MALICIOUS SOFTWARE: VIRUSES, WORMS, TROJAN HORSES, AND SPYWARE

Malicious software programs are referred to as malware and include a variety of threats, such as computer viruses, worms, and Trojan horses. A computer virus is a rogue software program that attaches itself to other software programs or data files in order to be executed, usually without user knowledge or permission. Most computer viruses deliver a “payload.” The payload may be relatively benign, such as the instructions to display a message or image, or it may be highly destructive—destroying programs or data, clogging computer memory, reformatting a computer’s hard drive, or causing programs to run improperly. Viruses typically spread from computer to computer when humans take an action, such as sending an e-mail attachment or copying an infected file.

Most recent attacks have come from worms, which are independent computer programs that copy themselves from one computer to other computers over a network. (Unlike viruses, they can operate on their own without attaching to other computer program files and rely less on human behavior in order to spread from computer to computer. This explains why computer worms spread much more rapidly than computer viruses.) Worms destroy data and programs as well as disrupt or even halt the operation of computer networks.

Worms and viruses are often spread over the Internet from files of downloaded software, from files attached to e-mail transmissions, or from compromised e-mail messages or instant messaging. Viruses have also invaded computerized information systems from “infected” disks or infected machines. E-mail worms are currently the most problematic. Malware targeting mobile devices is not as extensive as that targeting computers, but is spreading nonetheless using e-mail, text messages, Bluetooth, and file downloads from the Web via Wi-Fi or cellular networks.There are now more than 200 viruses and worms targeting mobile phones, such as Cabir, Commwarrior, Frontal.A, and Ikee.B. Frontal.A installs a corrupted file that causes phone failure and prevents the user from rebooting, while Ikee.B turns jailbroken iPhones into botnet-controlled devices. Mobile device viruses pose serious threats to enterprise computing because so many wireless devices are now linked to corporate information systems.

Web 2.0 applications, such as blogs, wikis, and social networking sites such as Facebook and MySpace, have emerged as new conduits for malware or spyware. These applications allow users to post software code as part of the permissible content, and such code can be launched automatically as soon as a Web page is viewed. The chapter-opening case study describes other channels for malware targeting Facebook. In September 2010, hackers exploited a Twitter security flaw to send users to Japanese pornographic sites and automatically generated messages from other accounts (Coopes, 2010). Worms and viruses that have appeared to date. Over the past decade, worms and viruses have caused billions of dollars of damage to corporate networks, e-mail systems, and data. Because of malware and online scams, and the majority of these losses came from malware (Consumer Reports, 2010).

A Trojan horse is a software program that appears to be benign but then does something other than expected, such as the Zeus Trojan described in the chapter-opening case. The Trojan horse is not itself a virus because it does not replicate, but it is often a way for viruses or other malicious code to be introduced into a computer system. The term Trojan horse is based on the huge wooden horse used by the Greeks to trick the Trojans into opening the gates to their fortified city during the Trojan War. Once inside the city walls, Greek soldiers hidden in the horse revealed themselves and captured the city. 

At the moment, SQL injection attacks are the largest malware threat. SQL injection attacks take advantage of vulnerabilities in poorly coded Web application software to introduce malicious program code into a company’s systems and networks. These vulnerabilities occur when a Web application fails to properly validate or filter data entered by a user on a Web page, which might occur when ordering something online. An attacker uses this input validation error to send a rogue SQL query to the underlying database to access the database, plant malicious code, or access other systems on the network. Large Web applications have hundreds of places for inputting user data, each of which creates an opportunity for an SQL injection attack. A large number of Web-facing applications are believed to have SQL injection vulnerabilities, and tools are available for hackers to check Web applications for these vulnerabilities. Such tools are able to locate a data entry field on a Web page form, enter data into it, and check the response to see if shows vulnerability to a SQL injection.

Some types of spyware also act as malicious software. These small programs install themselves surreptitiously on computers to monitor user Web surfing activity and serve up advertising. Thousands of forms of spyware have been documented. Many users find such spyware annoying and some critics worry about its infringement on computer users’ privacy. Some forms of spyware are especially nefarious. Keyloggers record every keystroke made on a computer to steal serial numbers for software, to launch Internet attacks, to gain access to e-mail accounts, to obtain passwords to protected computer systems, or to pick up personal information such as credit card numbers. Other spyware programs reset Web browser home pages, redirect search requests, or slow performance by taking up too much memory. 

Credit: Management Information Systems (By Kenneth C. Loudon and Jane P. Laudon)