Contact Information

• Instructor: David J. Malan
• TFs: Rei, Dan, Eugenia
• Course Staff Email: cscie1@fas.harvard.edu
• Meetings available by appointment

Malware

What ware?

• "Malware is software designed to take over and/or damage a computer user's operating system, without his or her knowledge or approval."
  -- http://en.wikipedia.org/wiki/Malware
• "Malicious code such as a virus, worm, or Trojan, is sometimes referred to as malware."
  -- http://antivirus.about.com/library/glossary/bldef-malware.htm
• There are many different types of malware, and some malicious programs are hard to classify. The term "virus" has been overused due to its early appearance relative to other types of malware. Some of the most popular malware types are discussed below.

Viruses

• A Virus is a piece of malicious code. It typically tries to hide itself and does not ask for permission to be installed or to run. At their most benign, Viruses merely use system resources. At their worst, Viruses can remove data (or even format a hard drive), corrupt an operating system, or damage network communications.
• Viruses are typically self-replicating (or, at least, they try to be).
• It is the malicious aspect that makes computer code a Virus. A program that does bad things merely because it is poorly written or poorly conceived is said to have a bug.
• A virus is a piece of programming, usually disguised as something else, which causes an unexpected and undesirable event. Viruses are often designed so that they are automatically spread.
• Viruses come in three general flavors: file infectors, system or boot record infectors, and macro viruses.
  • File infectors try to hide themselves by attaching to files – usually executable files. They are typically executed when the user runs the infected file.
  • System or boot record infectors hide themselves in certain areas typically only used by the operating system, such as the Master Boot Record of a hard disk drive. By lurking in a system area, the virus is activated when the computer system loads into memory, thus insuring its activation rather than waiting for a user to run it.
  • Macro viruses are special kinds of file infectors. They hide in user documents (typically Microsoft Office documents) disguised as macros. A macro can be thought of as a saved sequence of commands or keyboard strokes.

Worms

• Computer worms are similar to viruses but are stand-alone software and thus do not require to attach to files (or other types of host code) to spread themselves.
• They typically try to use services that operating systems tend to run automatically. Thus, they do not require user intervention and are difficult for users to detect until there have already been serious side-effects.

Trojans

• A trojan (or trojan horse) program is malicious code that “hides in plain sight.” That is, it tricks the user into activating the malicious code by offering something that the user might want. For example, when the year 1999 turned into the year 2000, a popular trojan that made its way around the internet was a file that purported to give the user a New Year’s fireworks show. Users willingly downloaded this apparently harmless file and even emailed it to their friends.
• Trojans are so named for the famous Trojan Horse in Homer’s Iliad. The Greeks hid inside a large wooden horse that was given as a gift to the city of Troy, which was guarded by a great wall. The (extremely gullible) Trojans took the horse inside the city walls and were slaughtered when the Greeks came out.

Hoaxes

• A hoax is a false warning about a computer virus. They sometimes contain instructions to have users delete, or otherwise remove, vital files or other parts of their systems, and are usually spread through email. Hoaxes are not really viruses in that there is no malicious code; indeed, they are closer to chain letters in nature. Some consider hoaxes to be the most insidious type of Virus out there even though they do not contain a single line of code; after all, there is no way to create a software patch for human nature.
• Hoaxes often ask the user to (immediately) delete a file in their system, perhaps with an obscure name, but these files are usually harmless and quite useful, such as Windows processes.
• If unsure, put the indicated filename in a search engine such as Google. You will most often be able to find out whether the email is a hoax or a legitimate warning.

Adware

• Adware, or advertising-supported software, is any software application in which advertisements are displayed while the program is running. These applications include additional code that displays the ads in pop-up windows or through a bar that appears on a computer screen. Adware helps recover programming development costs, and helps to hold down the price of the application for the user (even making it free of charge)—and, of course, it can give programmers a profit, which helps to motivate them to write, maintain, and upgrade valuable software.
• Some adware is also shareware. What differentiates adware from other shareware is that it is primarily supported by advertising. Users may also be given the option to pay for a "registered" or "licensed" copy, which typically does away with the advertisements. Other types of shareware include demoware, nagware, crippleware, freeware, and even spyware.
• Some adware overlaps categorically with spyware if the program collects some information from the PC unbeknownst to the user and sends it out.

