Malware intro

You know how every year the medical community campaigns for everyone to get a flu shot? That’s because flu outbreaks typically have a season—a time of year when they start spreading and infecting people.

In contrast, there are no predictable seasonal infections for PCs, smartphones, tablets, and enterprise networks. For them, it’s always flu season. But instead of suffering chills and body aches, users can fall ill from a kind of machine malady—malware. Each type of malware infection has its own methods of attack—from stealthy and sneaky to subtle like a sledgehammer. But if knowledge is power, as a preventative inoculation against infection, we offer here a short cybersecurity course on malware, what it is, its symptoms, how you get it, how to deal with it, and how to avoid it in the future.

Malware definition

Malware, or “malicious software,” is an umbrella term that describes any malicious program or code that is harmful to systems. Hostile, intrusive, and intentionally nasty, malware seeks to invade, damage, or disable computers, computer systems, networks, tablets, and mobile devices, often by taking partial control over a device’s operations. Like the human flu, it interferes with normal functioning.

The motives behind malware vary. Malware can be about making money off you, sabotaging your ability to get work done, making a political statement, or just bragging rights. Although malware cannot damage the physical hardware of systems or network equipment (with one known exception—see the Google Android section below), it can steal, encrypt, or delete your data, alter or hijack core computer functions, and spy on your computer activity without your knowledge or permission.

The way of spreading of Malware

The two most common ways that malware accesses your system are the Internet and email. So basically, anytime you’re connected online, you’re vulnerable. Malware can penetrate your computer when (deep breath now) you surf through hacked websites, view a legitimate site serving malicious ads, download infected files, install programs or apps from unfamiliar provide, open a malicious email attachment (malspam), or pretty much everything else you download from the web on to a device that lacks a quality anti-malware security application.

Malicious apps can hide in seemingly legitimate applications, especially when they are downloaded from websites or direct links (in an email, text, or chat message) instead of an official app store. Here it’s important to look at the warning messages when installing applications, especially if they seek permission to access your email or other personal information.

Bottom line, it’s best to stick to trusted sources for mobile apps, only installing reputable third-party apps, and always downloading those apps directly from the vendor—and never from any other site. All in all, there is a world of bad actors out there, throwing tainted bait at you with an offer for an Internet accelerator, new download manager, hard disk drive cleaner, or an alternative web search service. Malware attacks would not work without the most important ingredient: you. That is, a gullible version of you, willing to open up an email attachment you don’t recognize, or to click and install something from an untrustworthy source. And don’t take this as “click-shaming,” because even very experienced people have been tricked into installing malware.

Even if you install something from a credible source, if you don’t pay attention to the permission request to install other bundled software at the same time, you could be installing software you don’t want. This extra software, also known as a potentially unwanted program (PUP), is often presented as a necessary component, but it often isn’t.

Another wrinkle is a bit of social engineering that a Malwarebytes expert observed in the UK. The scam hit mobile users by taking dvantage of a common mobile direct-to-bill payment option. Users visited mobile sites, unwittingly tripping invisible buttons that charge them via their mobile numbers, directly billing the victims’ networks, which pass the cost onto their bill.

To be fair, we should also include a blameless malware infection scenario. Because it’s even possible that just visiting a malicious website and viewing an infected page and/or banner ad will result in a drive-by malware download. Malware distributed via bad ads on legitimate websites is known as malvertising. On the other hand, if you’re not running an adequate security program, the malware infection and its aftermath are still on you.

The history of malware

The 1980s and onward: The theoretical underpinning of “self-reproducing automata” (i.e., viruses) dates back to a lecture delivered in 1949 by 20th century Renaissance man John von Neumann. However, the history of modern viruses begins with a program called Elk Cloner, which started infecting Apple II systems in 1982. Disseminated by infected floppy disks, the virus itself was harmless, but it spread to all disks attached to a system, exploding so virulently that it can be considered the first large-scale computer virus outbreak in history. Note that this was prior to any Windows PC malware. Since then, viruses and worms have become widespread.

The 1990s: Microsoft Windows began its long run as the most popular OS in the world (not to be overtaken till Google’s Android many years later). As the Windows OS and its built-in applications grew in popularity, so too did the number of viruses written for the platform. In particular, malware authors started to write infectious code in the macro language of Microsoft Word. These macro viruses infected documents and templates rather than executable applications, although strictly speaking, the Word document macros are a form of executable code.

2002 to 2007: Instant messaging (IM) worms spread across popular IM networks, including AOL AIM, MSN Messenger, and Yahoo Messenger. Most attacks started with a social engineering ploy. Attackers might send out an IM that reads something like “Who’s with you in this picture?” or “OMG, I think you won the lottery!” along with a link to a malicious download. Once your system was infected, the IM worm would further propagate itself by sending malicious download links to everyone on your contact list.

2005 to 2009: Adware attacks proliferated, presenting unwanted advertisements to computer screens, sometimes in the form of a pop-up or in a window that users could not close. These ads often exploited legitimate software as a means to spread, but around 2008, software publishers began suing adware companies for fraud. The result was millions of dollars in fines. This eventually drove adware companies to shut down. Today’s tech support scams owe much to the adware of yesteryear, employing many of the same tricks as the old adware attacks; e.g., full screen ads that can’t be closed or exited.

2007 to 2009: Malware scammers turned to social networks such as Myspace as a channel for delivering rogue advertisements, links to phishing pages, and malicious applications. After Myspace declined in popularity, Facebook and Twitter became the preferred platforms.

2013: A new form of malware called ransomware launched an attack under the name CryptoLocker, which continued from early September 2013 to late May 2014, targeting computers running Windows. CryptoLocker succeeded in forcing victims to pay about $3 million in total, BBC News reported. Moreover, the ransomware’s success gave rise to an unending series of copycats.

2013 to 2017: Delivered through Trojans, exploits, and malvertising, ransomware became the king of malware, culminating in huge outbreaks in 2017 that affected businesses of all kinds. 2017: Cryptocurrency—and how to mine for it—has captured widespread attention, leading to a new malware scam called cryptojacking, or the act of secretly using someone else’s device to surreptitiously mine for cryptocurrency with the victims’ resources.

2018 to 2019: Ransomware made its big comeback. This time, however, cybercriminals shifted their focus from individual consumers to business targets. Riding a wave of GandCrab and Ryuk ransomware infections, attacks on businesses went up 365 percent from 2018 to 2019. As of this writing, there’s no indication the ransomware attacks will slow down.

Read more on history of malware here!

Malware Revisioned

Chengjiang He

 next article