At iShield, a cybersecurity department at Summit Consulting Ltd, we’re diving into the world of hackers to understand their tricks and tactics. The goal is to raise awareness so you can protect yourself and prevent falling prey to these common exploits. By knowing how hackers operate, you’ll be better equipped to spot suspicious activity and keep your information safe. In this part 3 of the series, we bring to you how malicious software exploits work. This is one of the deadliest and used tool by hackers that exploits any company from airlines to telecoms, financial institutions and everyone in between for a simple reason that many of these companies use instant messaging, emailing and online apps.
James runs a small business and relies heavily on his assistant, Anna, to manage emails and invoices. They both use their computers for almost all business operations, including handling sensitive customer data and financial transactions. During a casual search online, James’s website pops up and a cybercriminal decides to target it. The hacker knows that such a small business often deal with invoices and might not have strong cybersecurity measures in place.
Ransomware.Encrypts data and demands payment for the decryption key. You receive an email with an attachment titled “Invoice.pdf”. When you open it, a program runs and suddenly, you can’t access any of your files. A message appears on your screen demanding payment in exchange for unlocking your files. Imagine a thief breaks into your house, locks up all your valuables in a safe, and then demands money to give you the key. That’s what ransomware does with your digital files.
After some footprinting, the hacker sends Anna an email that looks like it’s from one of their regular suppliers in China, xingxing.com. The email says:
From: Supplier (supplier@xingximg)
Subject: Invoice for Recent Order
Hi Anna,
Please find attached the invoice for your recent order. Let us know if you have any questions.
Best, Xing Xing.
Anna’s Reaction
Anna sees the email and thinks it’s from a trusted supplier, Xing Xing, and does not notice that it is actually from XingXimg, a different company since it has m instead of n in the second xing. She opens the attached invoice document without hesitation.
As soon as Anna opens the attachment, malware (malicious software) installs itself on her computer in the background without her knowledge. This malware is designed to silently monitor the system and steal sensitive information like passwords, bank details, and customer data.
Later, James notices some unusual activity in their bank account and strange emails being sent from their business email address. He contacts an Summit Consulting Ltd’s iShield Security Team who discover the malware on Anna’s computer.
The Summit Consulting iShield team explains, “Malware is a type of malicious software that hackers use to harm or exploit systems. In this case, the malware was installed when Anna opened the fake invoice attachment. It has been stealing your sensitive information and sending it to the hacker.”
How to Stay Safe
The IT professional gives James and Anna some tips to stay safe:
1.) Be Skeptical of Unexpected Emails. Even if an email looks familiar, double-check its authenticity, especially if it contains attachments.
2.) Verify the Source. Contact the sender directly using a known phone number or email address before opening any attachments or clicking links. When it comes to cybersecurity, don’t get ready, stay ready. Indepedently confirm with your suppliers before you click any links in emails.
3.) Use Anti-Malware Software. Install and regularly update reliable anti-malware software to detect and prevent malware. Prevention is always better than cure.
4.) Regular Backups. Keep regular backups of important data to recover it in case of a malware attack. It is recommended that you regularly backup your critical servers and databases in an offsite location to help you continue in business in case of a crypto ransomware which could affect your business operations.
5.) Employee Training. Educate all employees about the risks of malware and how to recognize suspicious emails. As the saying goes, the only patch to human stupidity is awareness training.
James and Anna learn to be more cautious with their emails and adopt better security practices. They understand the importance of verifying the authenticity of emails and attachments and regularly updating their security software. From now on, James’s business is better protected against malware and other cyber threats, ensuring the safety of their sensitive information and smooth business operations. And that’s how James and Anna learned about malware and how to protect their business from these malicious attacks!
How malware is made
Malware can take many forms, each serving a different purpose. The common malicious software types are:
1.) Viruses.Attach to clean files and spread through systems, damaging software and data. Imagine you have a document called “MyReport.doc”. A virus attaches itself to this document. When you open it, the virus activates and starts spreading to other files on your computer. Over time, it might corrupt or delete important files. Think of a virus like a bad flu. It starts with one person (file) and spreads to others (files) it encounters, making everyone sick (damaged).
2.) Trojans.Disguise themselves as legitimate software but perform malicious activities. You download what you think is a free game called “SuperFunGame.exe” from the internet. When you run the game, it appears to work fine, but in the background, it’s stealing your personal information and sending it to hackers. Remember the story of the Trojan Horse? The Greeks gave the Trojans a giant wooden horse as a gift. The Trojans brought it inside their city, not knowing it was filled with Greek soldiers. Similarly, Trojan malware looks like a helpful or fun program, but it’s carrying harmful software inside.
