How viruses work

by Davey Winder on Sep 18, 2007

Tags: How | viruses | work

6 Comments

They will get past your security software. Know your enemy and protect yourself.

Ever felt like you’re fighting a losing battle? That sums up many people’s attitude to computing in the internet age: despite the best efforts of security vendors and software developers alike, malware not only exists, but continues to evolve and plague computer users.

Why does malware continue to thrive? The patronising answer would be that newbie users are behaving like amateurs and ignoring basic security practice. There’s a kernel of truth in that, but it isn’t only the newbie who clicks links they shouldn’t, and it isn’t only the novice who’s fooled into running nefarious executables by technical and social-engineering techniques.

The crux of the problem is that threats have changed dramatically in recent years, with the rise in malware mirroring the rise in broadband popularity. As the number of online users grow, and the technology used to connect to the net becomes simultaneously simpler at the front end yet more complex behind the scenes, so the opportunity to make money expands. And that’s where the answer to the “why?” question can be found: no longer are viruses the hobby of the über-nerd; malware has evolved into what most IT security experts quite rightly refer to as crimeware. Scatter-gun attacks are on the way out; targeted and financially motivated strikes are the new modus operandi.

But while everyone has heard terms such as worm, trojan, phishing and rootkit bandied about, how many people actually understand how they exploit security weaknesses? By understanding how malware works, you get one step closer to stopping it.

Dodgy diagnosis
There’s a great deal of misinformation when it comes to describing malware attacks. The terms worm, virus and trojan are used almost interchangeably, for example, yet the three threats are actually quite distinct.

The quick-and-dirty definition is that a virus spreads by attaching itself to something, and requires human interaction (running a program, forwarding an email attachment) to be distributed and replicated. A worm can self-replicate without any human intervention (sending copies of itself to everyone in your email contacts list, for example) and can exploit your network and the internet beyond to multiply very quickly indeed. The trojan, named after the mythical Trojan horse, hides within another container, be that a file or application, but can’t self-replicate or spread by infecting other files.

Just for fun, we can add the blended threat into the malware mix, combining the worst characteristics of all three: stealth, replication and payload. Using server and internet application vulnerabilities, they can spread rapidly without human intervention, doing vast amounts of damage courtesy of the multiple attack payload (for example, Denial-of-Service, backdoor installation and data theft).

Next: Viruses, Torjans and Rootkits

This article appeared in the September 2007 issue of PC Authority.

Ads by Google

Comments: 6

Nat.W¿LL¿ Jul 14, 2008 9:24 PM	The community needs to be educated more. Just the normal home user with no computer background doesnt know any better then to install a suss .exe or automatically accept a attachment from a friend. As soon as one installs windows they pretty much scream to the world "ATTACK ME! I HAVE WINDOWS!" Its sad that so many kids are bored or evil enough to attack peoples computers. Comment made about the PC Authority article: How viruses work? They will get past your security software. Know your enemy and protect yourself. What do you think? Join the discussion.
hacker16 Nov 12, 2008 3:26 PM	JUST UPDATE YOUR AV ON TIME.MOST MALWARE GETS PAST BY THE DEFENSES BECAUSE OF THE USER NOT UPDATING ON TIME.DOWNLOAD THERATFIRE FROM WWW.THERATFIRE.COM AND BE PROTECTED AGAINST ZERO DAY ATTACKS.
Slatts Nov 12, 2008 8:15 PM	hey hacker! Nice post bloke! Just one little thing mate. just to the left of the "A" key is one labeled "Caps Lock". If you tap it just the right number of times, you won't PISS OFF EVERYONE WHO TRIES TO READS YOUR POST! Only here to help mate:)
Nat.W¿LL¿ Nov 12, 2008 8:24 PM	haha slatts. now this is prob weird and only my opinion but how is the caps offensive...its..words! can read it fine better then S0m3th!ng LiKE THIs @yE?
Slatts Nov 12, 2008 8:59 PM	Nat.W¿LL¿ wrote: haha slatts. now this is prob weird and only my opinion but how is the caps offensive...its..words! can read it fine better then S0m3th!ng LiKE THIs @yE? it's a manners (or perhaps moaners? ;) )thing Nat. Most people read by recognizing the shape of a word. By using all caps, it changes the shape of the word, thereby making your reader work harder to read your post. it's a small thing but most manners things are in isolation:)
.:Cyb3rGlitch:. Nov 12, 2008 9:47 PM	Hacker16, check your PMs. See you in 30 days.