In this lesson, we're going to discuss
some different types of malware that you may come across
while working as a cybersecurity or network technician.
So what is malware?
Well, malware is a shorthand term for malicious software.
This is software that's designed
to infiltrate a computer system and possibly damage it
without the user's knowledge or consent.
Simply put, malware is some kind of bad software code
that wants to do harm to our computers and our networks.
Malware comes in many varieties, including viruses, worms,
Trojan horses, ransomware, spyware, and rootkits.
The first type of malware we have is known as viruses.
A computer virus is simply made up of malicious code
that's run on a machine without the user's knowledge.
This code allows it to infect the computer
whenever that code is run.
Now, what does this look like in the real world?
Well, one of your users may have gone to a website
to download a new game, and when they did that,
they actually download an installation file
that contained a virus or malicious code inside of it.
When they ran that program to install the game,
they actually just installed the virus
onto the client machine, and now that virus has taken hold.
At this point, the virus is going to want to reproduce
and spread, and it does this
because you had a user action occur.
This was namely the opening
and running of the game's install file.
Once this has been done,
the virus can now begin to replicate
and attempt to spread further across the network.
Our second type of malware is known as a worm.
Now, a worm is a piece of malicious software
much like a virus,
but it can replicate itself without any user interaction.
This is a key distinction between a virus and a worm.
Remember I said the user had to install the program
or open a file in order to have the virus take action
and begin its replication,
but with worms, this simply isn't the case.
Worms are able to self-replicate,
and they spread throughout your network
without a user's consent or action.
This occurs because worms take advantage
of security vulnerabilities
that exist within operating systems, network protocols,
and other applications.
If the worm determines
that there's a computer on the network
that doesn't have the latest security patch installed,
it can then take advantage of that
and exploit that vulnerability
to spread from victim to victim across the entire network
or even across the internet and the entire world.
Because of this, worms can cause disruption
to your normal network traffic and your computing activities
because as they're spreading
and replicating from victim to victim,
they're also using its processing power, its memory,
and its network traffic.
It's going to be using all these different resources
and not for something that you want them to do.
Eventually, this can start slowing down your systems,
or in some cases it can cause your systems
or your networks to crash.
Worms are known for spreading far and wide over the internet
in a relatively short amount of time.
Back in 2001, there was a worm named Nimda,
which is admin spelled backwards.
Now it was able to propagate across the entire internet
in just 22 minutes.
Then in 2009, we had another worm.
This one was known as Conficker.
This is probably one of the largest worms
that we as cybersecurity professionals have seen to date.
Conficker was able to infect
between 9 and 15 million machines worldwide.
This worm was infecting as many machines as it could
by leveraging an exploit
against a missing Microsoft window security patch.
This was specifically the patch associated
with the MS08-067 security bulletin.
Now the vulnerability was a coding error
with the way Microsoft Windows
was performing file and printer sharing.
Conficker sought out those machines
that were missing the security patch,
installed this piece of code on them,
and then those machines became part of a botnet.
Ultimately, this botnet was able to be shut down
before it was used for negative or malicious purposes.
But it does show the true power of these worms
and how they can gather up lots and lots of zombies
for a botnet really quickly for use later on.
The third type of malware we have
is known as a Trojan horse.
A Trojan horse gets its name from the legendary trick
that was used during the Trojan War back in ancient Greece.
Greece and Troy were at war for 10 years
and there was no end in sight.
After a long siege,
the Greeks decided they were getting restless
and they decided they wanted to try something
a little different to get this war over with.
So they decided to construct a large wooden horse,
and they gave it to the city of Troy
as a peace offering or so the story goes.
Now this seemingly harmless gift
was actually filled with Greek soldiers,
and once it was wheeled inside the city, day turned to night
and the soldiers emerged from within the horse.
These soldiers immediately opened the walled city gates
and began letting in their fellow soldiers
that were from the invading Greek army.
They got into the city and they laid waste to it.
This was the first example of a Trojan horse.
Now in the world of cybersecurity and computer networking,
Trojan horses work much the same way.
Trojan horses are pieces of malicious code
that's disguised as a piece of harmless
or desirable software.
Basically, a Trojan says,
I'm going to perform this function for you,
and it may very well perform that desired function,
but it can also perform a malicious function too.
Now when I was a kid,
there was a new game out called Tetris
that you probably have heard of at this point,
and it was extremely popular
and everybody wanted to get a copy of it.
So a lot of times you might have a friend
who put a copy of it on a disc and they handed it to you
so you can install it at home,
and you could play this great new game too.
Well, one person was really smart
and they used a copy of Tetris
and embedded a Trojan horse inside that copy of Tetris.
Now, if you took that disc
and installed that game on your computer,
that game would launch and play just like normal.
