Cyberstudy
PDF p.335 In progress

Computer Worms and Fileless Malware

Open PDF at p.335 12 flashcards

Summary

PDF p.335

A computer worm is a type of memory-resident malware that replicates and spreads over network resources without user intervention. Fileless malware, on the other hand, operates without writing its code to disk, using memory-resident techniques to evade detection.

Detailed explanation

PDF p.335
  • Computer Worms
    • Execution: Runs without user action by exploiting vulnerabilities in processes.
    • Examples: Code Red worm infected Microsoft's IIS web server via a buffer overflow.
    • Effects: Consumes network bandwidth, can crash systems, and may carry malicious payloads.
    • Notable Worm: Conficker demonstrated the potential for remote code execution and potent attacks.
  • Fileless Malware
    • Characteristics
      • Does not write code to disk; operates in memory.
      • May alter registry values for persistence.
      • Initial execution may depend on user actions like running a script or opening a file.
    • Techniques
      • Uses lightweight shellcode for backdoor mechanisms.
      • Downloads additional payloads, often obfuscated to evade detection.
      • Employs "live off the land" techniques, using legitimate system tools (e.g., PowerShell, WMI) to execute actions.
    • Classifications
      • Advanced Persistent Threat (APT): Long-term, targeted attacks.
      • Advanced Volatile Threat (AVT): Similar to APT but more transient.
      • Low-Observable Characteristics (LOC) Attack: Uses various coding tricks to evade detection.

Important terms

taken from the text above
Execution
Runs without user action by exploiting vulnerabilities in processes.
Effects
Consumes network bandwidth, can crash systems, and may carry malicious payloads.
Notable Worm
Conficker demonstrated the potential for remote code execution and potent attacks.
Advanced Persistent Threat (APT)
Long-term, targeted attacks.
Advanced Volatile Threat (AVT)
Similar to APT but more transient.
Low-Observable Characteristics (LOC) Attack
Uses various coding tricks to evade detection.
APT Advanced Persistent Threat AVT Advanced Volatile Threat LOC Low-Observable Characteristics

What I should remember

Key Points PDF p.335
  • Computer Worms
    • Execution: Exploits vulnerabilities, no user action needed.
    • Effects: Network bandwidth consumption, system crashes, malicious payloads.
    • Examples: Code Red, Conficker.
  • Fileless Malware
    • Characteristics: Memory-resident, no disk code, registry changes for persistence.
    • Techniques: Lightweight shellcode, obfuscated payloads, "live off the land" methods.
    • Classifications: APT, AVT, LOC attacks.