What is malware? All you need to know!
I believe you've heard or read that word, but do you know what malware is? The term malware is the abbreviation for Malicious Software, which is an unpleasant or malicious software that proposes to secretly access a device or machine without the user's knowledge, in order to damage or disable it.
Initially, understand that malware is a widespread category for all types of software that has a harmful purpose. It is like cancer, a terrible disease that has many types and variations, affecting different functions and organs of the human body.
From there, it will be easier to understand that a hacker attack is made up of different categories of software and that software used for malicious purposes is called malware.
It may seem confusing, but I'm here to help you and explain all this variation and nomenclature. We will then learn in a theoretical way how malware works, its different categories, and ways to protect itself. Prepared?
1. How do malware works?
Unlike a "common" virus, the user does not need to download a file to become infected. Malware can infect a machine in several ways, through malicious code added to the original software, portals, and even photos.
The malware is software that operates by installing on a machine or device, by combining a number of ingredients, the two most common: the internet and email.
Malware can penetrate your computer as you browse, click on game demos, download infected music files, open a malicious email attachment, or basically anything you download from internet for your device or machine, which does not have a quality anti-malware security application.
Malicious apps can hide in legitimate apps, especially when they are downloaded from websites or messages, rather than from an app store. For this reason, it is important to check alert messages when installing applications, or updating programs, especially if they ask for permission to access your email information or personal data.
This software is the intelligence used in the combination of three parts: strategy, intelligence, and objective. This combination classifies what is called a hacker attack. Basically, the goal is variant, but when it comes to a cyberattack, which is where the malware fits, the goal is to hijack data, collect traffic packets, steal information, etc.
The strategy is the name given to the plan that was devised, and it is the set of pieces, such as the objective, the target (in this case, your company), and intelligence. And finally, intelligence is the tool that makes it possible to execute the strategy, which, in this case, malware is the means used to execute this attack.
Viruses: This is malware that adds itself to another program so that when it is executed - usually unwisely by the user - it reproduces itself by modifying other computer programs and infecting them with its own code.
2.1 Adware: Adware is unwanted software designed to play ads on your screen, most often within a web browser. Usually, it uses a covert method to disguise itself as legitimate, or it overlaps with another program to deceive and install on your computer.
2.2 Spyware: Spyware is the malware that secretly monitors the computer user's activities without permission and passes information to the author of the software. It installs itself, and it usually makes its way onto your computer without your knowing or having allowed it, in your operating system, settling on your machine.
2.3 Worms: worms are a type of malware similar to viruses, which multiply in order to spread to other computers over a network, usually causing damage and destroying data and files.
2.4 Ransomware: is a form of malware that blocks your device, and/or encrypts your files, then forces you to pay a ransom to recover them. Ransomware has been called the favorite weapon of cybercriminals, as it requires a quick and profitable payment in a difficult-to-track cryptocurrency, Bitcoin. The code behind Ransomware is easy to obtain through online criminal markets, but defending against it is very difficult.
2.5 Keylogger: This type of malware records every user's keystroke, usually storing the acquired information and sending it to the attacker, who is looking for sensitive information such as usernames, passwords, or credit card details.
Let's look at some famous attacks that made use of the types of malware that were mentioned here:
The malware is software that operates by installing on a machine or device, by combining a number of ingredients, the two most common: the internet and email.
Malware can penetrate your computer as you browse, click on game demos, download infected music files, open a malicious email attachment, or basically anything you download from internet for your device or machine, which does not have a quality anti-malware security application.
Malicious apps can hide in legitimate apps, especially when they are downloaded from websites or messages, rather than from an app store. For this reason, it is important to check alert messages when installing applications, or updating programs, especially if they ask for permission to access your email information or personal data.
This software is the intelligence used in the combination of three parts: strategy, intelligence, and objective. This combination classifies what is called a hacker attack. Basically, the goal is variant, but when it comes to a cyberattack, which is where the malware fits, the goal is to hijack data, collect traffic packets, steal information, etc.
The strategy is the name given to the plan that was devised, and it is the set of pieces, such as the objective, the target (in this case, your company), and intelligence. And finally, intelligence is the tool that makes it possible to execute the strategy, which, in this case, malware is the means used to execute this attack.
2. Types of malware
Now that you understand what malware is and how it works, here are some types:Viruses: This is malware that adds itself to another program so that when it is executed - usually unwisely by the user - it reproduces itself by modifying other computer programs and infecting them with its own code.
2.1 Adware: Adware is unwanted software designed to play ads on your screen, most often within a web browser. Usually, it uses a covert method to disguise itself as legitimate, or it overlaps with another program to deceive and install on your computer.
2.2 Spyware: Spyware is the malware that secretly monitors the computer user's activities without permission and passes information to the author of the software. It installs itself, and it usually makes its way onto your computer without your knowing or having allowed it, in your operating system, settling on your machine.
2.3 Worms: worms are a type of malware similar to viruses, which multiply in order to spread to other computers over a network, usually causing damage and destroying data and files.
2.4 Ransomware: is a form of malware that blocks your device, and/or encrypts your files, then forces you to pay a ransom to recover them. Ransomware has been called the favorite weapon of cybercriminals, as it requires a quick and profitable payment in a difficult-to-track cryptocurrency, Bitcoin. The code behind Ransomware is easy to obtain through online criminal markets, but defending against it is very difficult.
2.5 Keylogger: This type of malware records every user's keystroke, usually storing the acquired information and sending it to the attacker, who is looking for sensitive information such as usernames, passwords, or credit card details.
