580 because the malicious code is scrambled into cipher text 128 00:04:32,580 --> 00:04:34,350 and it's unreadable to both the user 129 00:04:34,350 --> 00:04:36,360 and the anti-virus software. 130 00:04:36,360 --> 00:04:39,000 Sixth, we have polymorphic viruses. 131 00:04:39,000 --> 00:04:41,280 Now, a polymorphic virus is an advanced version 132 00:04:41,280 --> 00:04:42,480 of an encrypted virus, 133 00:04:42,480 --> 00:04:44,610 but instead of just encrypting the contents, 134 00:04:44,610 --> 00:04:46,650 it's actually going to change the virus's code 135 00:04:46,650 --> 00:04:49,800 each time it's executed by altering the decryption module 136 00:04:49,800 --> 00:04:51,840 in order for it to evade detection. 137 00:04:51,840 --> 00:04:53,640 Now, I know this sounds really complicated, 138 00:04:53,640 --> 00:04:55,230 but what it's really trying to do here 139 00:04:55,230 --> 00:04:56,790 is morph the way the code looks 140 00:04:56,790 --> 00:04:59,190 so that it's signature-based anti-virus applications 141 00:04:59,190 --> 00:05:02,370 are not going to be able to detect it as being malicious. 142 00:05:02,370 --> 00:05:04,860 Seventh, we have a metamorphic virus. 143 00:05:04,860 --> 00:05:07,710 Now, metamorphic viruses are able to write itself entirely 144 00:05:07,710 --> 00:05:09,960 before it attempts to infect a given file. 145 00:05:09,960 --> 00:05:12,000 Essentially, this is a more advanced version 146 00:05:12,000 --> 00:05:14,070 of a polymorphic virus. 147 00:05:14,070 --> 00:05:16,170 Eighth, we have stealth viruses. 148 00:05:16,170 --> 00:05:18,780 Now, a stealth virus isn't necessarily a type of virus 149 00:05:18,780 --> 00:05:21,240 as much as a technique that's used to prevent viruses 150 00:05:21,240 --> 00:05:23,970 from being detected by anti-virus software. 151 00:05:23,970 --> 00:05:26,370 Stealth viruses are using different techniques 152 00:05:26,370 --> 00:05:28,800 to avoid detection by an anti-virus software, 153 00:05:28,800 --> 00:05:30,960 including things like encrypting its contents, 154 00:05:30,960 --> 00:05:34,410 modifying its payload, and other methods to avoid detection. 155 00:05:34,410 --> 00:05:36,480 Ninth, we have armored viruses. 156 00:05:36,480 --> 00:05:38,700 Now, armored viruses have a layer of protection 157 00:05:38,700 --> 00:05:40,350 that confuse a program or a person 158 00:05:40,350 --> 00:05:41,940 who's trying to analyze it. 159 00:05:41,940 --> 00:05:43,740 This is yet another way that virus creators 160 00:05:43,740 --> 00:05:46,350 are trying to add in protections for their virus' code 161 00:05:46,350 --> 00:05:48,480 to increase their odds of being able to spread that virus 162 00:05:48,480 --> 00:05:50,460 to other users without being detected 163 00:05:50,460 --> 00:05:52,470 by your organization's security appliances 164 00:05:52,470 --> 00:05:54,570 or their anti-virus scanners. 165 00:05:54,570 --> 00:05:56,190 The 10th and final virus we have 166 00:05:56,190 --> 00:05:57,720 is what's known as a a hoax. 167 00:05:57,720 --> 00:06:00,870 Now, interestingly enough, a hoax technically isn't a virus, 168 00:06:00,870 --> 00:06:03,600 but instead, it's a form of technical social engineering 169 00:06:03,600 --> 00:06:05,310 that attempts to scare our end users 170 00:06:05,310 --> 00:06:08,460 into taking some kind of undesirable action on their system. 