Sybex CEH Certified Ethical Hacker Version 8 Study Guide

Malware 181
In past decades, what we now call malware was not so vicious in nature; it was more
benign. Software in this class was able to infect, disrupt, disable, and in some cases corrupt
software, including the operating system. However, it generally just annoyed and irritated
system owners; nastier forms were rare.
In recent years, though, this software category has come to include applications that
are much more malignant. Current malware is designed to stay stealthy in many cases and
employs a myriad of features designed to thwart detection by the increasingly complex
and accurate antimalware systems, such as antivirus software and antispyware. What
hasn’t changed is the fact that malware consumes resources and power on a host system or
network, all the while keeping the owner in the dark as to its existence and activities.
Making the situation worse in today’s world is that current malware types have been
influenced by the criminal element. The creation of botnets () and theft of information are
becoming all too common.
Malware is a contraction of malicious software. Keep this in mind. The
term accurately describes the purpose of this type of software.
If we define malware to include any software that performs actions
without the user’s knowledge or consent, this could include a large amount
of software on the average system. It is also important to recognize that
most malware is hostile in nature. Criminals use malware in a variety
of ways to capture information about the victim or commit other acts.
As technology has evolved, so has malware, from the annoying to the
downright malicious.
Another aspect of malware that has emerged is its use to steal information. Malware
programs have been known to install what is known as a keylogger on a system. The
intention is to capture keystrokes as they’re entered, with the intention of gathering
information such as credit card numbers, bank account numbers, and similar information.
For example, malware has been used to steal information from those engaging in online
gaming, to obtain players’ game account information.
In the Crosshairs
One of the highest-profile incidents concerning the dangers of malware involves the U.S.-
based retailer Target. In late November through early December, 2013, Target became
the victim of a data breach that compromised at least 110 million customer accounts:
an estimated 40 million included credit, debit, and PIN information, and the remaining
70 million involved name, address, e-mail, and phone information. This attack, the fallout
of which is still being assessed, represents the second largest data breach in history.