text:
Malware
From Wikipedia, the free encyclopedia
Jump to: navigation, search
This article is part of a series on
Information security
Related security categories
Internet security
Cyberwarfare
Computer security
Mobile security
Network security
Threats
Computer crime
Vulnerability
Eavesdropping
Malware
Spyware
Ransomware
Trojans
Viruses
Worms
Rootkits
Bootkits
Keyloggers
Screen scrapers
Exploits
Backdoors
Logic bombs
Payloads
Denial of service
Defenses
Computer access control
Application security
Antivirus software
Secure coding
Security by design
Secure operating systems
Authentication
Multi-factor authentication
Authorization
Data-centric security
Encryption
Firewall
Intrusion detection system
Intrusion prevention system
Mobile secure gateway
v
t
e
This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. (July 2013) (Learn how and when to remove this template message)
Malware, short for malicious software, is an umbrella term used to refer to a variety of forms of harmful or intrusive software,[1] including computer viruses, worms, Trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other software.[2] Malware is defined by its malicious intent, acting against the requirements of the computer user — and so does not include software that causes unintentional harm due to some deficiency.
Programs supplied officially by companies can be considered malware if they secretly act against the interests of the computer user. An example is the Sony rootkit, a Trojan horse embedded into CDs sold by Sony, which silently installed and concealed itself on purchasers' computers with the intention of preventing illicit copying; it also reported on users' listening habits, and unintentionally created vulnerabilities that were exploited by unrelated malware.[3]
Antivirus software and firewalls are used to protect against malicious activity, and to recover from attacks.[4]
Contents
[hide]
1 Purposes
2 Infectious malware
3 Concealment
3.1 Viruses
3.2 Lock-screens
3.3 Trojan horses
3.4 Rootkits
3.5 Backdoors
3.6 Evasion
4 Vulnerability
4.1 Security defects in software
4.2 Insecure design or user error
4.3 Over-privileged users and over-privileged code
4.4 Use of the same operating system
5 Anti-malware strategies
5.1 Anti-virus and anti-malware software
5.2 Website security scans
5.3 "Air gap" isolation or "Parallel Network"
6 Grayware
7 History of viruses and worms
8 Academic research
9 See also
10 References
11 External links
Purposes[edit]
Malware by categories on 16 March 2011.
Many early infectious programs, including the first Internet Worm, were written as experiments or pranks. Today, malware is used by both black hat hackers and governments, to steal personal, financial, or business information.[5][6]
Malware is sometimes used broadly against government or corporate websites to gather guarded information,[7] or to disrupt their operation in general. However, malware can be used against individuals to gain information such as personal identification numbers or details, bank or credit card numbers, and passwords.
Since the rise of widespread broadband Internet access, malicious software has more frequently been designed for profit. Since 2003, the majority of widespread viruses and worms have been designed to take control of users' computers for illicit purposes.[8] Infected "zombie computers" can be used to send email spam, to host contraband data such as child pornography,[9] or to engage in distributed denial-of-service attacks as a form of extortion.[10]
Programs designed to monitor users' web browsing, display unsolicited advertisements, or redirect affiliate marketing revenues are called spyware. Spyware programs do not spread like viruses; instead they are generally installed by exploiting security holes. They can also be hidden and packaged together with unrelated user-installed software.[11]
Ransomware affects an infected computer system in some way, and demands payment to bring it back to its normal state. For example, programs such as CryptoLocker encrypt files securely, and only decrypt them on payment of a substantial sum of money.
Some malware is used to generate money by click fraud, making it appear that the computer user has clicked an advertising link on a site, generating a payment from the advertiser. It was estimated in 2012 that about 60 to 70% of all active malware used some kind of click fraud, and 22% of all ad-clicks were fraudulent.[12]
In addition to criminal money-making, malware can be used for sabotage, often for political motives. Stuxnet, for example, was designed to disrupt very specific industrial equipment. There have been politically motivated attacks that have spread over and shut down large computer networks, including massive deletion of files and corruption of master boot records, described as "computer killing". Such attacks were made on Sony Pictures Entertainment (25 November 2014, using malware known as Shamoon or W32.Disttrack) and Saudi Aramco (August 2012).[13][14]
Infectious malware[edit]
Main articles: Computer virus and Computer worm
The best-known types of malware, viruses and worms, are known for the manner in which they spread, rather than any specific types of behavior. A computer virus is software that embeds itself in some other executable software (including the operating system itself) on the target system without the user's consent and when it is run, the virus is spread to other executables. On the other hand, a worm is a stand-alone malware software that actively transmits itself over a network to infect other computers. These definitions lead to the observation that a virus requires the user to run an infected software or operating system for the virus to spread, whereas a worm spreads itself.[15]
Concealment[edit]
These categories are not mutually exclusive, so malware may use multiple techniques.[16] This section only applies to malware designed to operate undetected, not sabotage and ransomware.
See also: Polymorphic packer
Viruses[edit]
Main article: Computer virus
A computer virus is software usually hidden within another seemingly innocuous program that can produce copies of itself and insert them into other programs or files, and that usually performs a harmful action (such as destroying data).[17] An example of this is a PE infection, a technique, usually used to spread malware, that inserts extra data or executable code into PE files.[18]
Lock-screens[edit]
Main article: Ransomware
