Malicious code
Harmful software code such as viruses and worms.
Learning Objectives
- Define malicious code (malware) and identify its main types.
- Distinguish a virus from a worm.
- Explain what a Trojan horse and ransomware do.
- Describe how bots and botnets are used in attacks.
Explanation
Malicious code (malware) is harmful software that includes viruses (replicate file to file), worms (spread computer to computer), Trojans (look benign but harm), ransomware (lock files for ransom), and bots (remotely controlled zombie computers).
Malicious code (sometimes referred to as 'malware') includes a variety of threats such as viruses, worms, Trojan horses, ransomware, and bots. Some malicious code, sometimes referred to as an exploit, is designed to take advantage of software vulnerabilities in a computer's operating system, web browser, applications, or other software components. Exploit kits are collections of exploits bundled together and rented or sold as commercial products, often with slick user interfaces.
A virus is a computer program that has the ability to replicate or make copies of itself and spread to other files. In addition to the ability to replicate, most computer viruses deliver a 'payload' — which may be relatively benign (such as displaying a message) or highly destructive (destroying files, reformatting the hard drive, or causing programs to run improperly).
A worm is designed to spread from computer to computer and does not necessarily need to be activated by a user or program to replicate itself. The Slammer worm, for example, targeted a known vulnerability in Microsoft SQL Server and infected more than 90% of vulnerable computers worldwide within 10 minutes. A Trojan horse appears to be benign but then does something other than expected; it is not itself a virus because it does not replicate, but is often a way for viruses or other malicious code to be introduced. Ransomware locks a computer or files and demands payment to unlock them.
Bots (short for robots) are a type of malicious code that can be covertly installed on a computer when connected to the Internet. Once installed, the bot responds to external commands sent by the attacker; the computer becomes a 'zombie' controlled by a 'bot-herder.' Botnets are collections of captured computers used for malicious activities such as sending spam, participating in DDoS attacks, stealing information, and storing network traffic for later analysis. Backdoors are features of viruses, worms, and Trojans that allow an attacker to remotely access a compromised computer.
Key Points & Important Terms
Key Points
- •Malicious code = viruses, worms, Trojan horses, ransomware, and bots.
- •A virus replicates file to file and delivers a payload.
- •A worm spreads computer to computer without user activation.
- •A Trojan horse looks benign but does harm; it does not replicate.
- •Ransomware locks files/computers and demands payment.
- •Bots are zombie computers controlled remotely; groups form botnets.
Important Terms
- Malicious code (malware)
- Variety of threats including viruses, worms, Trojan horses, ransomware, and bots.
- Virus
- A computer program that can replicate itself and spread to other files, often delivering a payload.
- Worm
- Malware designed to spread from computer to computer without user activation.
- Trojan horse
- Malware that appears benign but does something other than expected; often a delivery vehicle for other malware.
- Ransomware
- Malware that locks a computer or files and demands payment to unlock them.
- Bot / botnet
- Malicious code covertly installed on a computer to respond to attacker commands; a collection of bots forms a botnet.
- Exploit kit
- A collection of exploits bundled together and rented or sold as a commercial product.