Malicious Code, and Computing Security

1. Malicious Code, and Computing Security Dr. Theodore Cleveland University of Houston CIVE 1331 – Computing for Engineers Lecture_003A

2. Malicious Code • Definition: computer programs that waste or steal resources. • Types of Malicious Code: • Viruses • Trojan Horses • Sniffer • SpyWare • Logic Bomb

3. Trojan Horse(s) • Definition: A destructive program that masquerades as a benign application. • Do not self-replicate

4. Sniffer • Definition: A program and/or device that monitors data traveling over a network • On TCP/IP networks, where TCP/IP packets are sent, the program is often called a packet sniffer.

5. SpyWare • Definition: A program that monitors, collects and transmits information without the user’s knowledge. • Collects information by monitoring keystrokes, chat programs, word processors or by reading Browser cookies. • Sends information back to author through internet connections. • Usually created by advertising companies that sell information such as e-mail addresses, password and even credit card numbers • Commonly packaged within peer-to-peer file swapping clients

6. Spyware • Eats network bandwidth • Uses system resources • Often unstable and cause of system crashes or general system instability • Licensing agreements that accompany some software packages sometimes warn user that a spyware program is bundled with in the software being installed

7. Logic Bomb or Time Bomb • Definition: code added to software or operating system that lies dormant until a predetermined time or event when it becomes triggered. • Behavior similar to viruses/trojan once activated. • Examples of behavior: reformatting hard drive, corrupting data or altering data

8. Viruses • Definition: An intentionally self-replicating piece of malicious code that requires a “host”. • The term Virus is often used incorrectly to describe Trojan Horses or even spyware.

9. Viruses (2) • Author of Fprot anti-virus defines a virus as • Being able to create copies of itself • Replication is intentional (not a side-effect) • Some of the replicants are viruses by the same definition • A virus has to attach itself to a “host” in the sense that execution of the host implies execution of the virus

10. Viruses(3) • May transmit itself by • Network File Systems • Floppy disk, CDs (physical media) • Can infect a computer • Automatically (above) • User invitation (e-mail, web browser, etc.)

11. Boot Sector Viruses • A BSV infects boot sectors on diskettes and/or hard disks. On diskettes, the boot sector normally contains code to load the operating system files. The BSV replaces the original boot sector with itself and stores the original boot sector somewhere else on the diskette or simply replaces it totally. When a computer is then later booted from this diskette, the virus takes control and hides in RAM. It will then load and execute the original boot sector, and from then on everything will be as usual. Except, of course, that every diskette inserted in the computer will be infected with the virus, unless it is write-protected. • Most BSVs are also able to infect hard disks, where the process is similar to that described above, although they usually infect the master boot record instead of the DOS boot record.

12. Program Viruses Program viruses, the second type of computer viruses, infect executable programs, usually .COM and .EXE files, but they sometimes also infect overlay files, device drivers or even object files. An infected program will contain a copy of the virus, usually at the end, in some cases at the beginning of the original program, and in a few cases the virus is inserted in the middle of the original program. • 2 Means of Infection • Resident • Direct Action • When an infected program is run, the virus may stay resident in memory and infect every program run. Viruses using this method to spread the infection are called "Resident Viruses". • Other viruses may search for a new file to infect, when an infected program is executed. The virus then transfers control to the original program. Viruses using this method to spread the infection are called "Direct Action Viruses". It is possible for a virus to use both methods of infection.

13. Program Viruses (continued) Most viruses try to recognize existing infections, so they do not infect what has already been infected. This makes it possible to inoculate against specific viruses, by making the "victim" appear to be infected. However, this method is useless as a general defense, as it is not possible to inoculate the same program against multiple viruses.

14. Application Viruses • The third type of viruses are application viruses, which do not infect normal programs, but instead spread as "macros" in various types of files, typically word-processor documents or spreadsheets. In general, viruses are just programs - rather unusual programs perhaps, but written just like any other program. It does not take a genius to write one - any average assembly language programmer can easily do it. • Fortunately, few of them do.

15. Virus Misconceptions A virus cannot appear all by itself, it has to be written, just like any other program. Not all viruses are intentionally harmful - some may only cause minor damage as a side effect - however, there is no such thing as a "harmless" virus. Reading plain data from an infected diskette cannot cause an infection. (However, it is not trivial to determine what "plain data" is) A write-protected diskette cannot become infected, if the hardware is working properly.

16. Protect Yourself from Viruses There is no sure-fire way to protect yourself from getting a virus or trojan horse. The best way to protect yourself is to create backups. Backups not only protect from viruses, but also hardware failure. File Backups Keep good backups (more than one) ofeverything you do not want to lose. It is a good practice to keep all your files in one directory tree to facilitate this process. System Backups Drive imaging software can back up the entire contents of your hard drive and allow a 1-step recovery method in the case of a critical failure (e.g. blue screen on bootup) Norton Ghost is the leading software for this purpose. It is usually available for around $20 after rebate from many vendors.

