Professional Documents
Culture Documents
Lecture 2
Lecture 2
Fundamentals
Lecture 2
Malware and Malicious Code
Types of Malware
Cyber criminals target user’s end devices through the installation of malware. Malware is a
code or software designed to damage, disrupt, steal, or inflict some other ‘bad’ or illegitimate
action on data, hosts, or networks. The three most common types of malware are Virus,
Worm, and Trojan horse.
Viruses - A virus is malicious executable code attached to another executable file, such as a
legitimate program. Most viruses require end-user initiation, and can activate at a specific
time or date.
Worms - Worms are malicious code that replicates by independently exploiting vulnerabilities
in networks. Worms usually slow down networks. Whereas a virus requires a host program to
run, worms can run by themselves. Other than the initial infection, worms no longer require
user participation.
Trojan horse - A Trojan horse is malware that carries out malicious operations under the
guise of a desired operation such as playing an online game. This malicious code exploits the
privileges of the user that runs it. A Trojan horse differs from a virus because the Trojan binds
itself to non-executable files, such as image files, audio files, or games.
Common Threats and Attacks
Viruses
• A virus is a type of malware that spreads by inserting a copy of itself into another program.
• After the program is run, viruses spread from one computer to another, thus infecting the computers.
• A simple virus may install itself at the first line of code in an executable file.
• Viruses can be harmless, for those that display a picture on the screen, or they can be destructive.
They can also modify or delete files on the hard drive.
• Most viruses spread by USB memory drives, CDs, DVDs, network shares, and email. Email viruses are a
common type of virus.
Common Threats and Attacks
Trojan Horses
• Trojan horse malware is a software that appears to be legitimate, but it contains malicious code which
exploits the privileges of the user that runs it.
• Trojans are found attached to online games.
• Users are commonly tricked into loading and executing the Trojan horse on their systems
• The Trojan horse concept is flexible.
• It can cause immediate damage, provide remote access to the system, or access through a back door.
• Custom-written Trojan horses with a specific target are difficult to detect.
Common Threats and Attacks
Trojan Horses Classification
• Trojan horses are usually classified according to the damage that they cause, or the manner in which they
breach a system.
Common Threats and Attacks
Trojan Horses Classification (Contd.)
The types of Trojan horses are as follows:
Displays annoying pop-ups to generate revenue for its author. The malware may analyze user
Adware interests by tracking the websites visited. It can then send pop-up advertising pertinent to those
sites.
Common Threats and Attacks
Common Malware Behaviors
• Computers infected with malware often exhibit one or more of the following symptoms:
• Appearance of strange files, programs, or desktop icons
• Antivirus and firewall programs are turning off or reconfiguring settings
• Computer screen is freezing or system is crashing
• Emails are spontaneously being sent without your knowledge to your contact list
• Files have been modified or deleted
• Increased CPU and/or memory usage
• Problems connecting to networks
• Slow computer or web browser speeds
• Unknown processes or services running
• Unknown TCP or UDP ports open
• Connections are made to hosts on the Internet without user action
• Strange computer behavior
• Note: Malware behavior is not limited to the above list.
Common Network Attacks - Reconnaissance, Access, and Social Engineering
Types of Network Attacks
• Malware is a means to get a payload delivered .
• When a payload is delivered and installed, it can be used to cause a variety of network-related attacks
from the inside as well as from the outside.
• Network attacks are classified into three categories:
• Reconnaissance Attacks
• Access Attacks
• DoS Attacks
Common Network Attacks - Reconnaissance, Access, and Social Engineering
Reconnaissance Attacks
• Reconnaissance is information gathering.
• Threat actors use reconnaissance (or recon) attacks to do unauthorized discovery and mapping of
systems, services, or vulnerabilities.
• Recon attacks precede access attacks or DoS attacks.
Common Network Attacks - Reconnaissance, Access, and Social Engineering
Reconnaissance Attacks (Contd.)
The techniques used by malicious threat actors to conduct reconnaissance attacks are as follows:
Technique Description
Perform an information The threat actor is looking for initial information about a target. Various tools can be used,
query of a target including the Google search, organizations website, whois, and more.
