Malicious Program and Protection For bim 6th Sem (www.sheetal.com.np)

Malicious Program: Definition “Hardware, software, or firmware capable of performing an unauthorized function on an information system.” Usually violates security policy of a system Malicious logic is also known as malicious code or malware Types of malicious logic?

Types: Trojan Horses (remember movie TROY) Computer Virus Boot Sector Infector Executable Infector Multipartite Viruses TSR Viruses Stealth Virus Encrypted Virus Polymorphic Virus Macro Viruses Computer Worms Rabbits and Bacteria Logic Bombs

Types

Trojan Horse Definition: A Trojan horse is a program with an overt (known or documented) effect and covert (unknown or undocumented ) effect Overt effect: What user sees. Games, animation Cover effect: What happen in background Appears to be useful program but contain many malicious logic inside A propagating Trojan horse (aka replicating trojan horse) is a Trojan horse that creates a copy of itself

Virus a program that can infect other programs by modifying them to include a, possibly evolved, version of itself (Fred Cohen, 1983) Is a program that insert itself into one or more files and then perform some action Self replicating code, parasitic

Virus : General pseudocode beginvirus: if spread-condition then begin for some set of target files do begin if target is not infected then begin determine where to place virus instructions copy instructions from beginvirus to endvirus into target alter target to execute added instructions end; perform some action(s) goto beginning of infected program endvirus:

Virus types in brief Boot sector infector: Executable infector: That insert itself into the boot sector of disk Executable infector: That infects executable program Multipartite Virus Infect both boot sector or application TSR viruses A terminate and stay resident virus is one that stays active in memory after the application (for eg: disk mounting) has terminated

Virus type in brief Stealth virus: Encrypted Virus Polymorphic virus Virus that conceals the infection of file [ Eg: Virus intercept system call. If call is to obtain attribute, returns original attribute, if call is to execute then execute infected file.] Encrypted Virus Virus that encipher all of the virus code except for a small decryption routine Polymorphic virus Virus that changes it form each time it insert into another program Macro viruses Composed of sequence of instruction that is interpreted rather and executed

Worms Is a program that copies itself from one computer to another What is difference than virus?

Virus vs Worms Computer Virus Computer Worm How does it infect a computer system? It inserts itself into a file or executable program. It exploits a weakness in an application or operating system by replicating itself. How can it spread? It has to rely on users transferring infected files/programs to other computer systems. It can use a network to replicate itself to other computer systems without user intervention. Does it infect files? Yes, it deletes or modifies files. Sometimes a virus also changes the location of files. Usually not. Worms usually only monopolize the CPU and memory. whose speed is more? virus is slower than worm. worm is faster than virus. E.g.The code red worm affected 3 lack PCs in just 14 Hrs. Definition The virus is the program code that attaches itself to application program and when application program run it runs along with it. The worm is code that replicate itself in order to consume resources to bring it down.

Rabbits and Bacteria A bacterium or rabbit is a program that absorbs all of some class of resources While true do mkdir X chdir X done

Logic Bomb Is a program that performs an action that violates the security policy when some external event occurs

Defenses Sandboxing Reducing Right Information Flow Metrics Malicious Logic Altering Files Use cryptographic checksum Checksum is stored in system itself Proof of code Author generate Proof Carrying Code Consumer validates it Trust of notion

County by Malware Infection

Antivirus Software is a class of program that will prevent, detect and remediate malware infections on individual computing devices and IT systems. Though labeled antivirus, modern antivirus is capable of preventing all sort of makware

Features of Antivirus Antivirus, antiworm, antirootkit, ……… Protection against browser exploit Scanning On access, scheduled, on demand Added protection Email scan, Instant-message scan, USB scan, Auto clean Updates