Assignment 1: Question 3: Virus Attacks

Internet is now a part and parcel of modern life. More people than ever uses internet for work and pleasure. Because of its immense popularity, it is very usual that cyber crime is increasing all the time. According to the Federal Bureau of Investigation (FBI), cyber crime has cost consumers and businesses $5.8 billion in 2009. (State of internet security 2009, n.d.)

The most common sort of attacks are trojan horses. According to FBI, during the year of 2009 71% of the attacks were trojans. (State of internet security 2009, n.d.). trojans are lightweight malicious software, which are used as gateways by intruders to attack or gain remote access/control over a system through global bots and botnets. Most of them, consists of 2 parts: server and client. When a victime (unknowingly) runs the a trojan server in his/her machine the attacker than uses the client part of the trojan to connetc to the server and starts using the trojan. The protocol that is typically used by trojan horses are TCP, but some of the trojans use other protocols such as UDP etc. trojans are mainly aimed at modifying system files or windows registry. Thus, an intruder can get partial or full access to the resources of the affected computer. (How do trojans work?, n.d.).

Another highly increasing notable threat are Rogue security softwares which gains user's attention and trick them to install them by displaying fake infection results prommising to remove the infected files upon installation. It claims to provide security while doing the oposite. Those who are being tricked with such softwares are bombered with annoying fake and enormous alert messages, exposing them to additional internet threats. I personally had experience with such a software named "Personal Security" and it was very hard to remove it. Amongst other Win32/Fake AV, Win32/Waledac, Win32/Kollah etc. are to name a few.

The next comes Win32/Conflicker family. conflicker is believed to be the largest worm infection since 2003. "Win32/Conflicker.B aggresively propogates from removable drives and shared folders within the affected network. It communicates with other infected machines through its own peer-to-peer protocol while participating in a global network." (State of internet security 2009, n.d.). In 2009, new conflickers has emerged with more destructive potentials such as Win32/Conflicker.B++ and Win32/Conflicker.C.

The file infectors are also a big concern in internet security. During the first half of the year 2009, Win32/Virut has been highly active and caused a lot of security damage. Virut attaches its malicious code in various ways. "When an infected file is executed, Virut's code runs before any host program code. The virus derypts then injects part of its codes into all running processes". (State of internet security 2009, n.d.).

Next to come, are the E-mail spams, which is the most common way of infection now-a-days. Spaammers use socail engineering techniques to trick users into clicking links which then either download virus or take them to malicious coded websites. Spammers continuously change schemes and strategies to go past spam filters and exploit realistic events and topics to acheive their goal of installing maliciopus program.

A surprise comeback of Ransomware was being experienced by the first half of 2009. Ransomeware encrypts user files and data making them unusable. cybercriminals then offers to decrypt the data for a fee. Examples of Ransomware includes, Win32/FileFixPro2009, which is a duo containing Win32/FileFixPro2009.A and Win32/RansomFix.A. Win32/RansomFix.A encrypts user files and data and informs the user about the infection. To repair the files Win32/RansomFix.A redirects the user to a website which hosts Win32/FileFixPro2009.A and asks the user to purchase it for $49.95 to fix the so called "corrupted files".

With the cyber crime at its peak than ever, it ios very important to be more security cautious and implement safe computing. To be safe, you must implement the right security software update regularly, understand your daily computer activity and use common sense.

References:

1. How do trojans work? (n.d.). retrieved December 25, 2009 from http://kbase.gfi.com/showarticle.asp?id=KBID001671

2. State of internet security 2009. (n.d.). retrieved December 25, 2009 from http://itc358.googlegroups.com/web/2009ThreatReportFinal.pdf?hl=en&gda=Rkpc2k8AAAAbuQXOjJwpORSVPvRy9SpeB3MGidS2VdTc51jzEKnBjpHJOOEQ3YCMKdY77q9kpntSFZZj4oONa9gflrHsMyKw8LHiMuWlzfoXX4r9YSbaeg

Assignment 1: Question 2: Keylogger

Keylogger is aprogram that captures everything that a user enters on a computer keyboard. The program runs invisibly in the background and cannot be detected by normal users even from the Windows Task manager, as it is not shown in the application tab. However, it is possible for advanced user or computer experts to detect it from the processes tab though it is hard to find out.

The purpose of this activity is to provide information regarding how these programs function in order that adequate defenses can be designed and implemented. The steps to follow are the followings:

Step:1|| Open your web browser and enter the URL www.softdd.com/keystrokerecorder/index.html.

Step:2|| Click download here.

Step:3|| When the file download dialog box appears, click save and follow the instructions to save this file in a location such as your desktop or a folder designated by your instructor. When the download has been finished click run and follow the default installation process. Note that, some anti-virus software may detect that this program is a malware. It might be needed to temporarily disable the antivirus software in order to download and run the application. It is highly recomended though that, you turn the antivirus software back on once this assignment is finished.

Step:4|| click run keyboard collector and then click ok. when asked for a password click ok. The keyboad collector settings are as below.

Step: 5|| Select the always run checkbox.

Step:6|| click Activate/Start and then click Yes to confirm.

Step: 7|| Spend several minutes performing normal activities like creating a text document.

Step: 8|| Now examine what keylogger has captured. double click the Keyboard Collector Trial on desktop.

Step: 9|| When asked to enter a password click ok.

Step: 10|| click Run Keyboard Collector and then click ok.

Step: 11|| click view your logs and then click ok. Notice that the text you've typed has been captured.

Step: 12|| click Return and then Exit.

Step: 13|| Now notice that keyboard collector is cloaking itself so that it does not appear to be running. Press the ctrl+alt+del keys and click Start task Manager.

step: 14|| Click the application tab to see all the programs that are running at the moment.

Note that, Keylogger is not shown in the list. This kind of malwares work behind the screen so normal user cannot detect them and doesn't come to know that they are affected. They hide themselves from the Task Manager's application tab, however, it is possible to detect them if you go through every single processes that are running from the processes tab.

How to install keylogger in a computer for which you dont have a user name or password?

The best way of doing it would be sending e-mails with the virus attached to it. once the email is opened and downloaded the program will be automatically installed in that computer.

References:

1. Security+ guide to Network Security Fundamentals, Third edition, by Mark Ciampa. page: 31-33.

2. http://www.viruslist.com/en/analysis?pubid=204791931