2.4 Other Malware Types

Question 1

Keyloggers

Answer 1

• Your keystrokes contain valuable information– Web site login URLs, passwords, email messages
• Save all of your input and send it to the bad guys
• Circumvents encryption protections– Your keystrokes are in the clear
• Other data logging– Clipboard logging, screen logging, instant messaging,
  search engine queries

Question 2

Logic bomb

Answer 2

A logic bomb is a piece of malicious code intentionally inserted into a software system, application, or network that remains dormant until specific, predefined conditions are met (e.g., a date, time, or user action). When triggered, it executes destructive actions, such as deleting data, corrupting systems, or triggering ransomware.

• Waits for a predefined event– Often left by someone with grudge
• Time bomb - Time or date
• User event - Logic bomb
• Difficult to identify - Difficult to recover if it goes of

Question 3

Real-world logic bombs

Answer 3

• March 19, 2013, South Korea– Email with malicious attachment sent to
  South Korean organizations– Posed as a bank email - Trojan installs malware
• March 20, 2013, 2 p.m. local time– Malware time-based logic-bomb activates– Storage and master boot record deleted, system reboots
• Boot device not found.
  Please install an operating system on your hard disk.
• December 17, 2016, 11:53 p.m.– Ukraine high-voltage substation. Logic bomb begins disabling
  electrical circuits. Malware mapped out the control network
• Began disabling power at a predetermined time
• Customized for SCADA networks– Supervisory Control and Data Acquisitio

Question 4

Preventing a logic bomb

Answer 4

• Difficult to recognize– Each is unique– No predefined signatures
• Process and procedures– Formal change control
• Electronic monitoring– Alert on changes– Host-based intrusion detection,
  Tripwire, etc.
• Constant auditing– An administrator can circumvent
  existing systems

Question 5

Rootkits

Answer 5

Originally a Unix technique– The “root” in rootkit
* Modifies core system files– Part of the kernel
* Can be invisible to the operating system– Won’t see it in Task Manager
* Also invisible to traditional anti-virus utilities– If you can’t see it, you can’t stop it

Question 6

Finding and removing rootkits

Answer 6

• Look for the unusual– Anti-malware scans
• Use a remover specific to the rootkit– Usually built after the rootkit is discovered
• Secure boot with UEF