171 00:06:08,460 --> 00:06:10,440 For example, you may have seen a message 172 00:06:10,440 --> 00:06:12,750 or a website that pops up and claims that it's a message 173 00:06:12,750 --> 00:06:14,460 from the Microsoft Tech support team 174 00:06:14,460 --> 00:06:16,710 and that your machine has been infected by a virus 175 00:06:16,710 --> 00:06:18,180 or other type of malware, 176 00:06:18,180 --> 00:06:19,920 then they'll give you a few steps to follow 177 00:06:19,920 --> 00:06:21,420 to remove that infection. 178 00:06:21,420 --> 00:06:22,500 Unfortunately though, 179 00:06:22,500 --> 00:06:25,050 your computer was never actually infected in the first place 180 00:06:25,050 --> 00:06:26,400 when you got that message, 181 00:06:26,400 --> 00:06:28,050 but by following their actions, 182 00:06:28,050 --> 00:06:30,390 you actually will download and infect your computer 183 00:06:30,390 --> 00:06:31,410 with a virus. 184 00:06:31,410 --> 00:06:32,880 And this is what we're talking about 185 00:06:32,880 --> 00:06:34,740 when we talk about a virus hoax. 186 00:06:34,740 --> 00:06:36,660 Usually, a virus hoax is going to be used 187 00:06:36,660 --> 00:06:38,760 to make somebody think their computer is infected, 188 00:06:38,760 --> 00:06:40,080 but really, they're just trying to trick you 189 00:06:40,080 --> 00:06:41,940 into installing a virus on your system 190 00:06:41,940 --> 00:06:43,590 or to get you to pay them money 191 00:06:43,590 --> 00:06:46,170 to remove that supposed virus from your computer. 192 00:06:46,170 --> 00:06:48,300 Either way though, you should remember that a hoax 193 00:06:48,300 --> 00:06:49,500 isn't really a virus 194 00:06:49,500 --> 00:06:51,900 and you don't have a virus infection on your system, 195 00:06:51,900 --> 00:06:53,490 unless you actually follow the directions 196 00:06:53,490 --> 00:06:55,740 provided by that message or the popup, 197 00:06:55,740 --> 00:06:57,210 or you allow somebody else 198 00:06:57,210 --> 00:06:58,800 who's supposedly from tech support 199 00:06:58,800 --> 00:07:00,390 to remotely access your computer 200 00:07:00,390 --> 00:07:02,280 to provide virus remediation. 201 00:07:02,280 --> 00:07:04,620 Either way, this really is just a technical form 202 00:07:04,620 --> 00:07:06,330 of social engineering where the attacker 203 00:07:06,330 --> 00:07:08,400 is trying to trick you into giving them access 204 00:07:08,400 --> 00:07:10,980 or installing malicious programs on their behalf. 205 00:07:10,980 --> 00:07:14,160 So remember, a virus is simply made up of malicious code 206 00:07:14,160 --> 00:07:16,830 that's being run on a machine without the user's knowledge. 207 00:07:16,830 --> 00:07:18,510 This allows the code to infect the computer 208 00:07:18,510 --> 00:07:19,770 whenever it's been run, 209 00:07:19,770 --> 00:07:21,480 and there are 10 different types of viruses 210 00:07:21,480 --> 00:07:22,740 that you need to be aware of, 211 00:07:22,740 --> 00:07:26,400 including boot sector, macro, program, multipartite, 212 00:07:26,400 --> 00:07:30,390 encrypted, polymorphic, metamorphic, stealth, armor, 213 00:07:30,390 --> 00:07:31,950 and hoax viruses. 214 00:07:31,950 --> 00:07:33,960 Now, some modern viruses actually will combine 215 00:07:33,960 --> 00:07:35,430 multiple categories of these 216 00:07:35,430 --> 00:07:37,440 to create really powerful viruses, 217 00:07:37,440 --> 00:07:40,530 such as an encrypted, metamorphic, multipartite virus 218 00:07:40,530 --> 00:07:42,360 that is really going to grab a hold of your system 219 00:07:42,360 --> 00:07:44,880 and attempt to avoid detection by your security appliances 220 00:07:44,880 --> 00:07:46,230 and anti-virus software. 221 00:07:46,230 --> 00:07:48,180 So you should be aware of this as well.