syssec_red_book

12.4. What Is the Worst That Can Happen?another recent technique that malware authors employ to render signaturebasedantivirus protection ineffective. By dynamically generating a differentinstance of the malware binary at the server, each victim is infected by a uniqueversion of the malware that is unlikely to be encountered in the future. Byhiding the logic of the polymorphic engine at the server, malware analystshave also a harder time identifying common patterns that could be used for detection.Other techniques used for hindering analysis and detection includinganti-debugging tricks, VM detection, dormant functionality triggered by timeor other events, memory-resident code, and advanced code obfuscation andmetamorphism, are also expected to be used increasingly in future malwarestrands.12.4 What Is the Worst That Can Happen?Depending on the author’s intent, malware can potentially have devastatingconsequences. Typically, upon infection, malware attempts to steal everybit of private information from the victim’s device, including credit cardnumbers, personal files, and access credentials to web-banking, web-mail, orsocial networking websites. Infected computers also usually become “bots”in the attacker’s network of compromised hosts. The threat of such botnetsis extensively discussed in Chapter 11. Such networks of infected computersare essentially the infrastructure that allows cybercriminals to conduct a widerange of illegal activities, such as sending spam e-mails, launching denial ofservice attacks, hosting web sites for phishing, seeding malware, or publishingillegal material, and naturally, for probing and compromising other hosts.A worrisome prospect is the rise of ransomware [75], which encryptsimportant user documents or even locks the user’s computer completely. Torestore their files, users are asked to pay a ransom, in return for the decryptionkey. Depending on the malware’s sophistication and the type of encryptionused, cracking the encryption through other means can be infeasible. If themotive is not financial, catastrophic malware can irreversibly erase data (evenbackup files, if those are reachable through the same internal network), anddestroy crucial system components, such as the BIOS or other device firmware,causing severe damage.12.5 State of the ArtIn parallel with the development of cybercrime into a large undergroundeconomy driven by financial gain, malicious software has changed deeply.Originally, malicious software was mostly simple self-propagating code craftedprimarily in low-level languages and with limited code reuse. Today, malicioussoftware has turned into an industry that provides the tools that cybercriminalsuse to run their business [335]. Like legitimate software, malware is89