Introduction to Malware

What is malware?

Malware, formed from the words 'malicious' and 'software', is a broad term for any software that harms a device, server or network, or otherwise interferes with its normal, healthy functioning. This ecompasses any sort of damage inflicted to a computer system, as well as using the device for purposes that the user did not intend. 

What did early malware look like?

In 1971, Bob Thomas created Creeper - a program designed to move between computers and display the message “I'm the creeper: catch me if you can”. This was ultimately harmless and not designed to do damage, but rather to demonstrate an experimental self-replicating program. 

On the 2nd November 1988, college student Robert Tappan Morris created the “Morris worm”. This was one of the first computer worms - it was a program that infects computers by replicating itself across the ARPANET and the NSFNet, both precursors to the modern internet. Due to an error in his programming, the worm spread more quickly than Morris intended and ended up reinfecting the same computers over and over, slowing them down drastically. It’s estimated that six thousand computers were brought to a halt by the worm, which at the time was approximately 10% of computers connected to the network.

What types of malware are there?

Worm - Computer worms are programs that infect computers by replicating themselves before spreading to other systems via the local network, internet connection or email. It’s important to note that worms do not require any input from the user in order to take effect, which makes them especially dangerous and may explain why they are one of the key building blocks of most other types of malware.

Virus - Like a worm, a virus is a program that replicates itself, with the difference being that a virus requires the user to trigger or activate it in order for it to spread. An example would be downloading an attachment from an email that claims to be something else, something that a user would actually want to open and gain access to, as in the case of the Anna Kournikova Virus.

Ransomware - This is a form of malware that holds the user ransom by either locking them out of their device or by encrypting their data. They are then offered the chance to regain access by paying a fee. It has also been flagged as a major issue by both US President Joe Biden and Lindy Cameron, CEO of the UK National Cyber Security Centre (NCSC).

Wiper - This is a form of destructive malware that is designed to erase the data from a device. 

Spyware - As its name suggests, spyware surveils and collects information on the user for a third party. This includes anything from installing a keylogger that monitors each keystroke to tracking your internet browsing habits. 

Bots and Botnets - "Bot" derived from the word "robot", is an automated malware that interacts with other network services. Like worms, Bots are also self-propagating malware designed to infect a host. However, unlike a worm, they also connect back to a central server or servers that act as a command and control (C&C) center for an entire network of compromised devices, called a "botnet."

With a botnet, criminals can launch broad-based, "remote-control," attacks on their targets such as distributed Denial of Service Attacks (or dDOS) and relaying spam emails. Bots can also open backdoors on the infected host to log keystrokes, gather passwords, capture and analyse packets, and gather financial information.

Advanced botnets may even take advantage of common internet of things (IOT) devices such as home electronics or appliances to increase automated attacks. Crypto mining is becoming an increasingly common use of these bots.