Types of Malware: Threats, Attacks, and Vulnerabilities [Security+]

Multipartite Virus

→ A computer virus that *infects multiple targets* within the same system.

More Virus Types

→ Multipartite Virus → Armored Virus → Polymorphic Virus

Worms

→ A *self-replicating computer program*. It uses a network to send copies of itself to other nodes, and it may do so without any user intervention. → Can autonomously replicate itself across networks → One difference between a Trojan Horse and a Worm is that Worm self-replicates while the Trojan Horse does not.

Virus

→ A computer program that can *copy itself* and *infect a computer without* the permission or knowledge of the owner. → A security threat is a system that *requires interaction from a user*.

Botnet

→ A jargon term for *a collection of software robots*, or bots, that *run autonomously and automatically*. → It can be used to perform a *Denial of Service (DoS)* or *Distributed Denial of Service (DDoS)* attack.

Rootkits

→ A malware which consists of a program designed to *hide or obscure the fact* that a system has been compromised. → Hides its processes, applications, and files from being detected. → An attacker may use a rootkit to replace vital system executables which may then be used to hide processes and files the attacker has installed along with the presence of the rootkit itself. → If you believe that there is a rootkit installed on a server, the most effective action would be to reformat and reinstall the operating system.

Logic Bomb

→ A piece of code intentionally inserted into a software system that will set off a malicious function when *specified conditions are met.* → A type of malicious attack that is *set off by a specific event, date, or time.* → Not able to be discovered by an antivirus scan. → Code review and change management processes are the best way to stop logic bombs from showing up in your applications.

Adware

→ A software *installed that automatically* displays and *downloads advertising material* when a user is online. → It comes in the form of banners, pop-ups, browser search bars, etc. → Typically downloaded secretly and has the potential to continue to install more of itself or other malware as long as the user is online.

RAT (Remote Access Trojan)

→ A software that is used by a malicious attacker to *remotely control a system* without being allowed explicitly by the owner. → Before a remote control trojan can be effective, it needs to be launched on the victim's computer, *this usually requires human interaction.* → Normally, this is accomplished through email, like the most viruses, or through fake downloads masquerading as legitimate software.

Spyware

→ A type of malware that is installed on computers and that *collects information* about *users without their knowledge*. → Typically, spyware is secretly installed on the user's personal computer or on a shared computer. → Spyware can negatively affect confidentiality.

Polymorphic Virus

→ A type of stealth virus that attempts to avoid detection and removal by frequently *changing its file and process names*. → changes to void detection

Trojan or Trojan Horse

→ Describes a class of computer threats that appears to *perform a desirable function* but, in fact, performs undisclosed malicious functions.

Keylogger

→ Records every keystroke on a device, trying to pick out patterns that synchronize with certain information. → Often used covertly and remotely using the software in order to *record sensitive information* such as passwords, credit numbers, etc. → It can come packaged with other types of malware, such as Trojans.

Backdoor

→ Uses a method of *bypassing* normal authentication. → It can take the form of *any type of virus* that has found a way around conventional security. → Many backdoors are installed by malware so that other malware has an *easier time* accessing the user's computer. → Often introduced as a *rootkit*.

Types of Malware

→ Virus → Ransomware → Worm → Trojan → Rootkit → Keylogger → Adware → Spyware → Bots → RAT → Logic Bomb → Backdoor

Armored Virus

→ Wrapped in layers of encryption and complex code to make it *difficult for researchers to take part* in a lab.

Ransomware

→ locks your computer or encrypts your data and threatens to delete it unless you pay a ransom to the attacker. → need to reimage