Is malicious software placed on a computer without the knowledge of the owner?

Spyware

Spyware is a type of malware used to spy on user activity on a computer. Spyware will gather information on users’ habits such as browsed Web sites, accessed applications, and downloaded programs. This information is then sent to an attacker, so he or she knows what attacks can be perpetrated on a system. Spyware can have even more direct effects, like stealing of passwords and credit card information. This type of information can lead to direct financial benefits for an attacker. Spyware is generally not self-proliferating. It is not spread from infected system to infected system. Usually, spyware is downloaded from a Web site or server that the user believes contains beneficial software. In fact, many times, spyware will be bundled in a download with some sort of legitimate software.

Malware

Malware is a category name to define software that causes problems. This can include viruses, adware, and spyware. Malware can degrade system performance, expose confidential information, distribute spam, etc. Specific types of malware include:

Macro viruses. Viruses that use commands (macros) in application files (e.g., Excel and Word) to replicate themselves and do damage.

Worms. Self-contained programs that replicate themselves usually via the network or e-mail attachments.

Adware. Software that installs itself on a workstation for the purpose of displaying ads to the user. Users often unknowingly install adware when they download applications from the Web.

Spyware. Software that monitors a user's activity, often to collect account numbers, passwords, etc. Spyware often works in tandem with adware as the ads shown may be related to the activity detected by the spyware. Like adware, spyware is also frequently installed by the user unknowingly when downloading applications from the Web.

Trojan horses. Programs that appear to be legitimate, but in fact are malicious.

Backdoor Trojans: Trojan horse programs that allow a hacker to control your computer remotely.

Page Hijackers: Akin to the purposes of adware, they covertly redirect browsers to specific web pages.

Rootkits: A set of modifications to the operating system that is designed primarily to hide malicious activity. Because the rootkit software essentially resides in a modification of the operating system, it's extremely difficult to detect, and it also continually checks on itself to see that the compromised files are still compromised and reinfects as needed. In addition to being very difficult to detect, they're equally hard to remove.

Key loggers: Small applications that reside on a computer to record key strokes. These are used to capture passwords and confidential information (e.g., credit card numbers).

Of particular concern with malware is what is known as a Zero-Day attack, which is malicious code that takes advantage of a security vulnerability before there's a fix for it. In some cases, the malicious code is released even before there is public knowledge of the vulnerability.

Publisher Summary

Malware comes in numerous shapes, sizes, and purposes ranging from viruses, to spyware, to bots. There really are two different types of malware. Malware can either be infectious or concealing malware. Infectious malware is malware that spreads—software that will replicate itself from one user to the next. There are two primary items that are considered infectious malware, which include viruses—software that has infected some executable and causes the executable, when run, to spread the virus to other executable software, and worms—software that infects a computer, and then spreads to other computers. The concealment software includes Trojan Horses, rootkits, backdoors, and keylogger. Cross-site scripting (XSS) is an attack that forces a user's Web browser to execute an attacker's code. The steps followed by an attacker for a basic XSS attack include that an attacker finds an XSS hole in Site A and leaves it there for the victim. Another step is that a victim visits Site A with the XSS. Site A sends many requests through the victim's browser to Site B via a META refresh to hide the referrer without his knowledge. Next step, eventually the victim finds a hole, which is then sent to Site C without the victim's knowledge. Another step is that the victim sends successful attempts to hack Site B to Site C, where they are logged. Last step, the Webmaster of Site B becomes aware of the attacks on their Web site.

Malware

Malicious software (shortened to malware) is any software that causes damage or lost resources when used on any system it is purposely or inadvertently installed on. In this attack we are concerned with downloading malware specifically designed to alter the system in some way, usually via scripts from a web page visited by a client user. A typical scenario would involve, a malicious web page hosts some sort of malware and uses mass emailing, spam, social engineering or any other method to invite the user to download and execute the malware. A common example of such a technique is to use video codec that contains embedded malware, when the victim visits the site they are informed that downloading the codec is a requirement to view the material (Adult Pornography sites are a common delivery mechanism). Once the victim downloads and installs the malware, the attacker has gained control of the system. Drive-by-download versions of this attack do not even require the user to manually install anything as the malware is automatically downloaded and installed on a user’s system without their knowledge. These attacks usually trigger having a user merely visit a web page.

Keyloggers

A keylogger is a code that is installed by malware and sets on a device that has keyboard input (like a PC) and records keystrokes. The hope of the keylogger is that it will capture user login credentials, credit card number, government ID numbers, which can later be sold or used. Keylogger can be deployed by botnets, or themselves be deployed. Variants of keyloggers will look at other inputs and records. For example, variant code may listen to your built-in microphone or record video from the integrated camera (or just take periodic snapshots).

Malware Activity Reports

These reports summarize various malicious software activities and events likely related to malicious software.