Initiate a ping sweep of The information query usually reveals the target’s network address. The threat actor can
the target network now initiate a ping sweep to determine which IP addresses are active.
Initiate a port scan of This is used to determine which ports or services are available. Examples of port scanners
active IP addresses include Nmap, SuperScan, Angry IP Scanner, and NetScanTools.
This is to query the identified ports to determine the type and version of the application
Run vulnerability and operating system that is running on the host. Examples of tools include Nipper, Secuna
scanners PSI, Core Impact, Nessus v6, SAINT, and Open VAS.
The threat actor now attempts to discover vulnerable services that can be exploited. A
Run exploitation tools variety of vulnerability exploitation tools exist including Metasploit, Core Impact, Sqlmap,
Social Engineer Toolkit, and Netsparker.
Common Network Attacks - Reconnaissance, Access, and Social Engineering
Access Attacks
• Access attacks exploit known vulnerabilities in authentication services, FTP services, and web services
to gain entry into web accounts, confidential databases, and other sensitive information.
Password Attacks
• The threat actor attempts to discover critical system passwords using a variety of password cracking
tools.
Spoofing Attacks
• The threat actor device attempts to pose as another device by falsifying data.
• Common spoofing attacks include IP spoofing, MAC spoofing, and DHCP spoofing.
• Trust exploitations
• Port redirections
• Man-in-the-middle attacks
• Buffer overflow attacks
Common Network Attacks - Reconnaissance, Access, and Social Engineering
Social Engineering Attacks
• Social Engineering is an access attack that attempts to manipulate individuals into performing actions
or divulging into confidential information.
• Some social engineering techniques are performed in-person or via the telephone or internet.
• Social engineering techniques are explained in the below table.
Social Engineering Description
Attack
A threat actor pretends to need personal or financial data to confirm the identity of the
Pretexting recipient.
A threat actor sends fraudulent email which is disguised as being from a legitimate, trusted
Phishing source to trick the recipient into installing malware on their device, or to share personal or
financial information.
A threat actor creates a targeted phishing attack tailored for a specific individual or
Spear phishing organization.
Also known as junk mail, this is unsolicited email which often contains harmful links,
Spam malware, or deceptive content.
Common Network Attacks - Reconnaissance, Access, and Social Engineering
Social Engineering Attacks (Contd.)
Social Engineering Description
Attack
Something for Sometimes called “Quid pro quo”, this is when a threat actor requests personal
Something information from a party in exchange for something such as a gift.
A threat actor leaves a malware infected flash drive in a public location. A victim finds the
Baiting drive and unsuspectingly inserts it into their laptop, unintentionally installing malware.
In this type of attack, a threat actor pretends to be someone else to gain the trust of a
Impersonation victim.
This is where a threat actor quickly follows an authorized person into a secure location to
Tailgating gain access to a secure area.
This is where a threat actor inconspicuously looks over someone’s shoulder to steal their
Shoulder surfing passwords or other information.
This is where a threat actor rummages through trash bins to discover confidential
Dumpster diving documents.
Common Network Attacks - Reconnaissance, Access, and Social Engineering
Social Engineering Attacks (Contd.)
• The Social Engineer Toolkit (SET) was designed to
help white hat hackers and other network security
professionals to create social engineering attacks to
test their own networks.
• Enterprises must educate their users about the
risks of social engineering, and develop strategies
to validate identities over the phone, via email, or
in person.
Sniffing - Sniffing is similar to eavesdropping on someone. It occurs when attackers examine all
network traffic as it passes through their NIC, independent of whether or not the traffic is
addressed to them or not. Criminals accomplish network sniffing with a software application,
hardware device, or a combination of the two.
Code Injections Attacks - One way to store data at a website is to use a database. There
are several different types of databases such as a Structured Query Language (SQL)
database or an Extensible Markup Language (XML) database. Both XML and SQL injection
attacks exploit weaknesses in the program such as not validating database queries
properly.
Buffer Overflow - A buffer overflow occurs when data goes beyond the limits of a buffer.