Lock-screens, or screen lockers is a type of “cyber police” ransomware that blocks screens on Windows or Android devices with a false accusation in harvesting illegal content, trying to scare the victims into paying up a fee.[19] Jisut and SLocker impact Android devices more than other lock-screens, with Jisut making up nearly 60 percent of all Android ransomware detections.[20]
Trojan horses[edit]
Main article: Trojan horse (computing)
A Trojan horse is a malicious program which misrepresents itself to appear useful, routine, or interesting in order to persuade a victim to install it. The term is derived from the Ancient Greek story of the Trojan horse used to invade the city of Troy by stealth.[21][22][23][24][25]
Trojan horses are generally spread by some form of social engineering, for example, where a user is duped into executing an e-mail attachment disguised to be unsuspicious, (e.g., a routine form to be filled in), or by drive-by download. Although their payload can be anything, many modern forms act as a backdoor, contacting a controller which can then have unauthorized access to the affected computer.[26] While Trojan horses and backdoors are not easily detectable by themselves, computers may appear to run slower due to heavy processor or network usage.
Unlike computer viruses and worms, Trojan horses generally do not attempt to inject themselves into other files or otherwise propagate themselves.[27]
In spring 2017 Mac users were hit by the new version of Proton Remote Access Trojan (RAT)[28] trained to extract password data from various sources, such as browser auto-fill data, the Mac-OS keychain, and password vaults.[29]
Rootkits[edit]
Main article: Rootkit
Once malicious software is installed on a system, it is essential that it stays concealed, to avoid detection. Software packages known as rootkits allow this concealment, by modifying the host's operating system so that the malware is hidden from the user. Rootkits can prevent a malicious process from being visible in the system's list of processes, or keep its files from being read.[30]
Some malicious software contains routines to defend against removal, not merely to hide themselves. An early example of this behavior is recorded in the Jargon File tale of a pair of programs infesting a Xerox CP-V time sharing system:
Each ghost-job would detect the fact that the other had been killed, and would start a new copy of the recently stopped program within a few milliseconds. The only way to kill both ghosts was to kill them simultaneously (very difficult) or to deliberately crash the system.[31]
Backdoors[edit]
Main article: Backdoor (computing)
A backdoor is a method of bypassing normal authentication procedures, usually over a connection to a network such as the Internet. Once a system has been compromised, one or more backdoors may be installed in order to allow access in the future,[32] invisibly to the user.
The idea has often been suggested that computer manufacturers preinstall backdoors on their systems to provide technical support for customers, but this has never been reliably verified. It was reported in 2014 that US government agencies had been diverting computers purchased by those considered "targets" to secret workshops where software or hardware permitting remote access by the agency was installed, considered to be among the most productive operations to obtain access to networks around the world.[33] Backdoors may be installed by Trojan horses, worms, implants, or other methods.[34][35]
Evasion[edit]
Since the beginning of 2015, a sizable portion of malware utilizes a combination of many techniques designed to avoid detection and analysis.[36]
The most common evasion technique is when the malware evades analysis and detection by fingerprinting the environment when executed.[37]
The second most common evasion technique is confusing automated tools' detection methods. This allows malware to avoid detection by technologies such as signature-based antivirus software by changing the server used by the malware.[38]
The third most common evasion technique is timing-based evasion. This is when malware runs at certain times or following certain actions taken by the user, so it executes during certain vulnerable periods, such as during the boot process, while remaining dormant the rest of the time.
The fourth most common evasion technique is done by obfuscating internal data so that automated tools do not detect the malware.[39]
An increasingly common technique is adware that uses stolen certificates to disable anti-malware and virus protection; technical remedies are available to deal with the adware.[40]
Nowadays, one of the most sophisticated and stealthy ways of evasion is to use information hiding techniques, namely stegomalware.
Vulnerability[edit]
Main article: Vulnerability (computing)
In this context, and throughout, what is called the "system" under attack may be anything from a single application, through a complete computer and operating system, to a large network.
Various factors make a system more vulnerable to malware:
Security defects in software[edit]
Malware exploits security defects (security bugs or vulnerabilities) in the design of the operating system, in applications (such as browsers, e.g. older versions of Microsoft Internet Explorer supported by Windows XP[41]), or in vulnerable versions of browser plugins such as Adobe Flash Player, Adobe Acrobat or Reader, or Java SE.[42][43] Sometimes even installing new versions of such plugins does not automatically uninstall old versions. Security advisories from plug-in providers announce security-related updates.[44] Common vulnerabilities are assigned CVE IDs and listed in the US National Vulnerability Database. Secunia PSI[45] is an example of software, free for personal use, that will check a PC for vulnerable out-of-date software, and attempt to update it.
Malware authors target bugs, or loopholes, to exploit. A common method is exploitation of a buffer overrun vulnerability, where software designed to store data in a specified region of memory does not prevent more data than the buffer can accommodate being supplied. Malware may provide data that overflows the buffer, with malicious executable code or data after the end; when this payload is accessed it does what the attacker, not the legitimate software, determines.
Insecure design or user error[edit]
