Know Your Enemy to Defeat It

By Bob Kane
6/30/2006 4:40:00 PM

From the very first virus in the wild -- "Elk Cloner" -- which infected Apple II systems back in 1982, to "Sasser", "Blaster" and "MyDoom", viruses are as much a part of the PC as the operating system. Unfortunately, their role on the PC has evolved from simple jokes to causing millions of dollars in damage due to employee hours consumed and hardware replacement costs. Add to that the more difficult to measure costs of lost productivity and damage to a company's reputation and the total costs of viruses is put somewhere between $10 and $100 billion/year. No matter how you measure it, viruses cost money and the cost of dealing with them needs to be a part of your IT budget.

Knowing this, the best thing for you and your team to know about viruses--or the more common term now used to describe all malicious software--and malware is what they are and what they do. Armed with this information, it becomes much easier for you to identify, contain and eliminate malware and minimize the damage it can do to your networked systems. Armed with this information you should be better able to budget for controlling and managing malware.

Three categories of malware

All malware is considered bad but how you deal with it depends upon the particular type of malware you encounter. The challenge is how a malware author combines functions for a destructive piece of code combined with how malware evolves in the wild; it's difficult to categorize malware into simple categories. But that won't stop us from trying.

At a base level, if a program or script is designed with a malicious purpose, it should be considered malware. Early viruses which simply popped messages on the user's screen without doing anything else destructive would probably not be considered malware. However, these seemingly harmless programs today are used as Trojan Horses to gain access to a user's system and get the user to perform a task by misrepresenting itself. A good example of this was the "Love Letter" virus which appeared to be an email from someone you knew proclaiming their love for you and the act of opening the email launched its malicious payload. One defining characteristic of a Trojan Horse is that it does not replicate itself so an easy way to stop it is through educating users and making sure that they don't perform specific tasks which could launch the Trojan.

Some Trojans are designed to allow hackers to take control of a compromised system. These backdoor, or Remote Access Trojans (RATs) usually have both a client and server component where the compromised system acts as the server and the hacker connects to it with a client.

Another famous type of Trojan is the rootkit. Targeting a specific operating system, rootkits create a backdoor into a system and target both the host computer and other systems on the network.

Unlike a Trojan Horse, the next category of malware is a Worm. Worms use self-propagating code that can distribute itself from computer to computer through network connections. One of the more famous Worms, "Blaster" infected computers and created a denial of service attack against Microsoft's Windows Update web site. Infected computers were reported to slow down so much that they needed to be rebooted after several minutes. The potential for damage was so serious that Microsoft offered a $250,000 reward for information leading to the arrest of the original author of Blaster. Worms don't usually need user intervention to propagate from one machine to another though some Worms may require users to execute the code. Hybrid Worms may also deliver a malicious payload to the user's system in addition to spreading itself across the network. The best way to stop Worms is a combination of blocking all but the necessary ports on your network with your firewall and making sure that you stay current with all the security updates for your operating system which usually address any known service vulnerabilities which a Worm might exploit.

The last major category of malware--and the one that we are all most familiar with is the Virus. The defining characteristic of a Virus is that it will add a copy of itself to a file, document or the boot sector of a disk to replicate itself. Viruses take on many forms--it may contain a Trojan which it delivers to a computer to perform its malicious act or it may simply replicate itself on a system destroying data as it goes along. That's why it's important to understand if you get a Virus, which one it is and what behaviors it has. Some of the more insidious viruses are those that target both files and boot sectors on a disk. These viruses are sometimes referred to as multipartite viruses.

Hosts and transports

In order for malware to be effective, it needs at least two things: a host to infect and a way to get to the host through some type of transport. Hosts can take many forms but usually malware will utilize executable files, scripts, macros or attach itself to the boot sector of a disk. Malware can also utilize many different forms of transport including scanning a network for vulnerable hosts, peer-to-peer networks or network shares, removable media (such as a floppy disk or a flash drive) or what is arguably the transport mechanism of choice for most malware--email.

In part two of knowing your enemy, we'll go into more details on how to manage hosts and transports as well as look more in depth at payloads, triggers and defense mechanisms.