Chapter 17: Viruses, Worms, Trojans, and Other Malicious Code

Overview

Malicious code has evolved dramatically in the past decade . In this chapter we discuss the types of malicious code that organizations are most likely to encounter. We provide both an overview of these types of malicious code as well as recommendations on how organizations can protect themselves against it.

This chapter will provide information on the following:

• Types of Malicious Code and Security Risks Viruses, worms, bots, bot networks, Trojans, spyware, adware, and phishing attacks.

• Common Malicious Code Behavior What malicious code does when it gets onto your system, ranging from file modification to process termination.

Since the inception of computer viruses, never have we been faced with the volume and diversity of new malicious code than we are today. Each year, the sheer number of new malicious code threats continues to eclipse the last. Malicious code authors today are armed with increasingly sophisticated toolkits from which to develop new variants of their code. In addition, freely available source code makes the creation of a new variant as simple as changing a few lines of code and recompiling. This combined with the ease with which individuals can exchange information on the Internet today has created a new epidemic .

While the more successful self-propagating worms have infected millions of consumer and enterprise computer systems, we are fortunate (if you could call it that) that most of them have focused on either the theft of information, or the act of propagation itself, rather than the destruction of our data. Certainly nothing has precluded them from doing so, other than the author's intent. Given the potential, we are fortunate that no more serious catastrophes have occurred.

Conversely, some argue that destructive worms would be preferred. Due to their self-destructive nature, they result in the elimination of those hosts containing the vulnerabilities that they exploit. Just like Darwinian natural selection, the overall security of Internet hosts would be improved. A parallel can be drawn between HIV and Ebola, the latter being much faster and eliminating the host before it can spread further, while the first lays dormant for lengthy periods while continuing to spread.

In this chapter we'll discuss the various types of malicious code seen today, and give examples of each. While malicious code can traditionally be split into distinct categories, such as worms, Trojans, and spyware, a noticeable shift has taken place causing these lines to blur. More recent examples of malicious code exhibit the traits of more than one of these, combining their functionality into new, more insidious strains of threats.