Early PCs had to be booted from floppy disks. When built-in hard drives became common, the operating system was normally started from them, but it was possible to boot from another boot device if available, such as a floppy disk, CD-ROM, DVD-ROM, USB flash drive or network. It was common to configure the computer to boot from one of these devices when available. Normally none would be available; the user would intentionally insert, say, a CD into the optical drive to boot the computer in some special way, for example, to install an operating system. Even without booting, computers can be configured to execute software on some media as soon as they become available, e.g. to autorun a CD or USB device when inserted.
Malicious software distributors would trick the user into booting or running from an infected device or medium. For example, a virus could make an infected computer add autorunnable code to any USB stick plugged into it. Anyone who then attached the stick to another computer set to autorun from USB would in turn become infected, and also pass on the infection in the same way.[46] More generally, any device that plugs into a USB port - even lights, fans, speakers, toys, or peripherals such as a digital microscope - can be used to spread malware. Devices can be infected during manufacturing or supply if quality control is inadequate.[46]
This form of infection can largely be avoided by setting up computers by default to boot from the internal hard drive, if available, and not to autorun from devices.[46] Intentional booting from another device is always possible by pressing certain keys during boot.
Older email software would automatically open HTML email containing potentially malicious JavaScript code. Users may also execute disguised malicious email attachments and infected executable files supplied in other ways.[citation needed]
Over-privileged users and over-privileged code[edit]
Main article: principle of least privilege
In computing, privilege refers to how much a user or program is allowed to modify a system. In poorly designed computer systems, both users and programs can be assigned more privileges than they should be, and malware can take advantage of this. The two ways that malware does this is through overprivileged users and overprivileged code.
Some systems allow all users to modify their internal structures, and such users today would be considered over-privileged users. This was the standard operating procedure for early microcomputer and home computer systems, where there was no distinction between an administrator or root, and a regular user of the system. In some systems, non-administrator users are over-privileged by design, in the sense that they are allowed to modify internal structures of the system. In some environments, users are over-privileged because they have been inappropriately granted administrator or equivalent status.
Some systems allow code executed by a user to access all rights of that user, which is known as over-privileged code. This was also standard operating procedure for early microcomputer and home computer systems. Malware, running as over-privileged code, can use this privilege to subvert the system. Almost all currently popular operating systems, and also many scripting applications allow code too many privileges, usually in the sense that when a user executes code, the system allows that code all rights of that user. This makes users vulnerable to malware in the form of e-mail attachments, which may or may not be disguised.
Use of the same operating system[edit]
Homogeneity can be a vulnerability. For example, when all computers in a network run the same operating system, upon exploiting one, one worm can exploit them all:[47] In particular, Microsoft Windows or Mac OS X have such a large share of the market that an exploited vulnerability concentrating on either operating system could subvert a large number of systems. Introducing diversity purely for the sake of robustness, such as adding Linux computers, could increase short-term costs for training and maintenance. However, as long as all the nodes are not part of the same directory service for authentication, having a few diverse nodes could deter total shutdown of the network and allow those nodes to help with recovery of the infected nodes. Such separate, functional redundancy could avoid the cost of a total shutdown, at the cost of increased complexity and reduced usability in terms of single sign-on authentication.
Anti-malware strategies[edit]
Main article: Antivirus software
As malware attacks become more frequent, attention has begun to shift from viruses and spyware protection, to malware protection, and programs that have been specifically developed to combat malware. (Other preventive and recovery measures, such as backup and recovery methods, are mentioned in the computer virus article).
Anti-virus and anti-malware software[edit]
A specific component of anti-virus and anti-malware software, commonly referred to as an on-access or real-time scanner, hooks deep into the operating system's core or kernel and functions in a manner similar to how certain malware itself would attempt to operate, though with the user's informed permission for protecting the system. Any time the operating system accesses a file, the on-access scanner checks if the file is a 'legitimate' file or not. If the file is identified as malware by the scanner, the access operation will be stopped, the file will be dealt with by the scanner in a pre-defined way (how the anti-virus program was configured during/post installation), and the user will be notified.[citation needed] This may have a considerable performance impact on the operating system, though the degree of impact is dependent on how well the scanner was programmed. The goal is to stop any operations the malware may attempt on the system before they occur, including activities which might exploit bugs or trigger unexpected operating system behavior.
Anti-malware programs can combat malware in two ways:
They can provide real time protection against the installation of malware software on a computer. This type of malware protection works the same way as that of antivirus protection in that the anti-malware software scans all incoming network data for malware and blocks any threats it comes across.