Spyware

• "Spyware is a piece of software that collects and sends information (such as browsing patterns in the more benign cases or credit card numbers in more malicious cases) about users or, more precisely, the results of their computer activity, typically without explicit notification."
  -- http://en.wikipedia.org/wiki/Spyware
• Evaluation Criteria for Spyware: Microsoft uses the following 5 evaluation criteria to determine whether to add a program to the definition library for detection, and what classification type, risk level, and recommendation to give it.  (excerpted from Microsoft)
  • Deceptive behaviors. Runs processes or programs on the user's computer without notifying the user and getting the user's consent. Prevents users from controlling the actions taken by the program while it runs on the computer. Prevents users from uninstalling or removing the program.
  • Privacy. Collects, uses, or communicates the user's personal information and behaviors (such as Web browsing habits) without explicit consent.
  • Security. Attempts to circumvent or disable the security features on the user’s computer, or otherwise compromises the computer's security.
  • Performance. Undermines performance, reliability, and quality of the user's computing experience with slow computer speed, reduced productivity, or corruption of the operating system.
  • Industry and consumer opinion. Considers the input from software industry and individual users as a key factor to help identify new behaviors and programs that might present risks to the user's computing experience.

Rootkits

• "A rootkit is a set of tools used by an intruder after cracking a computer system. These tools can help the attacker maintain his or her access to the system and use it for malicious purposes. Rootkits exist for a variety of operating systems such as Linux, Solaris, and versions of Microsoft Windows."
  -- http://en.wikipedia.org/wiki/Rootkit

Prevention

Common Sense Tips

• Understand what you are downloading/installing on your computer
• Third party cookies
• Beware of "Free" Software (e.g.: embedded media player in version of KaZaA)
• Read software's EULA
• Run A/V and OS updates frequently
• Run A/V and spyware scans regularly
• Keep backups of your most important/sensitive data

Technical Maneuvers

• Firewalls
• Anti-Virus Software
• Pop-up Blockers
• Other Specialized Software

Disinfection

Catching and Eradicating Malware

• There are three necessary steps to catching malware:
  • install a protection program (e.g. an anti-virus application, or a spyware-removal application)
  • keep definitions ("signatures") up to date
  • ensure that the protection program runs when it must (usually automated to run periodically)

• It also helps to know some symptoms of contagion:
  • browser hijacking
  • incessant pop-ups
  • unusual/increased resource usage (RAM, CPU, etc.)

• Definitions (also known as "signatures") are patterns that the protection program looks for to identify malware. Definitions are frequently updated to keep pace with new threats as they are written. Vendors typically make definition updates freely available on their websites.

• Removing malware can be handled in different ways, depending on the protection program installed and the newness/cleverness of the virus. Typically, protection programs can divorce the malicious code from the file/system/service to which it is attached. Sometimes, however, more drastic measures need to be taken--such as file deletion or, in extreme cases, reinstalling the OS.

Demos

• Using HijackThis
• Installing and Using AVG
• Installing and Using Spybot
• Activating Windows Firewall
  
• Popup blocking in Internet Explorer and Firefox
• Booting into safe mode
• Installing and using other specialized tools for malware eradication
• Getting information online about specific malware infections
  • Symantec Security Response
  • McAfee Threat Center
  • CERT

Extras

More Info

• Malware: http://en.wikipedia.org/wiki/Malware
• Viruses: http://en.wikipedia.org/wiki/Computer_virus
• Adware: http://en.wikipedia.org/wiki/Adware
• Computer Security: http://en.wikipedia.org/wiki/Computer_security
• Complaint to the FTC regarding Unfair and Deceptive Online Marketing Practices

Resources

• How-To: Use AVG Anti-Virus
• How-To: Use McAfee VirusScan
• How-To: Windows Safe Mode
• How-To: Spybot - Search and Destroy
• Housecall - A free virus scan from the Internet
• Stinger - A free tool for quick removal of the most malicious viruses known.