Let us begin by understanding the definition of a malware. Malware is a software intentionally designed
to cause damage or gain unauthorized access to a computer.
It is derived from two words, malicious and software.
These malicious programs are written by cyber attackers or more precisely, in case of a malware, they
are called malware authors.
More than 300000 new malware are created every day.
While all attacks are bad for a company, malware attacks in particular are biggest threat to an organization.
This is mainly because the malware may sometimes go undetected for several weeks in a network.
Now, let's try to understand the maliciousness of a malware or in other words, what are the typical
intentions of a malware?
In early days of computer evolution, malwares were created more for fun, and they were annoying, but
not dangerous.
They were programmed to do things like slowing down the computer or generating random pop ups.
They were also designed to multiply and spread to other systems.
Eventually, malwares became more malicious in nature, wherein they tried to install other applications,
steal sensitive information or trick people and scam them.
Malwares are also designed to delete critical files on a system to make it malfunction.
Or as in recent years, Malwares can encrypt your system and ask for ransom to get the decryption key.
Some malwares are also built to stop critical services or shut down important servers.
More advanced malwares are developed to give unauthorized access to the hackers or gather and send
sensitive information that can be used to launch other attacks.
There is a specific type of malware family called botnet in which the malware are built to take part
in a larger attacks.
When machines are infected with such botnets, they turn into zombie computers and act on the Masters
order.
Malwares can be designed to do a lot of things, but this list gives you an overall picture.
Once the malware is developed, it has to be distributed so that it infects the target computer.
Some malwares are designed to attack a specific target and some malware are designed to attack any possible
machine.
So in order to infect the target machine, attackers use various delivery methods.
One way is if the attacker has the direct physical access to the target machine.
Typically, this is done over a period of time by gaining trust of the actual owner or user of the machine.
We have seen this in movies where an attacker befriends a target and gets close to him or her.
And finally, once they win the trust, the attacker borrows the laptop using an excuse of checking
some urgent e-mail or any similar excuses.
When the access is given, the attacker infects the computer with the malware.
Of course, this method is challenging and time consuming, but still used in some cases where the security
of the company is very high.
Another method of getting the malware into the target machine is by using external storage devices.
In this method, the attacker usually spills few infected USB sticks near the target, usually in the basement
of the office or car parking space.
It's a human tendency that when we get a USB storage device, we would like to know what is the content
of the USB drive, or at least we would like to check if it works.
And when an innocent unsuspecting user puts the infected USB in the computer, the malware infects the
machine.
Here, the attacker makes use of the curious nature of human beings.
Another popular method used to deliver malware is email, in some cases, the malware is sent as an
attachment in the e-mail.
This method is less effective as the email security scanners might detect the malware and deleted.
Alternately, the attacker just puts a link in the email that, when clicked, will download the actual
malware from the Internet.
The attacker has to write a compelling e-mail in order to ensure the user actually downloads the attached
file or clicks on the link.
This is done by creating some sense of urgency, like your credit card will be blocked if you do not
verify the details or here is your order summary on amazon.
Such attacks are called phishing attacks.
Most popular method of distributing malware is through website, no the attacker does not create his
own website and put some malware there so that the visitors will come and download.
Because it is extremely difficult to build a website and make it popular to attract more users.
Instead, the attacker spends time compromising an already popular website, usually websites of celebrities.
So when a innocent user is thinking he is downloading a picture of Tom Cruise.
He is, in fact, downloading a Malware.
Celebrity names are very much used in malware distribution, that's why some security companies come
up with the most dangerous celebrity list every year.
Also, attackers use a technique called drive by downloads in which a website visitor need not click
on any link just by visiting the website.
The malware will be downloaded.
Another way attackers lure users into downloading the malware is through malvertising or malware advertising.
Examples of these might include online spin the wheel end of season sale on popular brands offering
80 to 90 percent discount, etc..
OK, now that we know how malwares are distributed, one question still remains whom do the attackers
target?
How do they choose whose machine to infect?
To answer this question, we will need to understand the two types of attack.
Depending on who is the target of a attack, or a malware they can be categorized into two types.
Commodity malware and APT malware, APT here stands for Advanced Persistent Threat.
To give you a real life comparison, commodity malwares are more like street muggers.
And APT malwares are like bank robbery.
Now, what do I mean by that commodity malwares usually do not have a specific target, just like street
mugger's.
They need money and they will attack anyone.
On the other hand, APT malwares have a very specific target, this target is identified after doing
a lot of research and reconnaissance.
Commodity malware attacks are very aggressive in distributing their malwares.
For them, it is, the more the merrier.
But APT malware authors are very covert and stealth in infecting their selected targets, commodity
malwares are usually built with well-known vulnerabilities and exploit like a mugger using simple tools like
a knife or a gun.
APT malwares are typically built with zero-day vulnerabilities and exploit.
Just like the bank robbery needs advanced tools and weapons.
It is comparatively easy to build a commodity malware.
In other words, a attacker with average skills, can develop a commodity malware.
It takes a sophisticated and advanced skills to build an APT malware.
Example of a commodity malware is WannaCry which will designed to infect every possible Windows machine with
SMB vulnerability.
An excellent example of a APT malware is Stuxnet, which is believed to be developed by US and Israel
to take down Iran's nuclear facility.
In a nutshell, some malwares are written to infect every possible machine and some others are designed to
attack a specific target.