The chances of you watching this video and never having to deal with malware is pretty small.
And in this episode what I want to do is let's just talk about malware.
Now to get things started.
What I want to say is that malware is nothing more than software that is running on your system that
you don't want it there and B it may or may not be doing something naughty.
In most cases it's doing something naughty.
So what I want to do in this episode is go through each of the different types of malware that are listed
on the exam starting with a virus.
Now it makes me laugh a little bit when I see the word virus on the exam because really viruses are
very old fashioned term viruses go back to the mid 1980s arguably and a virus is a piece of software
that somehow gets on your computer.
Keep in mind we're talking about before internet.
So back in the old days a virus would get on your computer through a floppy disk.
You ever heard of those or more modern maybe a thumb drive.
So what would happen is a virus would get on your system.
It would attach itself often to operating system files or something like that and it would go ahead
and do two things.
Number one it would propagate.
So anytime someone else threw in a floppy disk or punched in another thumb drive well the viruses job
was to get itself onto that removable media so it could spread itself out to other different types of
devices.
The other thing that it does is that a virus will activate.
Now when we talk about activation back in the old days they would do amusing cute things like the famous
falling letters virus or maybe you would see something you would put a happy face up on your screen
but it didn't take very long for viruses to start doing really terrible things like for example erasing
the boot sector on your hard drive.
So the term virus is a little bit dated in that really because we're so internet connected now we'd
have to take some broader views so going with that.
Let's go ahead and talk about where
now.
When I say ad where all I'm talking about are programs that try to put ads up so they're pretty much
web centric.
And what will happen is you'll be on some web page and suddenly something's going to pop up saying Oh
by this ad where when it first came out years ago was in many people's opinion kind of a good thing
you know you'd be trying to buy flowers from one website and then all of a sudden this thing would pop
up and go we will sell you the same flowers for half price.
Over time it became noxious.
And we decided that ad where it was also a very very bad thing.
The next type of malware you're going to see on the exam is spyware.
Now spyware is kind of an interesting term but basically what it means is that spyware is some form
of malware that is hiding itself from you so you don't see it up on the screen or anything but what
it's doing is it's phoning home one way or another.
It could be tracking what you're doing in terms of web browsing it could be stealing cookie information.
The bottom line is is that spyware is something that we really really don't want on our systems.
A Trojan horse or as I say a trojan is a piece of software that does something like this.
No no no that's a real Trojan horse.
What we're talking about when we say Trojan Horse we're talking about a piece of software that is running
on your system and it may do something you could be a game or a chat tool or whatever.
So it's doing something nice but it's also doing something naughty in the background.
So Trojan horses are not like viruses they don't propagate on their own.
There has to be something compelling about that application that says oh I want to download this and
run it type of thing.
Now that type of Trojan is kind of old fashioned these days.
What we tend to see more than anything else when we talk about trojans are what we call remote access
Trojans a remote access trojan is a Trojan.
But the big differences is it doesn't do anything naughty until somebody in a remote location goes ahead
and manually turns it on to do whatever naughtiness that it's going to do.
So when we're talking about Trojan horse we've got the classic Trojans and then we have the remote access
trojan.
So when you're talking about a trojan remember it's a piece of software that something like that.
Next is ransomware or crypto malware.
Same term.
Of what we're talking about here is a type of now where that does in fact a lot of people that are one
of the most evil malwares out there.
And it simply does something Gere's system locks it in some way that you can't get to it until you pay
somebody some money to have them go ahead and unlock your system.
Now ransomware has been out for a few years now probably started originally with the infamous crypto
locker but there's a lot of derivations out there these days that can do all kinds of naughtiness and
it is a big big problem.
Now next I want to talk about one of my absolute favorites.
The logic bomb
a logic bomb has some similarities to a remote access trojan a logic bomb is a program that is sitting
on a computer.
It doesn't propagate.
It has to activate but whereas a remote access trojan would be activated remotely.
A logic bomb kicks off because some event has taken place probably one of the best examples of a logic
bomb would be say I'm a I'm a disgruntled employee and I can actually create a logic bomb that will
only go off if an administrator disables my account for example if I was fired.
Now there's a lot of malware out there that could be argued that it could be for goodness as much as
for badness.
So the two I'm talking about right now are root kits and back doors now a root kit and the name root
is actually a clue is a piece of software that grabs administrative or very very big privileges so that
it can do things to other stuff that's running on the computer.
Probably the most famous rootkit of all was the famous Sony rootkit back a long time ago.
And it's a great example of is it good or is it bad because that Sony rootkit was used for digital rights
management.
So in that case it was good for Sony.
I don't know about the rest of us though root kits are particularly notorious to detect because of the
nature of their administrative or root level privileges.
It can be a challenge to actually detect and get rid of them so it's always a big deal.
Along with that is going to be a back door now a back door is a piece of software that has some intentionally
derived way to get into it to do something.
Now if I were a developer of software for example and I would write a backdoor that would allow me to
access somebody in a remote situation so I could work on it that might be a good thing.
I could be that saying to the helper that I could put a backdoor into my software application that erases
it if you don't pay me on time.
That might be a bad thing.
So when we talk about back doors when we talk about root kits keep in mind that there is some argument
for goodness.
But generally when we'd call them now where they're doing something bad now the next thing I want to
talk about are isn't really so much malware itself as some aspects of what malware can do and probably
the best first example is going to be what we call polymorphic malware
polymorphic malware is malware that changes itself.
The reason it changes itself is because any time now where program is going to be using digital signatures
to recognize these different types of bits of malware literally.
Ones and zeroes that define these different pieces of Naughtie programs.
So a polymorphic is simply going to change its own code just enough to confuse the digital signatures
of your anti-malware program.
And they are extremely common today.
Now an armored virus is a little bit different an armored virus is a virus that is designed to make
it hard for the anti-malware people to figure out what's going on.
The number one tool we use to get rid of malware is we get a piece of malware and then we reverse engineer
it to see how it ticks.
So an armored virus is going to well first of all it's going to have into it's code little like memory
locations and stuff that make it hard to actually find the malware itself.
And then along with that it's going to have a lot of superfluous code that does absolutely nothing whose
only job is to confuse the reverse engineers.
So what we're talking about an armored virus or we're talking about polymorphic that isn't just one
piece of malware it's just aspects of what they might do.
Now speaking of aspects we've talked about a lot of different pieces of malware in here.
But one of the things we haven't talked about is what do they do.
And probably one of the more common things that we see is what we call a key logger key loggers simply
as the name infers will record keystrokes letting people capture passwords or private information or
whatever they might want.
So a lot of different types of malware will use a key logging function to get bad information.
Now the other way we'll see key loggers in a lot of situations is there'll be some type of little Dongola
P.S. to dongle that plugs into a keyboard or little US beat device that you plug in and that device
is simply there to record keystrokes
in.