You could play Tetris, no issue at all,
but in the background,
the Trojan horse part of this
opened up something that allowed a connection
between your system and the attacker system,
allowing them to have remote control
and steal your information or destroy your data.
This is one of the earliest examples
of what we now refer to as a RAT or Remote Access Trojan.
A RAT is a common type of Trojan
that's still widely used today.
It provides the attacker
with remote control of a victim system.
These techniques are still really used a lot today,
but instead of somebody handing you a disc,
they instead post the file on our website
and they wait for you to download it.
Remember, whenever you're downloading a program
for the internet, always be careful
because you don't know what other code
is inside of that lurking there.
Anytime you or your users are downloading a file,
you have to make sure you check it for viruses, worms,
and Trojans before you install it.
The fourth type of malware we have is known as ransomware.
If you've watched the news
or scrolled Facebook in the last year or two,
you probably already know what ransomware is
because it keeps showing up all over our news feeds.
Ransomware is a type of malware
that restricts access to a victim's computer system
or their files until a ransom or payment is received.
Essentially, someone's going to break into a network,
a server or a computer,
and then they're going to encrypt all the files
or change the passwords or do something else
to hold that system hostage until you pay up.
One day you may reboot your computer
and it says something like this,
"Your computer has been locked.
You have to pay a fine of $200
and be able to pay it through this link using Bitcoin
and able to get access back.
If you pay me, I'll give you a secret unlock code
and you can put it in that white little box
and you can hit okay and have access to all your stuff."
This is what ransomware looks like
when it targets end users.
But even more recently,
we're seeing large scale ransom attacks
against large corporations and local governments,
including oil pipelines, hospital systems,
and even city governments.
Back in 2018, the city of Atlanta got infected
with the Samsam ransomware.
This started spreading
across a lot of their systems throughout the city,
and it ended up costing them over $17 million to fix it.
They ended up not paying the ransom,
but instead they spent about $6 million in services
and contracts and software upgrades
and another $11 million in hardware upgrades
to be able to deal with the Samsam ransomware.
This made the costliest cyber attack
affecting the government in 2018,
and this was despite them not paying
the ransom demanded by the attackers.
Usually, ransomware is going to get a foothold
into your network somewhere
because of a vulnerability in a piece of software
on one of your servers or your clients.
Once it gets into the network though,
it's going to attempt to steal your data and hold it hostage.
Once they do that, you have no way to decrypt that data
unless you pay the ransom or restore from an offline backup.
The fifth type of malware we have is known as spyware.
Spyware is a type of malicious software
that's installed on your system
and it gathers information about you without your consent.
Normally, this will be installed either from a website
or some third party software
that you have installed on your system.
That software is going to look through all your files.
It's going to look through all your emails,
all of your instant messages, all your calendar invites,
and what other information you may have on your system.
It's going to look through that to gather information
and build a profile on you.
This is the best case scenario.
Now after all, spyware might just be trying to figure out
things they can advertise to you,
and in this case, we call this a thing called adware.
Now, this allows it to display advertisements to you
based on what they think you'd like best
and what you're most likely to buy.
Now in the worst case, spyware could include a key logger.
Now a key logger can allow an attacker
to capture any keystrokes you make on a victim machine,
such as the website addresses you type in,
the usernames, and even the passwords you enter.
Spyware and key loggers can collect those details
and send it all back to the attacker
complete with screenshots that they're taking
on a regular interval of your computer screen.
Now, our sixth type of malware we have
is known as a rootkit.
A rootkit is a specific type of software
that's designed to gain administrative level control
over a computer system or network device
without being detected.
Now, this is really important
because when we talk about root
or administrator level permissions,
this is the highest level of permissions
that someone can have on a system.
If you're using a Windows machine, for example,
that would be your administrator account
that allows somebody to install programs,
delete programs, open ports and shut ports.
Basically, they can do whatever they want on your system.
This type of access is known as root access
if you're using Unix, Linux or OSX,
which is a Mac operating system.
Either way, gaining administrative
or root access is great for an attacker,
but it is horrible for you and your security.
Now in our networks, the most common place
to find a root kit would be if the attacker
was able to compromise the firmware
on our routers or switches.
There have been documented cases of this
for pretty much every brand of router
and switch out there.
So it's important to keep up to date
with the latest threats based on the type of equipment
that you're using inside your networks.
Rootkits are extremely powerful
and they're really difficult to detect
because the operating system itself can be blinded to them
since they're loaded before the operating system itself is.
To detect them,
the best way is to boot from an external device
and then scan the device to ensure
that you can properly detect those rootkits.
As I said earlier in this lesson,
there are lots of different types of malware.
In this lesson, we discussed just a few of them.
We talked about viruses and worms and Trojan horses
and ransomware and spyware and rootkits,
but there are many others out there
that you're going to learn about
as you continue to advance in your cybersecurity career.