Anti-malware software programs can be used solely for detection and removal of malware software that has already been installed onto a computer. This type of anti-malware software scans the contents of the Windows registry, operating system files, and installed programs on a computer and will provide a list of any threats found, allowing the user to choose which files to delete or keep, or to compare this list to a list of known malware components, removing files that match.[48]
Real-time protection from malware works identically to real-time antivirus protection: the software scans disk files at download time, and blocks the activity of components known to represent malware. In some cases, it may also intercept attempts to install start-up items or to modify browser settings. Because many malware components are installed as a result of browser exploits or user error, using security software (some of which are anti-malware, though many are not) to "sandbox" browsers (essentially isolate the browser from the computer and hence any malware induced change) can also be effective in helping to restrict any damage done.[citation needed]
Examples of Microsoft Windows antivirus and anti-malware software include the optional Microsoft Security Essentials[49] (for Windows XP, Vista, and Windows 7) for real-time protection, the Windows Malicious Software Removal Tool[50] (now included with Windows (Security) Updates on "Patch Tuesday", the second Tuesday of each month), and Windows Defender (an optional download in the case of Windows XP, incorporating MSE functionality in the case of Windows 8 and later).[51] Additionally, several capable antivirus software programs are available for free download from the Internet (usually restricted to non-commercial use).[52] Tests found some free programs to be competitive with commercial ones.[52] Microsoft's System File Checker can be used to check for and repair corrupted system files.
Some viruses disable System Restore and other important Windows tools such as Task Manager and Command Prompt. Many such viruses can be removed by rebooting the computer, entering Windows safe mode with networking[53], and then using system tools or Microsoft Safety Scanner.[54]
Hardware implants can be of any type, so there can be no general way to detect them.
Website security scans[edit]
As malware also harms the compromised websites (by breaking reputation, blacklisting in search engines, etc.), some websites offer vulnerability scanning.[55][56][57][58] Such scans check the website, detect malware, may note outdated software, and may report known security issues.
"Air gap" isolation or "Parallel Network"[edit]
As a last resort, computers can be protected from malware, and infected computers can be prevented from disseminating trusted information, by imposing an "air gap" (i.e. completely disconnecting them from all other networks). However, malware can still cross the air gap in some situations. For example, removable media can carry malware across the gap. In December 2013 researchers in Germany showed one way that an apparent air gap can be defeated.[59]
"AirHopper",[60] "BitWhisper",[61] "GSMem" [62] and "Fansmitter" [63] are four techniques introduced by researchers that can leak data from air-gapped computers using electromagnetic, thermal and acoustic emissions.
Grayware[edit]
See also: Privacy-invasive software and Potentially unwanted program
Grayware is a term applied to unwanted applications or files that are not classified as malware, but can worsen the performance of computers and may cause security risks.[64]
It describes applications that behave in an annoying or undesirable manner, and yet are less serious or troublesome than malware. Grayware encompasses spyware, adware, fraudulent dialers, joke programs, remote access tools and other unwanted programs that may harm the performance of computers or cause inconvenience. The term came into use around 2004.[65]
Another term, potentially unwanted program (PUP) or potentially unwanted application (PUA),[66] refers to applications that would be considered unwanted despite often having been downloaded by the user, possibly after failing to read a download agreement. PUPs include spyware, adware, and fraudulent dialers. Many security products classify unauthorised key generators as grayware, although they frequently carry true malware in addition to their ostensible purpose.
Software maker Malwarebytes lists several criteria for classifying a program as a PUP.[67] Some types of adware (using stolen certificates) turn off anti-malware and virus protection; technical remedies are available.[40]
History of viruses and worms[edit]
Before Internet access became widespread, viruses spread on personal computers by infecting the executable boot sectors of floppy disks. By inserting a copy of itself into the machine code instructions in these executables, a virus causes itself to be run whenever a program is run or the disk is booted. Early computer viruses were written for the Apple II and Macintosh, but they became more widespread with the dominance of the IBM PC and MS-DOS system. Executable-infecting viruses are dependent on users exchanging software or boot-able floppies and thumb drives so they spread rapidly in computer hobbyist circles.[citation needed]
The first worms, network-borne infectious programs, originated not on personal computers, but on multitasking Unix systems. The first well-known worm was the Internet Worm of 1988, which infected SunOS and VAX BSD systems. Unlike a virus, this worm did not insert itself into other programs. Instead, it exploited security holes (vulnerabilities) in network server programs and started itself running as a separate process.[68] This same behavior is used by today's worms as well.[citation needed][69]
With the rise of the Microsoft Windows platform in the 1990s, and the flexible macros of its applications, it became possible to write infectious code in the macro language of Microsoft Word and similar programs. These macro viruses infect documents and templates rather than applications (executables), but rely on the fact that macros in a Word document are a form of executable code.[70]
Academic research[edit]
Main article: Malware research
The notion of a self-reproducing computer program can be traced back to initial theories about the operation of complex automata.[71] John von Neumann showed that in theory a program could reproduce itself. This constituted a plausibility result in computability theory. Fred Cohen experimented with computer viruses and confirmed Neumann's postulate and investigated other properties of malware such as detectability and self-obfuscation using rudimentary encryption. His doctoral dissertation was on the subject of computer viruses.[72] The combination of cryptographic technology as part of the payload of the virus, exploiting it for attack purposes was initialized and investigated from the mid 1990s, and includes initial ransomware and evasion ideas.[73]
