Cyber Risk – Common Threats Part 1 of 2 Table of Contents Threats to Information Systems ..................................................................................................... 2 Malware .......................................................................................................................................... 4 Viruses ............................................................................................................................................. 5 Virus Examples ................................................................................................................................ 6 Worms ............................................................................................................................................. 8 Brief Virus and Worm History ......................................................................................................... 9 Downloaders ................................................................................................................................. 11 Attack Scripts ................................................................................................................................ 13 Botnet -1 ....................................................................................................................................... 15 Botnet -2 ....................................................................................................................................... 17 IRCBotnet Example ....................................................................................................................... 19 Trojans........................................................................................................................................... 20 Denial of Service ( DoS ) ................................................................................................................ 23 Rootkits ......................................................................................................................................... 25 Notices .......................................................................................................................................... 26 Page 1 of 26 Threats to Information Systems Threats to Information Systems Networks face a multitude of threats every day. • Some are direct: malicious code, direct exploits. • Some target users: spearphishing, steganography. http://news.softpedia.com/news/PDF-Based-Targeted-Attack- http://datalossdb.org/ Against-Military-Contractors-Spotted-212139.shtml http://www.computerworlduk.com/news/security/3288274/microsoft- warns-rootkit-infection-requires-windows-reinstall/?olo=rss http://ddanchev.blogspot.com/2011/03/dissecting-massive-sql-injection-attack.html 4 **004 So some of the common threats. You probably can't read an article online or go through a news report without something related to cyber; cyber attack, denial of service, phishing attack, I mean, they're all over the place. It's very, very common. If you operate some type of network you are experiencing this stuff on a daily basis. Whether you see it or not is a totally different story, but I guarantee that if you're operating a network you're seeing this type of garbage. You're seeing scareware here. You're seeing data leakage, or data loss reports. You're seeing exploits and documents that come embedded with things to take advantage of computers. Page 2 of 26 You look at the cyber threat landscape, and it's huge. There are so many possible things that can wrong. So many ways that you can be taken advantage of if you operate a network. Why do people even bother? Why do we have networks? Why do we have computers? Student: Convenience. Chris Evans: Convenience, absolutely. Can you imagine doing anything now without your Smartphone, a laptop or a computer? I don't know how people lived 50 years ago. My laptop's attached to me at the hip. I've got it right here. If that ever goes away I start to shake. I go into withdrawal. So your networks really face a multitude of threats every day, but you put up with it because you need the networks. You need those computer systems. You need that connectivity. So you might face direct attacks where people are attacking your systems or your users directly like direct exploits, or SQL injection, or something like that, steganography attacks, or phishing attacks. Phishing is probably the number one attack that you will see. It's cheap, it's easy and it works, which is why it's so prevalent. Page 3 of 26 Malware Malware aka Malicious Code or Malicious Software Hostile, intrusive code designed to infiltrate a computer without users knowledge or consent Examples • Viruses • Worms • Trojans • Downloaders • Attack Scripts • Botnets 5 **005 You'll see a lot on malware. Malware is malicious code or malicious software. It is designed to do something hostile to you, take advantage of something, steal data, provide access to a computer, and generally wreck havoc with computer systems, hopefully without you knowing it as a user. That's what malware's intended to do. And so there are some different categories of malware; viruses, worms, Trojans, downloaders or dropper programs, there's all sorts of malware out there that you can be taken advantage of with, and we'll kind of step through all of these. Page 4 of 26 Viruses Viruses Self-replicating programs that require user intervention to spread Most spread through email, removable media drives, and commonly used files like Microsoft Office or Adobe documents Usually have two parts • Replication Element • Payload 6 **006 So viruses are self-replicating programs. You used to hear a lot about this in the '90s and early parts of the '00 decade. You don't really hear a whole lot about this anymore, because viruses, what were they intended to do? They were for notoriety. People wrote viruses because they wanted their name out there. "Hey, I wrote the Melissa something or another," or "I did this particular virus." Most viruses were spread through e-mail, removable media, or CDs, or USB drives, or something like that. It took advantage a lot of Microsoft Office files because you'd have Word documents with viruses embedded in them. Page 5 of 26 Usually they have two parts. They have a replication element, which tells the virus how it's going to spread to other computer systems, and it has a payload. What is a payload? A payload is what the virus actually does. Does it delete files? Does it shut off the computer? Does it popup annoying boxes on your computer screen? That's what a payload is. It's what the virus actually is intended to do. Virus Examples Virus Examples Chernobyl • First virus known to have the power to damage computer hardware • Attempts to erase the hard drive and overwrite the systems BIOS Melissa • A fast-spreading virus distributed as an e-mail attachment that, when opened, disables safeguards in Word 97 or Word 2000 • If Microsoft Outlook is used, the virus sends itself to addresses in the user's address books EICAR – a test virus • Not a virus, does not include any fragments of viral code • The file is a legitimate program, and produces sensible (non- malicious) results when run (it prints the message "EICAR- STANDARD-ANTIVIRUS-TEST-FILE!") 7 **007 Some interesting examples of viruses here. You have Chernobyl, which was interesting in and of itself because it was the first virus to actually damage hardware. So it tried to erase the hard Page 6 of 26 drive, overwrite the BIOS, or otherwise cause physical damage or physical manifestation of some type of malicious activity. It tried to attack the computer system itself, not just the information on it. Melissa was a really superfast spreading virus that came out through Word documents and that sort of thing. If you had Microsoft Outlook, so this ran rampant through corporations who had exchange with Outlook. So you would get this e-mail in your inbox. You would click on it, and it would exploit your computer, and then send itself to everybody in your address book. So you figure that companies with global address books where you've got six thousand people in the company, now you've got for each person who clicks on the message six thousand messages are going out. And so what you would see is one person would get it, six thousand people would get it, and then everybody would be sending it to each other and you'd crash the exchange server or whatever your mail program was. So this was a great virus to show how quickly these things can spread. And then the EICAR is a test virus. It doesn't actually do any damage, but it's good for testing virus scanners, testing your detection and your response procedures. So as you're going through, and if you determine that, let's say, viruses are a risk to you, how could you mitigate the risk of that? Well, come up with some processes and then test them with this, the EICAR virus. Page 7 of 26 Worms Worms Worms, in contrast, are self-replicating programs that do not require user intervention to spread, rather, they take advantage of vulnerabilities in operating systems and applications to spread. Examples Morris 1988, first worm to spread extensively in the wild; prompted establishment of the CERT/CC Storm 2007, added infected hosts to the Storm Botnet Conficker 2008/9, prompted the Conficker Working Group, but morphing code thwarted attempts to stop it Stuxnet 2010, first worm to target SCADA Morto 2011, targeted Remote Desktop Windows machines with a password dictionary 8 **008 Worms, so