3.) Ransomware.Encrypts data and demands payment for the decryption key. You receive an email with an attachment titled “Invoice.pdf”. When you open it, a program runs and suddenly, you can’t access any of your files. A message appears on your screen demanding payment in exchange for unlocking your files. Imagine a thief breaks into your house, locks up all your valuables in a safe, and then demands money to give you the key. That’s what ransomware does with your digital files.
4.) Spyware.Secretly monitors user activity and gathers information. You download a program that promises to speed up your computer, called “SpeedBoost.exe”. While it seems to work, it’s tracking your keystrokes, capturing your passwords and credit card numbers, and sending them to hackers. It’s like someone secretly installing a camera in your house to watch everything you do and hear everything you say, then sending that information to a thief.
5.) Worms. Spread across networks without needing to attach to files. You connect your computer to a public Wi-Fi network. A worm on that network finds a vulnerability in your computer and installs itself. It then starts spreading to other computers on the same network, infecting them without anyone needing to open a file or click a link. Think of a worm in a garden. Once it’s in one plant, it can move on its own to other plants, causing damage everywhere it goes, without needing any help from you to spread.
2. Programming Language
Malware can be written in various programming languages. Some common ones include:
- C/C++: Powerful and efficient, often used for creating complex malware.
- Python: Easy to write and understand, commonly used for scripting and simpler malware.
- JavaScript: Often used in browser-based attacks.
- Setting Up the Development Environment
A cybercriminal would typically set up a secure and isolated environment to create and test malware. This might include:
- Virtual Machines (VMs): To avoid infecting their own systems.
- Sandboxing: To test malware in a controlled environment.
- Obfuscation Tools: To hide the code and make it harder to detect.
- Simple malware code
Find a simplified and hypothetical example of how a basic piece of malware (like a keylogger) might be written in Python;
- Embedding and Distribution
To spread the malware, a hacker might:
- Attach it to Emails. Disguise the malware as an innocent-looking attachment (like an invoice). As already explained.
- Exploit Vulnerabilities. Use known software vulnerabilities to install malware on target systems.
- Fake Software. Create malicious software that looks legitimate and distribute it through download sites or peer-to-peer networks.
- Drive-by Downloads. Use compromised websites to automatically download malware onto visitors’ computers.
- Evading Detection
To avoid detection by antivirus software, hackers might.
1.) Obfuscate Code.Obfuscation is like writing a secret message in a way that makes it difficult for others to understand. Make the code harder to read and analyze. Imagine writing a sentence but replacing every letter with a different symbol or random letters. While the message still works, anyone trying to read it without the key to your code would find it very hard to understand. Hackers do the same with their malware code. They make it look confusing and jumbled up so that security experts and software have a tough time figuring out what the code is doing.
2.) Use Polymorphic Techniques.Change the malware’s code every time it infects a new system. Polymorphism in malware means the code changes itself every time it spreads to a new computer. Think of a shape-shifting creature from a sci-fi movie. Every time it moves to a new location, it changes its appearance so it’s harder to recognize. When malware uses polymorphic techniques, it changes parts of its code each time it infects a new computer. This makes it look different each time and harder for antivirus programs to detect and block it because it doesn’t look the same twice.
3.) Encrypt Payloads.Encrypt the malicious parts of the code so they aren’t easily detected. Encryption is like putting your valuables in a locked safe so only someone with the key can access them. Imagine you wrote a secret message, but instead of just hiding it, you put it in a box with a lock that only you have the key for. Even if someone finds the box, they can’t read the message without your key. Hackers encrypt the harmful parts of their code, turning it into a secret code that’s not easily readable. Even if security software detects the malware, it can’t easily understand what the code does because it’s all locked up in a kind of digital safe. Only the malware itself knows how to unlock it.
7.Command and Control (C&C).Once installed, many types of malware need to communicate with the attacker. This might involve:
- C&C Servers. Servers controlled by the attacker to send commands to and receive data from the infected systems.
- Using Standard Protocols. HTTP, HTTPS, or DNS to blend in with normal traffic.
Protecting Yourself Against Malware
To protect against malware, you should;
- Use Antivirus Software. Keep it updated.
- Be Wary of Emails and Attachments. Verify sources before opening attachments or clicking links.
- Regularly Update Software. Keep your operating system and all software up to date to patch vulnerabilities.
- Backup Data. Regularly backup important data to recover it in case of an attack.
- Educate Yourself and Others. Stay informed about the latest threats and share this knowledge with your peers.
Understanding how malware is created helps in developing better defenses against it. Always practice ethical behavior and use your knowledge to enhance cybersecurity.
Mr.Strategy Tweet
Copyright Summit Consulting Ltd’s iShield Cybersecurity 2024. All rights reserved.
