Malware

Malware is software written to damage a system or its data, or to gain unauthorized access to either. Viruses and worms are the 2 self-replicating kinds.

Both are the most destructive threats in terms of data loss, recovery time, and money. Defending against them needs frequently updated virus patterns and applied patches. See server protection for the deployment side.

Virus

A virus is malware that replicates by inserting its code into a host file. It runs when the host runs, and usually spreads through a user action such as opening an email attachment.

Resident and Transient Viruses

• Resident virus
  Loads into system RAM and stays there. Infects files on the fly by hooking into OS calls, such as file open or execute.
• Transient virus
  Non-resident. Runs only while its host program runs. Searches for files to infect during that execution and leaves memory when the host exits.

Infection Techniques

• Prepend virus
  Inserts its code at the start of the host, so it runs before the host.
• Appender virus
  Appends its code to the end of the host and rewrites the entry point to point to itself. The host runs after the virus finishes.
• Cavity virus
  Writes its code into unused padding bytes inside the host, such as compiler alignment gaps. The file size does not change, so file-size monitoring tools do not notice the infection.

Infection Marker

A virus writes a specific marker or signature byte into the header of each infected host. It checks for the marker before infecting, to avoid infecting the same file repeatedly. Repeated infection would grow the file abnormally and expose the virus.

Evading Signature Detection

Antivirus tools match known byte patterns. Viruses counter this by changing how their code looks.

• Encrypted virus
  Encrypts its body under a key and carries a small decryptor stub. The body changes with the key, but the stub stays constant and can be matched.
• Polymorphic virus
  Mutates the decryptor stub on every infection, while the decrypted body stays the same.
• Metamorphic virus
  Rewrites its entire code structure from scratch on every infection. It has no constant stub or body, so it is the highest level of obfuscation.

Worm

A worm is malware that replicates as an autonomous, self-contained program. It needs no host file and no human interaction. It finds new targets on its own, usually by exploiting a vulnerability in a network service, often a buffer overflow.

Scanning Strategies

A worm picks the next IP addresses to attack by one of the following strategies.

• Random scanning
  Probes random IP addresses.
• Linear scanning
  Probes addresses in sequential order. The regular pattern makes it easy for an intrusion detection system to detect.
• Hitlist scanning
  Probes a precompiled list of vulnerable hosts first.
• Local subnet prioritization
  Probes the infected host’s own subnet first. Internal networks often have weaker security barriers and fewer firewalls than the perimeter.

Evading Detection

• Polymorphic engines alter the appearance of the worm’s code on each copy, defeating signature matching.
• Multi-stage delivery makes a small first stage download the main payload later, so the initial copy contains little to match.

Worked Example: SQL Slammer

SQL Slammer spread in 2003 through a buffer overflow in Microsoft SQL Server. The whole worm fit in a single 376-byte UDP packet.

• It was fileless. Its scanning and exploit code were packed into tight shellcode that ran from memory.
• UDP needs no handshake, so it sent packets as fast as the host allowed.
• It never wrote to disk, so file-based antivirus scanning had nothing to inspect.