See also[edit]
Botnet
Browser hijacking
Comparison of antivirus software
Computer security
Cyber spying
Facebook malware
File binder
Identity theft
Industrial espionage
Linux malware
Malvertising
Phishing
Riskware
Security in Web apps
Social engineering (security)
Targeted threat
Telemetry software
Typosquatting
Web server overload causes
Zombie (computer science)
References[edit]
Jump up ^ "Defining Malware: FAQ". technet.microsoft.com. Retrieved 10 September 2009.
Jump up ^ "An Undirected Attack Against Critical Infrastructure" (PDF). United States Computer Emergency Readiness Team(Us-cert.gov). Retrieved 28 September 2014.
Jump up ^ Russinovich, Mark (31 October 2005). "Sony, Rootkits and Digital Rights Management Gone Too Far". Mark's Blog. Microsoft MSDN. Retrieved 29 July 2009.
Jump up ^ "Protect Your Computer from Malware". OnGuardOnline.gov. Retrieved 26 August 2013.
Jump up ^ "Malware". FEDERAL TRADE COMMISSION- CONSUMER INFORMATION. Retrieved 27 March 2014.
Jump up ^ Hernandez, Pedro. "Microsoft Vows to Combat Government Cyber-Spying". eWeek. Retrieved 15 December 2013.
Jump up ^ Kovacs, Eduard. "MiniDuke Malware Used Against European Government Organizations". Softpedia. Retrieved 27 February 2013.
Jump up ^ "Malware Revolution: A Change in Target". March 2007.
Jump up ^ "Child Porn: Malware's Ultimate Evil". November 2009.
Jump up ^ PC World – Zombie PCs: Silent, Growing Threat.
Jump up ^ "Peer To Peer Information". NORTH CAROLINA STATE UNIVERSITY. Retrieved 25 March 2011.
Jump up ^ "Another way Microsoft is disrupting the malware ecosystem". Retrieved 18 February 2015.
Jump up ^ "Shamoon is latest malware to target energy sector". Retrieved 18 February 2015.
Jump up ^ "Computer-killing malware used in Sony attack a wake-up call". Retrieved 18 February 2015.
Jump up ^ "computer virus – Encyclopædia Britannica". Britannica.com. Retrieved 28 April 2013.
Jump up ^ All about Malware and Information Privacy
Jump up ^ "What are viruses, worms, and Trojan horses?". Indiana University. The Trustees of Indiana University. Retrieved 23 February 2015.
Jump up ^ Peter Szor (3 February 2005). The Art of Computer Virus Research and Defense. Pearson Education. p. 204. ISBN 978-0-672-33390-3.
Jump up ^ "Rise of Android Ransomware, research" (PDF). ESET.
Jump up ^ "State of Malware, research" (PDF). Malwarebytes.
Jump up ^ Landwehr, C. E; A. R Bull; J. P McDermott; W. S Choi (1993). A taxonomy of computer program security flaws, with examples. DTIC Document. Retrieved 5 April 2012.
Jump up ^ "Trojan Horse Definition". Retrieved 5 April 2012.
Jump up ^ "Trojan horse". Webopedia. Retrieved 5 April 2012.
Jump up ^ "What is Trojan horse? – Definition from Whatis.com". Retrieved 5 April 2012.
Jump up ^ "Trojan Horse: [coined By MIT-hacker-turned-NSA-spook Dan Edwards] N". Retrieved 5 April 2012.
Jump up ^ "What is the difference between viruses, worms, and Trojan horses?". Symantec Corporation. Retrieved 10 January 2009.
Jump up ^ "VIRUS-L/comp.virus Frequently Asked Questions (FAQ) v2.00 (Question B3: What is a Trojan Horse?)". 9 October 1995. Retrieved 13 September 2012.
Jump up ^ "Proton Mac Trojan Has Apple Code Signing Signatures Sold to Customers for $50k". AppleInsider.
Jump up ^ "Non-Windows Malware". Betanews.
Jump up ^ McDowell, Mindi. "Understanding Hidden Threats: Rootkits and Botnets". US-CERT. Retrieved 6 February 2013.
Jump up ^ "Catb.org". Catb.org. Retrieved 15 April 2010.
Jump up ^ Vincentas (11 July 2013). "Malware in SpyWareLoop.com". Spyware Loop. Retrieved 28 July 2013.
Jump up ^ Staff, SPIEGEL. "Inside TAO: Documents Reveal Top NSA Hacking Unit". SPIEGEL. Retrieved 23 January 2014.
Jump up ^ Edwards, John. "Top Zombie, Trojan Horse and Bot Threats". IT Security. Retrieved 25 September 2007.
Jump up ^ Appelbaum, Jacob. "Shopping for Spy Gear:Catalog Advertises NSA Toolbox". SPIEGEL. Retrieved 29 December 2013.
Jump up ^ Evasive malware
Jump up ^ Kirat, Dhilung; Vigna, Giovanni; Kruegel, Christopher (2014). Barecloud: bare-metal analysis-based evasive malware detection. ACM. pp. 287–301. ISBN 978-1-931971-15-7.
Jump up ^ The Four Most Common Evasive Techniques Used by Malware. 27 April 2015.
Jump up ^ Young, Adam; Yung, Moti (1997). "Deniable Password Snatching: On the Possibility of Evasive Electronic Espionage". Symp. on Security and Privacy. IEEE. pp. 224–235. ISBN 0-8186-7828-3.
^ Jump up to: a b Casey, Henry T. (25 November 2015). "Latest adware disables antivirus software". Tom's Guide. Yahoo.com. Retrieved 25 November 2015.
Jump up ^ "Global Web Browser... Security Trends" (PDF). Kaspersky lab. November 2012.
Jump up ^ Rashid, Fahmida Y. (27 November 2012). "Updated Browsers Still Vulnerable to Attack if Plugins Are Outdated". pcmag.com.
Jump up ^ Danchev, Dancho (18 August 2011). "Kaspersky: 12 different vulnerabilities detected on every PC". pcmag.com.
Jump up ^ "Adobe Security bulletins and advisories". Adobe.com. Retrieved 19 January 2013.
Jump up ^ Rubenking, Neil J. "Secunia Personal Software Inspector 3.0 Review & Rating". PCMag.com. Retrieved 19 January 2013.
^ Jump up to: a b c "USB devices spreading viruses". CNET. CBS Interactive. Retrieved 18 February 2015.
Jump up ^ "LNCS 3786 – Key Factors Influencing Worm Infection", U. Kanlayasiri, 2006, web (PDF): SL40-PDF.
Jump up ^ "How Antivirus Software Works?". Retrieved 16 October 2015.
Jump up ^ "Microsoft Security Essentials". Microsoft. Retrieved 21 June 2012.
Jump up ^ "Malicious Software Removal Tool". Microsoft. Archived from the original on 21 June 2012. Retrieved 21 June 2012.
Jump up ^ "Windows Defender". Microsoft. Archived from the original on 22 June 2012. Retrieved 21 June 2012.
^ Jump up to: a b Rubenking, Neil J. (8 January 2014). "The Best Free Antivirus for 2014". pcmag.com.
Jump up ^ "How do I remove a computer virus?". Microsoft. Retrieved 26 August 2013.
Jump up ^ "Microsoft Safety Scanner". Microsoft. Retrieved 26 August 2013.
Jump up ^ "An example of a website vulnerability scanner". Unmaskparasites.com. Retrieved 19 January 2013.
Jump up ^ "Redleg's File Viewer. Used to check a webpage for malicious redirects or malicious HTML coding". Aw-snap.info. Retrieved 19 January 2013.
