I was
surprised how ignorant of some our members might be about malware. Some huge misconceptions are:
1) If
I keep my antivirus and other software up-todate I am secure.
2) The
only sites I need to be wary of are disreputable sites
3) I
need to click on something to get infected
4) The
most common way to get malware by email is by opening an attachment
1) Simple
antivirus software that relies on scanning for detecting is becoming fairly
useless. You still need old fashion
defense for old fashion malware but you need more to be safer. A good firewall is more valuable than AV
protection. Botnets have enough
computing power to monitor ALL IP addresses.
One group would ping for ports another group would attack known IP
addresses that did not stealth their ports.
It is very likely that there are dozens of botnets with more than 10
million zombies. The biggest botnet that
was taken down had a 30 million zombies that was a few years ago. The smarter and stealthier they are the
bigger they will become. If you think
monitoring IP addresses is a figment of an active imagination, I am sure bot
nets at least monitor zombie IP addresses.
After I re-imaged my computer and connected to my home network I
instantly (less than a second) saw a
message that I had an incoming connection did I want to let it pass through the
fire wall. I had not set up the fire wall to high alert
status when I made the image. I used to
connect to the internet after I installed my OS to get it verified. I know now I probably let malware into my
computer from the get-go. A college ran a test a few years back and monitored attackes on a freshly installed computer that was just on and connected to the internet. The average attack time was 30 minutes. I suspect in the age of the botnet the attacks are far more frequent.
1)
Here are some important excerpts from the below link - most
malware created in the last 12 months mutate and often employ one or both of
the other protections. This is the only
web page I have found that did not preach any of the 4 fallacies. The code mutations are probably created real
time if an injection port is used to infect your computer. This is probably the most common method of
attack since it is so successful. Early
this year hackers broke into Norton and stole a good bit of their anti-virus source
code. By now some hackers know how to
avoid detection by Norton products.
http://www.securelist.com/en/threats/detect?chapter=74
·
Code mutation is mixing the Trojan's code with 'spam' instructions, resulting
in the change of its appearance, whilst retaining the Trojan's functionality.
Sometimes mutation happens in real-time, i.e. every time that a Trojan is
downloaded from an infected website. It means that all, or almost all, Trojans
that are downloaded to users' computers are different. The Warezov mail worm,
which caused some serious epidemics in the second half of 2006, is an
illustration of this technique.
·
Stealth techniques. The so-called rootkit technologies generally employed by Trojans
are used to intercept and substitute system functions which make the infected
file invisible to the operating system and antivirus programs. Sometimes even
the registry branches where the Trojan is registered, along with other system
files, are hidden. These techniques are actively used by the HacDef backdoor
Trojan, for example.
·
Blocking antivirus programs and antivirus database update systems. Many Trojans and network
worms take special actions directed against antivirus programs - they search
for them in the list of active applications and try to block them, damage their
antivirus databases and block their update processes, etc. Antivirus programs
have to defend themselves adequately by controlling the integrity of their
databases and by hiding their processes from Trojans, etc.
2)
Porn sites may be a great place for infections but even the most
reputable sites like Microsoft sites can be infected for a few days. I discovered after being attacked using hot
mail that Microsoft relies heavily on contractors and that Hotmail might have
up to a dozen different contractors maintaining different functionalities. Adds are a favorite attack vector. I use addblock with Firefox to eliminate that
common threat.
3)
Web page infections are usually carried out as you open the page. If you did click on a 'bad link" by the time
you see the page, the damage is done.
4)
The most common way to get infected by email is by clicking on a
link provided. The email will come from
a friend and the message will contain a plausible reason to click on the
link.
The new tech
advice I have received is if you think your computer is infected and your
anti-virus can't find any malware. Wipe
your C: dirve and start over. You are
suggested to image your computer before your computer has attached to the
internet.
Some of the
biggest botnets taken down -. http://en.wikipedia.org/wiki/Botnet
The biggest taken
down so far had 30 million zombies. That
is a considerable amount of attack power.
For instance, a bot net of only a million zombies was breaking passwords
by brute force on web sites using certain website engines. The bot net used the assumption that the
default admin user ID was never changed for several website engines that had default
passwords. Because the log in attempts
were each carried out by a million different zombies with only 1 attempt on a
site per day the 3 strike rule did not lock out the zombies ip address from
logging in. Once in, it infected the web
pages with a disturbing arsenal of attacks.
These are javascript malware and hidden injection ports/frames. Both attack as you open the page. By the time you can see the page, any saved
passwords you have any stored FTP information has been uploaded to the
attacking servers and malware has been downloaded on to your computer. Web master tools save the web site log in information
so you do not need to enter all the connection info every time you make a
change to a web site. The most
disturbing trend is how many different hidden injection frames are being
used. In the kinder more gentle time of years
past there would be 2 ports. A port is a
portal to a different server than the host server for the web site. Hackers used to use 2 ports just in case one
server was down during the attack the other could carry on the attack. Hackers do not need 6-8 ports for redundancy. They probably keep 2 for themselves for
redundancy. I fear the extra 4 to 6
ports are paid for connections. One
thing is for sure by being attacked by many attack servers using different or
even the same tactics the black hats have a much better chance of breaking
through the meager defenses of a PC than a single server attack.
The payments could
be either credits or cold cash. The
credits would be when bot nets working together infect web pages with ports to
other botnet servers. Cash payment could
be government funding. The hackers could
receive a penny or less for each IP address infected. These military grade botnets could stay
dormant until needed. It only took a few
tens of thousands of zombies to break down the Pentagon defenses. An attack of 50 million could devastate our
infrastructure and government communication.
The Pentagon attack had no agenda other than to show how powerful and
evasive a botnet could be. They
underestimated what the US government could do if provoked. No one has tried that prank on any major
government since.
Lastly, I
like to browse the internet inside a Sandboxie sandbox. It gives you an error message if something tries
to alter the browser while it is in the sandbox. This happens far too often for my
liking. I suspect my security on my home
computer is much higher than most of your home computers and I am still getting
attacked more than once every 20 hours on line or about once in 2-3 weeks. To get this message the attack made it
through my router with both NAT and packet scanning protection. I cannot afford a router with deep scanning
protection. It has faked out the top
rated firewall with most setting to maximum alert. Any higher and I can't surf
the web etc. It fooled 2 packages that
are supposed to be watching for attacks like that. The new beta package from Malwarebytes
is supposed to focus on just such an attack.
This is not the AV package but something altogether new.
Browser attacks are a favorite target of the new age
malware. Browsers have permission to
send and receive through the firewall. It is invisible to malware detection
tools such as HijackThis. HijackThis will only report that your browser is
running if it is. The malware does not
need to be running all the time since it will be running when it can do the
most mischief. It can add a malware package
to anything you download as well as log what you send out to the internet. This is better than a keylogger which
can be foiled by a cut and paste of a password.
Feel free to straighten me out!
A Few Words on Malware
Re: A Few Words on Malware