17. Protect Yourself from BSV’s BSV’s (Boot Sector Viruses) proliferate by the sharing of floppy disks, and they usually infect when a system attempts to boot off a floppy disk. • Never boot from a floppy disk • Keep all floppy disks write-protected until you need to write to them • Never boot a computer with a hard disk from a diskette because that is the only way the hard disk could become infected with a boot sector virus. (Well, strictly speaking, it can happen if you run a "dropper" program too, but that happens rarely). If your BIOS allows you to change the boot sequence to "C: A:", do it. This will give you very good protection against boot sector virus infections • Should you, by accident, have left a non-bootable diskette in drive A: when you turn the computer on, the message Not a system disk may appear. If the diskette was infected with a virus, it will now be active, but may not have infected the hard disk yet (Most boot sector viruses will do it right away, however). If this happens, remove the diskette from the A: drive and turn the computer off (or press the reset button). It is important to note that pressing Ctrl-Alt-Del is not sufficient, as a few viruses can survive that.

18. Protecting Yourself from Viruses • When downloading software, always save the software to your hard disk first, and then scan the file with an antivirus program. Never open a downloaded file directly. • It is even advisable to scan software with several antivirus programs from different manufacturers, as no single scanner is able to detect all viruses. • Obtain Shareware, Freeware and Public-Domain software from the original author or reliable distribution sites, if at all possible.

19. Do you have a Virus? • Does it take longer than usually to load programs ? • Do unusual error messages appear ? • Does the memory size seem to have decreased ? • Do the disk lights stay on longer than they used to ? • Do files just disappear ?

20. If you do have a Virus DON'T PANIC! Sometimes a badly thought out attempt to remove a virus will do much more damage than the virus could have done. If you are not sure what to do, leave your computer turned off until you find someone to remove the virus for you. Finally, remember that some viruses may interfere with the disinfection operation if they are active in memory at that time, so before attempting to disinfect you MUST boot the computer from a CLEAN system diskette. It is also a good idea to boot from a clean system diskette before scanning for viruses, as several "stealth" viruses are very difficult to detect if they are active in memory during virus scanning

21. Other Misconceptions It used to be the case that a virus could not infect a computer unless it was booted from an infected diskette or an infected program was run on it, but alas, this is no longer true. It is possible for a virus infection to spread, just by the act of reading an infected Microsoft Word document, for example, or through use of Outlook, to name two well-known applications. It also used to be the case that a virus could not infect data files or spread from one type of computer to another - a virus designed to infect Macintosh computers could not infect PCs or vice versa, but with the appearance of application viruses this has changed as well - there are now a few viruses that can infect WinWord as well as MacWord.

22. Anti-Virus Programs • Anti-Virus programs find and inoculate computer viruses • New viruses/virus strains are created daily. It is very important to update your anti-virus program with the latest virus definitions • UH students can use the site-licensed McAffee Virus Scan (www.uh.edu/software)

23. Network Attacks • Definition: causing harm to computer or network remotely by exploiting networking protocols and networking software. • DoS attack – “Denial of Service” floods a network with useless network traffic, preventing legitimate traffic. • Teardrop attack – Exploits a bug in the way Windows based clients reconstruct TCP/IP Packets

24. Network Security • The best defense from network intrusion is a good firewall. A firewall can stop communication initiated by an outside party, which is usually how hackers find holes to exploit a system. • Firewalls are available in the form of hardware and software. • Hardware firewalls are preferential because they are less likely to be compromised by a virus or trojan horse. • Firewalls must be configured correctly to be effective.

25. File Names • A filename under MS-DOS consisted of an 8-letter “name” and a 3-letter extension. This is sometimes referred to as 8.3 or “eight dot three” filenames • 8.3 filenames do not support spaces, filenames must be made with a printable ASCII character. • When writing a program, it is important to use the 8.3 convention due to limitations of programming and scripting limitations. • Windows 95+/Unix support from 32 to 255 characters filenames, which support the use of spaces in the filename.

26. File Types (File Extensions) • The letters after the last period in a filename are referred to as the extension • Extensions are generally limited to three characters for cross-system compatibility. • An extension DOES NOT determine the file type. (e.g. changing the extension of a file will not change the contents or type of file) • There should however be a correspondence between the file type and the extension. • Note that the extension is commonly used to refer to the file type. (e.g. a “.xxx” file is often referred to as an “Ex Ex Ex” file)

27. File Types (continued) • Windows uses the extension of a file to determine what program to use to open the file. • In Windows Explorer, click >>Tools>>Folder Options>>File Types tab • Windows will even change the icon associated with a file extension to reflect the application used to open the file

28. File Types Virus Warning • By default some installations of Windows will hide file extensions. This practice allows many trojan horses to masquerade as a different file type. • Consider the file: AnnaKournikova.jpg.vbs Which would appear as “AnnaKournikova.jpg” on the desktop