Jump up ^ "Example Google.com Safe Browsing Diagnostic page". Google.com. Retrieved 19 January 2013.
Jump up ^ "Safe Browsing (Google Online Security Blog)". Retrieved 21 June 2012.
Jump up ^ Hanspach, Michael; Goetz, Michael (November 2013). "On Covert Acoustical Mesh Networks in Air". Journal of Communications. arXiv:1406.1213  . doi:10.12720/jcm.8.11.758-767.
Jump up ^ M. Guri, G. Kedma, A. Kachlon and Y. Elovici, "AirHopper: Bridging the air-gap between isolated networks and mobile phones using radio frequencies," Malicious and Unwanted Software: The Americas (MALWARE), 2014 9th International Conference on, Fajardo, PR, 2014, pp. 58-67.
Jump up ^ M. Guri, M. Monitz, Y. Mirski and Y. Elovici, "BitWhisper: Covert Signaling Channel between Air-Gapped Computers Using Thermal Manipulations," 2015 IEEE 28th Computer Security Foundations Symposium, Verona, 2015, pp. 276-289.
Jump up ^ GSMem: Data Exfiltration from Air-Gapped Computers over GSM Frequencies. Mordechai Guri, Assaf Kachlon, Ofer Hasson, Gabi Kedma, Yisroel Mirsky, and Yuval Elovici, Ben-Gurion University of the Negev; USENIX Security Symposium 2015
Jump up ^ https://arxiv.org/ftp/arxiv/papers/1606/1606.05915.pdf
Jump up ^ Vincentas (11 July 2013). "Grayware in SpyWareLoop.com". Spyware Loop. Archived from the original on 15 July 2014. Retrieved 28 July 2013.
Jump up ^ "Threat Encyclopedia – Generic Grayware". Trend Micro. Retrieved 27 November 2012.
Jump up ^ "Rating the best anti-malware solutions". Arstechnica. Retrieved 28 January 2014.
Jump up ^ "PUP Criteria". malwarebytes.org. Retrieved 13 February 2015.
Jump up ^ William A Hendric (4 September 2014). "Computer Virus history". The Register. Retrieved 29 March 2015.
Jump up ^ "Malware: Types, Protection, Prevention, Detection & Removal - Ultimate Guide". EasyTechGuides.
Jump up ^ "Beware of Word Document Viruses". us.norton.com. Retrieved 2017-09-25.
Jump up ^ John von Neumann, "Theory of Self-Reproducing Automata", Part 1: Transcripts of lectures given at the University of Illinois, December 1949, Editor: A. W. Burks, University of Illinois, USA, 1966.
Jump up ^ Fred Cohen, "Computer Viruses", PhD Thesis, University of Southern California, ASP Press, 1988.
Jump up ^ Young, Adam; Yung, Moti (2004). Malicious cryptography - exposing cryptovirology. Wiley. pp. 1–392. ISBN 978-0-7645-4975-5.
External links[edit]
Look up malware in Wiktionary, the free dictionary.
Wikimedia Commons has media related to Malware.
Malicious Software at Curlie (based on DMOZ)
Further Reading: Research Papers and Documents about Malware on IDMARCH (Int. Digital Media Archive)
Advanced Malware Cleaning – a Microsoft video
[show]
v
t
e
Malware topics
Infectious malware
Computer virus
Comparison of computer viruses
Computer worm
List of computer worms
Timeline of computer viruses and worms
Concealment
Trojan horse
Rootkit
Backdoor
Zombie computer
Man-in-the-middle
Man-in-the-browser
Man-in-the-mobile
Clickjacking
Malware for profit
Privacy-invasive software
Adware
Spyware
Botnet
Keystroke logging
Form grabbing
Web threats
Fraudulent dialer
Malbot
Scareware
Rogue security software
Ransomware
Crimeware
By operating system
Linux malware
Palm OS viruses
Mobile malware
Macro virus
Classic Mac OS viruses
MacOS malware
iOS malware
Android malware
Protection
Anti-keylogger
Antivirus software
Browser security
Internet security
Mobile security
Network security
Defensive computing
Firewall
Intrusion detection system
Data loss prevention software
Countermeasures
Computer and network surveillance
Operation: Bot Roast
Honeypot
[show]
v
t
e
Software distribution
Licenses
Beerware
Floating licensing
Free
Free and open-source
Freely redistributable
Open source
Proprietary
Public domain
Compensation models
Adware
Commercial software
Retail software
Crippleware
Crowdfunding
Freemium
Freeware
Pay what you want
Careware
Donationware
Open core
Postcardware
Shareware
Nagware
Delivery methods
Digital distribution
File sharing
On-premises
Pre-installed
Product bundling
Retail software
Sneakernet
Software as a service
Deceptive and/or illicit
Unwanted software bundling
Malware
Spyware
Trojan horse
Worm
Ransomware
Scareware
Shovelware
Vaporware
Software release life cycle
Abandonware
End-of-life
Long-term support
Software maintenance
Software maintainer
Software publisher
Copy protection
Digital rights management
Software protection dongle
Hardware restrictions
License manager
Product activation
Product key
Software copyright
Software patent
Torrent poisoning
Information technology portal
Internet portal
Computer security portal
Authority control
GND: 4687059-3
Retrieved from "https://en.wikipedia.org/w/index.php?title=Malware&oldid=820971587"
Categories:
Malware
Computer security exploits
Hidden categories:
Use dmy dates from August 2017
Articles needing additional references from July 2013
All articles needing additional references
All articles with unsourced statements
Articles with unsourced statements from July 2013
Articles with unsourced statements from March 2013
Articles with DMOZ links
Wikipedia articles with GND identifiers
Navigation menu
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
Namespaces
Article
Talk
Variants
Views
Read
Edit
View history
More
Search
Navigation
Main page
Contents
Featured content
Current events
Random article
Donate to Wikipedia
Wikipedia store
Interaction
Help
About Wikipedia
Community portal
Recent changes
Contact page
Tools
What links here
Related changes
Upload file
Special pages
Permanent link
Page information
Wikidata item
Cite this page
Print/export
Create a book
Download as PDF
Printable version
In other projects
Wikimedia Commons
Languages
العربية
Azərbaycanca
বাংলা
Bân-lâm-gú
Беларуская
Български
Bosanski
Català
Čeština
Dansk
Deutsch
Eesti
Ελληνικά
Español
Euskara
فارسی
Français
Gaeilge
한국어
Հայերեն
हिन्दी
Hrvatski
Bahasa Indonesia
Italiano
עברית
Basa Jawa
ಕನ್ನಡ
ქართული
Latina
Latviešu
Lumbaart
Magyar
Македонски
മലയാളം
मराठी
Bahasa Melayu
Монгол
မြန်မာဘာသာ
Nederlands
日本語
Norsk
Norsk nynorsk
ਪੰਜਾਬੀ
Polski
Português
Română
Русский
Scots
Shqip
Simple English
Slovenčina
Slovenščina
کوردی
Српски / srpski
Srpskohrvatski / српскохрватски
Suomi
Svenska
Tagalog
தமிழ்
ไทย
Türkçe
ᨅᨔ ᨕᨘᨁᨗ
Українська
Tiếng Việt
粵語
中文
Edit links
This page was last edited on 17 January 2018, at 17:55.
Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Developers
Cookie statement
Mobile view
Enable previews

