Outline Malware: Definitions and Examples Cyber Warfare L6. Hacking, Malware, and Cyber Warfare Alice E. Fischer September 18, 2018 L6. Hacking. 1/25 Outline Malware: Definitions and Examples Cyber Warfare Malware: Definitions and Examples Cyber Warfare L6. Hacking. 2/25 Outline Malware: Definitions and Examples Cyber Warfare Dishonesty on the Internet Malware comes in may forms I Root kits, Viruses, worms, and Trojan horses I Spyware and weapons. I Dishonest adware. I Fake people, fake news, and \trending". Much of today's information is adapted from Wikipedia. L6. Hacking. 3/25 Outline Malware: Definitions and Examples Cyber Warfare Viruses Virus: a computer program that can replicate itself. I It must attach itself to another piece of software, and runs when that other software is activated. I January 1986: the Brain boot sector virus became the first virus epidemic. It infected IBM-compatible hardware. it was created in Lahore, Pakistan by 19 year old Pakistani programmer and his brother. I August 2012: Shamoon is designed to target computers running Microsoft Windows in the energy sector. Symantec, Kaspersky Lab and Seculert announced its discovery. L6. Hacking. 4/25 Outline Malware: Definitions and Examples Cyber Warfare Worms Worm: a standalone malware computer program that replicates itself in order to spread I November 2 1988: The Internet worm, created by Robert T. Morris, infected DEC VAX and Sun machines running BSD UNIX connected to the Internet. It became the first worm to spread extensively "in the wild", and one of the first well-known programs exploiting buffer overrun vulnerabilities. I November 21 2008: Computer worm Conficker infects anywhere from 9 to 15 million Microsoft server systems running everything from Windows 2000 to the Windows 7 Beta. The French Navy, UK Ministry of Defense (including warships and submarines), Sheffield Hospital network, German Bundeswehr, and Norwegian Police were all affected. L6. Hacking. 5/25 Outline Malware: Definitions and Examples Cyber Warfare Trojan Horses Trojan Horse: malware that masquerades as a legitimate file or a helpful program. When installed, it will give a hacker remote access to a targeted computer. Typical purposes: I Enroll the machine as part in a botnet I Data theft I Installation of third-party add-ons I Downloading, deletion of, or uploading files I Keystroke logging I Watching the user's screen I Crashing the computer I Anonymizing internet viewing L6. Hacking. 6/25 Outline Malware: Definitions and Examples Cyber Warfare Trojan Horses Trojans are currently becoming more prevalent. I 1974: ANIMAL, by John Walker for the UNIVAC 1108 became the first trojan to propagate itself \in the wild". It played a harmless guessing game, but also made copies of itself in all directories to which the user had access. I Anti-Spyware 2011, a trojan which attacks Windows 9x, 2000, XP, Vista, and Windows 7, posing as an anti-spyware program. It actually disables the security-related processes of anti-virus programs, while also blocking access to the Internet to prevent updates. I Is Kaspersky's antivirus a Trojan horse whose purpose is to gain access to U.S. defense systems? L6. Hacking. 7/25 Outline Malware: Definitions and Examples Cyber Warfare Spyware Malware that collects information without the user's knowledge. I In 2005, 61% of surveyed users' computers were infected with spyware. I Microsoft used to claim the right to install or remove software on any machine that ran Windows. I Keyloggers. (Several years ago at UNH. ) I Installed by employers to monitor employee usage. I Installed by crooks to get passwords. L6. Hacking. 8/25 Outline Malware: Definitions and Examples Cyber Warfare Spyware Major companies install spyware to collect personal information. Some of the products are aimed at children. I 2000: The Mattel toy company sold \Reader Rabbit" educational software that sent usage data back to Mattel. I 2011: Android malware was found in Angry Birds add-on apps. I Alexa records conversations in your home and reports them to Google. It is often in the news because of newly discovered surveillance issues. I Barbie relays conversations with children back to the company's processing center. L6. Hacking. 9/25 Outline Malware: Definitions and Examples Cyber Warfare Weapon-Malware The use of malware as a weapon is relatively new. I can find no mention of this before Stuxnet, in June 2010. Sept. 2011: Gauss I Gauss appears to be a cyber-espionage weapon designed by a country to target and track specific individuals. It's not known yet who created it. I Of the 2,500 or so discovered instances of Gauss across the world, about 1,660 of them were found in Lebanon. I The virus is specifically designed to target customers of Lebanese banks, aCitibank, eBay, and PayPal. L6. Hacking. 