syssec_red_book

12 MalwareMost users and administrators of computer systems configure theirdevices by installing software of their choice according to theirneeds. Often, however, not all software running on a device is vettedby its owner. Malware, short for malicious software, is an umbrella termreferring to software that gets installed and operates against a user’s will,usually for the benefit of a third party. Categorized depending on propertiessuch as the malware’s infection and propagation strategy, stealthiness, andpurpose, common types of malware include viruses, worms, spyware, rootkits,keyloggers, backdoors, trojans, ransomware, and others [368].Viruses usually infect executable files or documents, and require some formof human intervention in order to spread, such as plugging in an infected USBflash drive (or, in older times, inserting a diskette), being tricked into clickingon a malicious URL or attachment, or intentionally installing a maliciousprogram disguised as (or contained in) a legitimate-looking application. Incontrast, worms are autonomous, self-replicating programs that spread acrossthe network by exploiting defects in widely-used software running on victimhosts. Other types of malware can be installed as a result of direct unauthorizedaccess to a computing device, manual intrusions (often involving some formof social engineering), or automated exploitation by malicious websites ordocuments.Historically, early viruses and worms were usually the outcome of experimentationand curiosity. Most of them were harmless, although they oftenunintentionally resulted in significant service disruption [165]. Fast forwarda couple of decades, when organized cybercriminals develop sophisticatedmalware with the aim of illegal financial gain, while governments employmalware for gathering intelligence or even tactical operations (as was the casewith the Stuxnet worm, discussed in Section 6.3).12.1 What Is the Problem?The rise in the number of malware variants continues at a steady pace. Indicatively,McAfee reports a growth in the number of new malware samples ofabout 8–12 million per quarter for 2012, while as of April 2013 they have more