value: mw-page-base noprint

value: mw-head-base noprint

value: firstHeading firstHeading en

value: siteSub noprint

value: jump-to-nav mw-jump

tag: li

value:
/wiki/Computer_crime
mw-redirect
Computer crime

value:
/wiki/Screen_scrape
mw-redirect
Screen scrape

value:
/wiki/Denial_of_service
mw-redirect
Denial of service

value:
/wiki/Security_by_design
mw-redirect
Security by design

value:
/wiki/Intrusion_prevention_system
mw-redirect
Intrusion prevention system

value: float:right;clear:right;width:22.0em;margin:0 0 1.0em 1.0em;background:#f9f9f9;border:1px solid #aaa;padding:0.2em;border-spacing:0.4em 0;text-align:center;line-height:1.4em;font-size:88%

value: Help:Introduction to referencing with Wiki Markup/1

value: plainlinks metadata ambox ambox-content ambox-Refimprove

value:
/wiki/Ransomware_(malware)
mw-redirect
Ransomware (malware)

value:
/wiki/Executable_code
mw-redirect
Executable code

value:
/wiki/Script_(computing)
mw-redirect
Script (computing)

value:
/wiki/Sony_rootkit
mw-redirect
Sony rootkit

value: This pie chart shows that in 2011, 70% of malware infections were by Trojan horses, 17% were from viruses, 8% from worms, with the remaining percentages divided among adware, backdoor, spyware, and other exploits.

value:
/wiki/Black-hat_hacking
mw-redirect
Black-hat hacking

value:
/wiki/Zombie_computer
mw-redirect
Zombie computer

value:
/wiki/Distributed_denial-of-service
mw-redirect
Distributed denial-of-service

value:
/wiki/Polymorphic_packer
mw-redirect
Polymorphic packer

value:
/wiki/Trojan_horse
mw-redirect
Trojan horse

value:
/wiki/CP-V_operating_system
mw-redirect
CP-V operating system

value: Edit section: Security defects in software

value:
/wiki/Software_vulnerability
mw-redirect
Software vulnerability

value:
/wiki/Buffer_overrun
mw-redirect
Buffer overrun

value: Edit section: Insecure design or user error

value: This claim needs references to reliable sources. (July 2013)

value:
noprint Inline-Template Template-Fact
white-space:nowrap;

value: Edit section: Over-privileged users and over-privileged code

value:
/wiki/Administrative_privileges
mw-redirect
Administrative privileges

value:
/wiki/E-mail_attachment
mw-redirect
E-mail attachment

value: Edit section: Use of the same operating system

value: Edit section: Anti-virus and anti-malware software

value:
/wiki/Operating_system_kernel
mw-redirect
Operating system kernel

value: This claim needs references to reliable sources. (March 2013)

value:
/wiki/Task_Manager
mw-redirect
Task Manager

value:
/wiki/Command_Prompt_(Windows)
mw-redirect
Command Prompt (Windows)

value: Edit section: "Air gap" isolation or "Parallel Network"

value: Edit section: History of viruses and worms

value:
/wiki/Apple_Macintosh
mw-redirect
Apple Macintosh

value:
/wiki/Microsoft_Office_Word
mw-redirect
Microsoft Office Word

value:
/wiki/Macro_virus_(computing)
mw-redirect
Macro virus (computing)

value: -moz-column-width: 20em; -webkit-column-width: 20em; column-width: 20em;

value: United States Computer Emergency Readiness Team

value:
nofollow
external text
http://oit.ncsu.edu/resnet/p2p

value:
nofollow
external text
https://kb.iu.edu/d/aehm

value:
nofollow
external text
http://www.spywareloop.com/news/malware

value:
nofollow
https://www.adobe.com/support/security/
external text

value:
nofollow
http://www.unmaskparasites.com/
external text

value:
nofollow
http://aw-snap.info/file-viewer/
external text

value:
nofollow
external text
//arxiv.org/abs/1406.1213

value:
nofollow
external text
//doi.org/10.12720%2Fjcm.8.11.758-767

value:
nofollow
https://www.malwarebytes.org/pup/
external text

value: -moz-column-width: 30em; -webkit-column-width: 30em; column-width: 30em; list-style-type: decimal;

value:
nofollow
external text
http://www.idmarch.org/document/Malware

value: nowraplinks collapsible autocollapse navbox-inner

value:
/wiki/Public_domain_software
mw-redirect
Public domain software

value:
/wiki/Unwanted_software_bundling
mw-redirect
Unwanted software bundling

value:
/wiki/Hardware_restrictions
mw-redirect
Hardware restrictions

value: Desktop computer clipart - Yellow theme.svg

value:
noprint metadata navbox
navigation
Portals
font-weight:bold;padding:0.4em 2em