Buffers are memory areas allocated to an application. By changing data beyond the
boundaries of a buffer, the application accesses memory allocated to other processes.
This can lead to a system crash, data compromise, or provide escalation of privileges.
Network Attacks - Denial of Service, Buffer Overflows, and Evasion
Components of DDoS Attacks
The following terms are used to describe the components of a DDoS:
Component Description
A group of compromised hosts. These hosts run
zombies malicious code.
Bots are malware that is designed to infect a host
bots
and communicate with a handler system.
A group of zombies that have been infected using
botnet self-propagating malware and are controlled by
handlers.
A master command-and-control
handlers (CnC or C2) server controlling groups of zombies.
Enables unauthorized file transfer services on
botmaster end devices.
Network Attacks - Denial of Service, Buffer Overflows, and Evasion
Buffer Overflow Attack
• The threat actor uses the buffer overflow DoS attack to find a
system memory-related flaw on a server and exploit it.
• For instance, a remote denial of service attack vulnerability was
discovered in Microsoft Windows 10, where the threat actor
created malicious code to access out-of-scope memory.
• Another example is ping of death, where a threat actor sends a
ping of death, which is an echo request in an IP packet that is
larger than the maximum packet size.
• The receiving host cannot handle a packet size and it would
crash.
• Note: It is estimated that one third of malicious attacks are the
result of buffer overflows.
Network Attacks - Denial of Service, Buffer Overflows, and Evasion
Evasion Methods
The evasion methods used by threat actors include:
This evasion technique splits a malicious payload into smaller packets to bypass network
Traffic fragmentation security detection. After the fragmented packets bypass the security detection system, the
malware is reassembled and may begin sending sensitive data out of the network.
Network Attacks - Denial of Service, Buffer Overflows, and Evasion
Evasion Methods (Contd.)
Evasion Method Description
This evasion technique occurs when network defenses do not properly handle features of a
Protocol-level PDU like a checksum or TTL value. This can trick a firewall into ignoring packets that it should
misinterpretation check.
In this evasion technique, the threat actor attempts to trick an IPS by obfuscating the data in
the payload. This is done by encoding it in a different format. For example, the threat actor
Traffic substitution could use encoded traffic in Unicode instead of ASCII. The IPS does not recognize the true
meaning of the data, but the target end system can read the data.
Similar to traffic substitution, but the threat actor inserts extra bytes of data in a malicious
Traffic insertion sequence of data. The IPS rules miss the malicious data, accepting the full sequence of data.
Common Threats and Network Attacks - Denial of Service, Buffer Overflows, and Evasion
Evasion Methods (Contd.)
Evasion Method Description
This technique assumes the threat actor has compromised an inside host and wants to expand
their access further into the compromised network. An example is a threat actor who has
Pivoting gained access to the administrator password on a compromised host and is attempting to login
to another host using the same credentials.
A rootkit is a complex attacker tool used by experienced threat actors. It integrates with the
lowest levels of the operating system. When a program attempts to list files, processes, or
Rootkits network connections, the rootkit presents a sanitized version of the output, eliminating any
incriminating output. The goal of the rootkit is to completely hide the activities of the attacker
on the local system.
Network traffic can be redirected through intermediate systems in order to hide the ultimate
destination for stolen data. In this way, known command-and-control not be blocked by an
enterprise because the proxy destination appears benign. Additionally, if data is being stolen,
Proxies the destination for the stolen data can be distributed among many proxies, thus not drawing
attention to the fact that a single unknown destination is serving as the destination for large
amounts of network traffic.
Malware and Malicious Code
Email and Browser Attacks (Cont.)
Email is a universal service used by billions worldwide. As one
of the most popular services, email has become a major
vulnerability to users and organizations.
SEO Poisoning - Search engines such as Google work by ranking pages and presenting
relevant results based on users’ search queries. Depending on the relevancy of web
site content, it may appear higher or lower in the search result list. SEO, short for
Search Engine Optimization, is a set of techniques used to improve a website’s ranking
by a search engine. While many legitimate companies specialize in optimizing websites
to better position them, SEO poisoning uses SEO to make a malicious website appear
higher in search results.
www.astanait.edu.kz