MalwareMaliciousSoftware-BrownCS.pdfVIP

Malware: Malicious Software 10/21/2010 Malware 1 Viruses, Worms, Trojans, Rootkits • Malware can be classified into several categories, depending on propagation and concealment • Propagation – Virus : human-assisted propagation (e.g., open email attachment) – Worm : automatic propagation without human assistance • Concealment – Rootkit: modifies operating system to hide its existence – Trojan : provides desirable functionality but hides malicious operation • Various types of payloads, ranging from annoyance to crime 10/21/2010 Malware 2 Insider Attacks • An insider attack is a security breach that is caused or facilitated by someone who is a part of the very organization that controls or builds the asset that should be protected. • In the case of malware, an insider attack refers to a security hole that is created in a software system by one of its programmers. 10/21/2010 Malware 3 Backdoors • A backdoor, which is also sometimes called a trapdoor, is a hidden feature or command in a program that allows a user to perform actions he or she would not normally be allowed to do. • When used in a normal way, this program performs completely as expected and advertised. • But if the hidden feature is activated, the program does something unexpected, often in violation of security policies, such as performing a privilege escalation. • Benign example: Easter Eggs in DVDs and software 10/21/2010 Malware 4 Logic Bombs • A logic bomb is a program that performs a malicious action as a result of