3. Famous malware attacks
As already mentioned, these types of malware are tools that make up the intelligence for executing a hacker attack. According to the researchers, there were 9.9 billion malware attacks were recorded in 2019. The malware links are intended to infect computers and devices with malware, attacking them.Let's look at some famous attacks that made use of the types of malware that were mentioned here:
3.1 Ryuk (Ransomware)
Ryuk is a type of ransomware that was hugely successful in 2018 and 2019, with its victims being chosen exclusively as organizations with little tolerance for downtime; they include daily newspapers and a North Carolina water utility, struggling with the aftermath of Hurricane Florence.
The Los Angeles Times wrote a very detailed account of what happened when their own systems were infected. A particularly dishonest feature of Ryuk is that it can disable the Windows System Restore option on infected computers, making it even more difficult to recover encrypted data without paying a ransom.
The demands for rescue were particularly high, corresponding to the high-value victims that the invaders were targeting; a wave of holiday attacks showed that the invaders were not afraid to ruin Christmas to achieve their goals.
Analysts believe Ryuk's source code is largely derived from Hermes, which is a product of North Korea's Lazarus Group.
However, this does not mean that Ryuk's own attacks were carried out in the country; McAfee believes that Ryuk was built on code purchased from a Russian-language provider, in part because the ransomware does not run on computers whose language is defined as Russian, Belarusian or Ukrainian. How this Russian source acquired the North Korean code is unclear.
The Los Angeles Times wrote a very detailed account of what happened when their own systems were infected. A particularly dishonest feature of Ryuk is that it can disable the Windows System Restore option on infected computers, making it even more difficult to recover encrypted data without paying a ransom.
The demands for rescue were particularly high, corresponding to the high-value victims that the invaders were targeting; a wave of holiday attacks showed that the invaders were not afraid to ruin Christmas to achieve their goals.
Analysts believe Ryuk's source code is largely derived from Hermes, which is a product of North Korea's Lazarus Group.
However, this does not mean that Ryuk's own attacks were carried out in the country; McAfee believes that Ryuk was built on code purchased from a Russian-language provider, in part because the ransomware does not run on computers whose language is defined as Russian, Belarusian or Ukrainian. How this Russian source acquired the North Korean code is unclear.
3.2 Stuxnet (Worms)
Probably the most well-known attack was the complex and multifaceted malware that shut down uranium enrichment centrifuges in Iran, delaying the country's nuclear program for several years. The Stuxnet pioneered the issue on the use of cyberweapons against industrial systems.
At the time, there was nothing more complex or ingenious than Stuxnet - the worm was able to spread imperceptibly via USB sticks and penetrate even computers that were not connected to the Internet or local networks.
The worm got out of control and quickly spread around the world, infecting hundreds of thousands of computers. However, it was unable to damage these computers; it had been created for a very specific task.
The worm manifested itself only on devices operated by Siemens software and programmable controllers. On these machines, he reprogrammed these controllers, and then, by greatly increasing the rotational speed of uranium enrichment centrifuges, he ended up physically destroying them.
3.3 Bat Rabbit (Virus)
In October 2018, the Bad Rabbit virus even caused delays at a Ukrainian airport because employees processed data manually, as well as affecting various media in Russia.
Bad Rabbit infected computers through a fake Adobe Flash installation. When the victim ran the downloaded file, the computer went through an encryption process.
Each of this malware was used in the combination that we already presented to you, and was executed causing terrible damage to your targets.
4. How to defend against malware?
So far I believe you have managed to understand what malware is and the damage it can do, but I want you to think to yourself: Am I a possible target to be infected? Is my company at risk of being prey?
The answer to these two questions is: Yes! There are no people or companies that are not the target of attacks through malware. And this is because the information is the “ oil ” of our age, that is, it has great value!
Small and medium-sized businesses are increasingly becoming a target for criminals.
This fact occurs because there is generally little attention to Information Security in SMEs, as well as low, or, in some cases, no investment and care for their vulnerabilities.
Thinking about it, I want to present two tools for you to keep your company safe and prevented against this evil:
4.1 Firewall
One of the measures to protect the computer against malware is to use a good firewall, a tool that limits access to the computer's ports, thus preventing intruders from entering. Therefore, only authorized users are allowed to tamper with the computer.
This feature makes it impossible to enter and exit confidential information because it controls any type of data transfer from the machine via the internet. It is a software responsible for creating a security order for data traffic, thus creating barriers to threats on the external network, thanks to the monitoring of the machine's doors.
The firewall monitors and guarantees the protection of the network and machines against internal attacks, but it is important to remember that it is not like an antivirus, as the two work in different ways, and one does not dispense with the need for the other.
This feature makes it impossible to enter and exit confidential information because it controls any type of data transfer from the machine via the internet. It is a software responsible for creating a security order for data traffic, thus creating barriers to threats on the external network, thanks to the monitoring of the machine's doors.
The firewall monitors and guarantees the protection of the network and machines against internal attacks, but it is important to remember that it is not like an antivirus, as the two work in different ways, and one does not dispense with the need for the other.
4.2 Antivirus
Antivirus is software that detects, prevents, and acts on the removal of malicious software programs, which are malware. Antivirus is a program used to protect and prevent computers and other devices from code or viruses, in order to provide more security to the user.
The antivirus works with several identification methods to prevent viruses from entering, including automatic updating, scanning, quarantine, and other means.
An important note is the regular update of the antivirus, which is the minimum necessary to improve its performance within the system.
5. Conclusion:
Malware is a common threat to computer networks, and therefore to companies. As we have seen, this is due to the fact that they are fundamental pieces in attacks aimed at the theft of information and data, as well as damage to the business.
0 comments:
Post a Comment