10/25 Outline Malware: Definitions and Examples Cyber Warfare Weapon-Malware Flame (September, 2012), a spy vs. spy weapon. I It attacks computers running the Microsoft Windows I It uses multiple encryption techniques and spreads through four different transfer protocols. I It record local activity and network traffic and attempts to download information from nearby computers. This info, plus local documents, is sent to one of several command servers. I It can delete itself it it receives a \kill" command. I Victims include governmental organizations, educational institutions and private individuals. At that time 65% of the infections happened in Iran, Israel, Sudan, Syria, Lebanon, Saudi Arabia, and Egypt, L6. Hacking. 11/25 Outline Malware: Definitions and Examples Cyber Warfare Root Kit: Sony 2003? { November 2005 A set of tools that disable the diagnostic tools that are designed to let you discover that your system has been compromised. This gives the attacker privileged access to a computer, any time. I August 2000: Designed to combat Napster in an effective way, the XCP software was installed on Sony BMG music CDs. A detailed description and technical analysis was published in Oct. 2005. I XCP was installed silently, the EULA does not mention it, there was no uninstaller, and it created security holes. All are illegal in various ways and places. I Inexpert attempts to uninstall the software could lead to Windows failing to recognize an existing drive. I It used unsafe procedures to start/stop the rootkit, which could lead to the Blue Screen of Death. L6. Hacking. 12/25 Outline Malware: Definitions and Examples Cyber Warfare Phishing and Pharming I Phishing: Often delivered as spam, a phishing message tries to induce you to give up personal information that can be used to defraud you. I Pharming is a scamming practice in which malicious code is installed on a personal computer or server, misdirecting users to fraudulent Web sites without their knowledge or consent. Pharming has been called \phishing without a lure." L6. Hacking. 13/25 Outline Malware: Definitions and Examples Cyber Warfare How does it get in the door? I It was put there when the equipment was manufactured or the system was installed. I System vulnerability + some level of access + known exploit I Plugging in an infected stick / disk. I Mis-designed features: autoexec.bat I Password cracking. I On-site collaborators: Firewalls are often configured to filter out tcp connection packets. But an insider can establish a connection to the outside, which then becomes a 2-way street. L6. Hacking. 14/25 Outline Malware: Definitions and Examples Cyber Warfare Fake people, Fake News, and \Trending" These are indirect cyber tools that foster \group-think" and can influence large numbers of people to believe things that are not true. I From Hitler, we learned that people will believe anything they hear over and over and over, from sources all around them. I Putin uses the same technique to control his own country. I During the 2016 presidential election, Russian hackers created multitudes of fake people (Facebook and Twitter accounts). They injected fake news into the network, and ensured that it was \liked" and \retweeted" again and again. The \trending" lies were picked up by thousands of unwary Americans and passed on to their friends. I By election day, hundreds of thousands of people did not know what was true. They had no idea that the news was planted. L6. Hacking. 15/25 Outline Malware: Definitions and Examples Cyber Warfare The Business of Hacking I Social Engineering: DefCon.pdf, http://www.defcon.org/ I Zero-Day.pdf: A price list for secret exploits I Who are the Hackers? I Government agencies: powerGrid.pdf, GoogleHacked.pdf I Military organizations. I Bored kids: ClassExercise.eml I Bright, angry young adults: PayForPlay.pdf I Professional thieves: FreeApps.rtf L6. Hacking. 16/25 Outline Malware: Definitions and Examples Cyber Warfare Definition and Overview An act is Cyber Warfare if it uses the internet and/or computer technology to attack another country's economy, infrastructure, government, or people. Motivations might be: I To weaken or destabilize an economy. I To damage the military readiness of a country. I Stealing military or industrial secrets and/or plans I Identifying the people who are spying on your country. L6. Hacking. 17/25 Outline Malware: Definitions and Examples Cyber Warfare Weapon-Malware The use of malware as a weapon is relatively new. I can find no mention of this before Stuxnet, in June 2010. Sept. 2011: Gauss I Gauss appears to be a cyber-espionage weapon designed by a country to target and track specific individuals. It's not known yet who created it. I Of the 2,500 or so discovered instances of Gauss across the world, about 1,660 of them were found in Lebanon. I The virus is specifically designed to target customers of Lebanese banks, aCitibank, eBay, and PayPal. L6. Hacking.