20 Years of Malware Risk Robert M. Slade, M. Sc., CISSP

(c)1986Brain Was it the first? Was it the first? Are the risks the same? Are the risks the same?

Prehistory s-50s von Neumann architecture von Neumann architecture Harvard architecture Harvard architecture Howard Aiken, Mark I – IV Howard Aiken, Mark I – IV Risk – Law of unintended consequences Risk – Law of unintended consequences Cost/benefit – development versus viruses? Cost/benefit – development versus viruses?

Prehistory s-70s Core Wars Core Wars DARWIN – 1969 DARWIN – 1969 Survival of programs Survival of programs Imp Imp Replication, quite successful Replication, quite successful Risk – beware of playful programmers Risk – beware of playful programmers

Trojans Various types, difficult to define Various types, difficult to define Password stealing Password stealing Pranks Pranks Malicious damage Malicious damage Phishing (ID theft) Phishing (ID theft) Risks Risks Trust Trust Ill-defined threats Ill-defined threats

Pranks Non-malicious Non-malicious Anthem Anthem Flip Flip Risks? Risks?

Prehistory s Infamous Xerox worm Infamous Xerox worm Shoch and Hupp Shoch and Hupp Experiment in distributed computing Experiment in distributed computing Application with multiple segments Application with multiple segments Bug in the program Bug in the program Risk – unintended consequences again Risk – unintended consequences again

Prehistory s Apple viruses Apple viruses Texas Texas Like Core Wars, examining survival Like Core Wars, examining survival Variant 1 successful Variant 1 successful Variant 2 escaped, interfered with game Variant 2 escaped, interfered with game Variant 3 to hunt down 2 Variant 3 to hunt down 2 Risk – buggy code Risk – buggy code Risk – antivirus viruses - Ohio Risk – antivirus viruses - Ohio

Fred Cohen Replication proposed at 1983 seminar Replication proposed at 1983 seminar Len Adelman Len Adelman 1984 thesis 1984 thesis 1986 dissertation 1986 dissertation Three major antiviral types identified Three major antiviral types identified

(c)1986Brain Brain Computer Services, Pakistan Brain Computer Services, Pakistan Ashar and Ashar Ashar and Ashar Stealth Stealth Boot sector infector Boot sector infector Risk – variants – Ohio, Den Zuk Risk – variants – Ohio, Den Zuk

1987 Lehigh Lehigh CHRISTMA CHRISTMA Risk - DoS Risk - DoS

1987 Jerusalem Jerusalem Risks – variants, malicious damage, reputation Risks – variants, malicious damage, reputation

1987 Polymorphism Polymorphism Many shapes Many shapes Self-encryption Self-encryption stub stub Modular construction Modular construction module signatures module signatures Updating Updating update module signature update module signature File pickup File pickup other signatures other signatures Risks Risks AV expert blood pressure (zero day) AV expert blood pressure (zero day) CPU time CPU time File distribution File distribution

1988 Stoned Stoned Risk – holdover technology (boot sector) Risk – holdover technology (boot sector) Internet/UNIX/Morris Worm Internet/UNIX/Morris Worm Risks - defaults Risks - defaults MacMag MacMag Risks – data, commercial Risks – data, commercial

1991 Desert Storm Desert Storm Risk – don't believe everything you read Risk – don't believe everything you read MSAV MSAV Anti-antivirus Anti-antivirus Risk - There is hardly anything in the world that some man cannot make a little worse and sell a little cheaper, and the people who consider price only are this man's lawful prey. - John Ruskin Risk - There is hardly anything in the world that some man cannot make a little worse and sell a little cheaper, and the people who consider price only are this man's lawful prey. - John Ruskin

1994 Good Times hoax Good Times hoax Risk – don't believe everything you read Risk – don't believe everything you read Springer-Verlag publishes "Robert Slade's Guide to Computer Viruses" Springer-Verlag publishes "Robert Slade's Guide to Computer Viruses" (ummm...) (ummm...)

1995 Concept Concept Macro virus Macro virus Risks Risks Outdated definitions of program Outdated definitions of program Extraneous functionality Extraneous functionality

1999 Melissa Melissa First of the fast burners First of the fast burners Used multiple linked applications Used multiple linked applications Risks Risks Platform dominance Platform dominance Convenience Convenience (Pornography) (Pornography)

2000 Life Stages Life Stages Risk - file formats and extensions Risk - file formats and extensions

2001 Lindose/Winux Lindose/Winux Cross-platform Cross-platform Code Red Code Red Worm speed Worm speed

Intermission DCOM DCOM

2003 Sobig Sobig Spambotnets Spambotnets Risk – commercial and criminal impetus to malware Risk – commercial and criminal impetus to malware

Spyware and Adware Potentially Unwanted Software – PUS Potentially Unwanted Software – PUS Risk - definition Risk - definition

Mobile Cell phones, PDAs, Blackberry, etc. Cell phones, PDAs, Blackberry, etc. Risk – computers everywhere Risk – computers everywhere

20 Years of Malware Risk Robert M. Slade, M. Sc., CISSP