value:
nofollow
external text
https://d-nb.info/gnd/4687059-3

value: Category:Articles needing additional references from July 2013

value: Category:All articles needing additional references

value: Category:All articles with unsourced statements

value: Category:Articles with unsourced statements from July 2013

value: Category:Articles with unsourced statements from March 2013

value: Category:Wikipedia articles with GND identifiers

value: Discussion about edits from this IP address [ctrl-alt-n]

value: A list of edits made from this IP address [ctrl-alt-y]

value: You are encouraged to create an account and log in; however, it is not mandatory

value: You're encouraged to log in; however, it's not mandatory. [ctrl-alt-o]

value:
/wiki/Malware
View the content page [ctrl-alt-c]
c

value: Discussion about the content page [ctrl-alt-t]

value: p-namespaces navigation vectorTabs p-namespaces-label

value:
p-variants
navigation
vectorMenu emptyPortlet
p-variants-label

value:
/w/index.php?title=Malware&action=edit
Edit this page [ctrl-alt-e]
e

value: Past revisions of this page [ctrl-alt-h]

value: p-views navigation vectorTabs p-views-label

value:
p-cactions
navigation
vectorMenu emptyPortlet
p-cactions-label

value:
mw-wiki-logo
/wiki/Main_Page
Visit the main page

value:
/wiki/Main_Page
Visit the main page [ctrl-alt-z]
z

value: Featured content – the best of Wikipedia

value: Find background information on current events

value:
/wiki/Special:Random
Load a random article [ctrl-alt-x]
x

value: portal navigation p-navigation p-navigation-label

value: برمجيات خبيثة – Arabic

value: ম্যালওয়্যার – Bangla

value: Шкодная праграма – Belarusian

value:
https://bs.wikipedia.org/wiki/Malware
Malware – Bosnian
bs
bs
interlanguage-link-target

value:
https://cs.wikipedia.org/wiki/Malware
Malware – Czech
cs
cs
interlanguage-link-target

value:
https://da.wikipedia.org/wiki/Malware
Malware – Danish
da
da
interlanguage-link-target

value:
https://et.wikipedia.org/wiki/Kurivara
Kurivara – Estonian
et
et
interlanguage-link-target

value: Κακόβουλο λογισμικό – Greek

value:
https://es.wikipedia.org/wiki/Malware
Malware – Spanish
es
es
interlanguage-link-target

value:
https://eu.wikipedia.org/wiki/Malware
Malware – Basque
eu
eu
interlanguage-link-target

value: بدافزار – Persian

value: 악성 소프트웨어 – Korean

value: Վնասակար ծրագիր – Armenian

value: मैलवेयर – Hindi

value:
https://it.wikipedia.org/wiki/Malware
Malware – Italian
it
it
interlanguage-link-target

value: נוזקה – Hebrew

value: ಮಾಲ್‌ವೇರ್ – Kannada

value: მავნე პროგრამა – Georgian

value:
https://la.wikipedia.org/wiki/Malware
Malware – Latin
la
la
interlanguage-link-target

value:
https://lmo.wikipedia.org/wiki/Malware
Malware – Lombard
lmo
lmo
interlanguage-link-target

value:
https://hu.wikipedia.org/wiki/Malware
Malware – Hungarian
hu
hu
interlanguage-link-target

value: Злонамерен програм – Macedonian

value: मालवेअर – Marathi

value:
https://mn.wikipedia.org/wiki/Malware
Malware – Mongolian
mn
mn
interlanguage-link-target

value: မောလ်ဝဲလ် – Burmese

value:
https://nl.wikipedia.org/wiki/Malware
Malware – Dutch
nl
nl
interlanguage-link-target

value:
https://no.wikipedia.org/wiki/Malware
Malware – Norwegian
no
no
interlanguage-link-target

value:
https://nn.wikipedia.org/wiki/Malware
Malware – Norwegian Nynorsk
nn
nn
interlanguage-link-target

value: ਮਾਲਵੇਅਰ – Punjabi

value:
https://pt.wikipedia.org/wiki/Malware
Malware – Portuguese
pt
pt
interlanguage-link-target

value: Вредоносная программа – Russian

value:
https://sco.wikipedia.org/wiki/Malware
Malware – Scots
sco
sco
interlanguage-link-target

value:
https://sq.wikipedia.org/wiki/Malware
Malware – Albanian
sq
sq
interlanguage-link-target

value:
https://sk.wikipedia.org/wiki/Malware
Malware – Slovak
sk
sk
interlanguage-link-target

value: Zlonamerna programska oprema – Slovenian

value: Малвер – Serbian

value:
https://sh.wikipedia.org/wiki/Malware
Malware – Serbo-Croatian
sh
sh
interlanguage-link-target

value: interlanguage-link interwiki-sh badge-Q17437796 badge-featuredarticle

value:
https://tl.wikipedia.org/wiki/Malware
Malware – Tagalog
tl
tl
interlanguage-link-target

value: தீப்பொருள் – Tamil

value: มัลแวร์ – Thai

value:
https://tr.wikipedia.org/wiki/Malware
Malware – Turkish
tr
tr
interlanguage-link-target

value:
https://bug.wikipedia.org/wiki/Malware
Malware – Buginese
bug
bug
interlanguage-link-target

value: Шкідливий програмний засіб – Ukrainian

value: /static/images/wikimedia-button-1.5x.png 1.5x, /static/images/wikimedia-button-2x.png 2x

value: /static/images/poweredby_mediawiki_132x47.png 1.5x, /static/images/poweredby_mediawiki_176x62.png 2x

value:
suggestions
display: none; font-size: 13px;

value: mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-Malware rootpage-Malware skin-vector action-view