Cybersecurity - General Culture

Signature Detection

It is also called scan. This is the oldest and most used method.
This method consists in analyzing the hard disk, looking for the signature of the virus, which is present in the database of the software, if it is up to date and knows this virus.

The signature is a piece of code or a string of the virus that identifies it. Each virus has its own signature, which must be known to the antivirus.
This method is not effective against new viruses or so-called polymorphic viruses, whose signature changes with each replication.

The advantage of the scan technique is that it can
detect viruses before they run in memory

The integrity check

Checking the integrity of a file consists of checking that it has not been modified or altered over time.

The antivirus, to check the integrity of the files, will store a central file listing all the files on the disk with which it has associated information that may change when the file is changed:

• Size
• Date and time of last modification
• The checksum (CRC: cyclic redundancy code)

Heuristic analysis

Antivirus usually includes a heuristic analysis function. This heuristic treatment consists of an analysis of suspicious codes via the search for instructions usually used by the viruses.

 The goal is to detect viruses that are not yet known antivirus vendors.

The heuristic scanner looks for unusual calls or instructions to the system, network applications, or email clients. When the number of these normally exceptional behaviors exceeds a certain threshold, the scanner emits an alarm.

How does the antivirus react ?

The antivirus continually monitors the behavior of active software (if it is running and automatic protection is enabled). It scans all modified and created files. In case of anomaly, it warns the user by an explicit message

When the antivirus detects a virus, it offers three possibilities to the user:

• Repair file: The antivirus must be able to repair an affected file. But that's not always possible.
• Delete file: If the antivirus is not able to delete the file, you can delete it.
• Quarantining the infected file: This is a wait solution. The antivirus places the file in a safe folder on the hard drive. When the antivirus will be able to repair the file, you will be able to extract the file from the file and fix it.

Stuxnet

Stuxnet is considered as the most ingenious cyber attack and the one that has revolutionized the world of computer security.

Stuxnet is discovered in June 2010, but studies will show later that his career probably began a few years earlier, in 2005 or 2006, about the same time Tehran got the wrath of some of the international community by announcing the resumption of its work around uranium enrichment.

We still do not know who created it and why, however, a rumor wants it to be an invention of the US and Israeli secret services in order to sabotage the Iranian nuclear program. This hypothesis is quite likely: this malware has indeed made the centrifuges used to enrich uranium inoperable, which has delayed the Iranian nuclear program by several years.

In general, malwares relies on the exploitation of one or two security flaws that have already been documented and even corrected. Sometimes, the virus exploits a new vulnerability: it is called zero-day, whose large-scale exploitation is an event. Stuxnet exploits four 0-day vulnerabilities affecting Windows environments.

This is the first discovered worm that spies and reprograms industrial systems, which carries a high risk. It specifically targets SCADA systems used for the control of industrial processes. Stuxnet has the ability to reprogram Siemens Programmable Logic Controllers (PLCs) and hide its modifications.

The creators of Stuxnet managed to infect disconnected and protected devices, which caused a wave of panic. Then, according to several experts, they lost control of the worm that began to spread actively, but without causing visible damage to home or business computers, since it was originally created to attack precise industrial systems.

The worm has affected 45,000 computer systems, including 30,000 located in Iran, including PCs owned by employees of the Bouchehr nuclear power plant. The other 15,000 computer systems are computers and power plants in Germany, France, India and Indonesia, Siemens technology users.

To learn more about this attack, I advise you to watch the documentary entitled 0-day, which traces the whole history of this attack and its process.

WannaCry

Wannacry (also known as WannaCrypt), is a malware ransomware (see the beginning of this article for more information on this type of malware) self-replicating.

This cyber attack is considered the biggest ransom piracy in the history of the Internet. He encrypted the disks of a computer and asked for a ransom of $ 300 to $ 600 in bitcoin to decrypt the computer.

In May 2017, it was used in a massive global cyberattack affecting more than 300,000 computers in more than 150 countries, mainly in India, the United States, and Russia, using the outdated Windows XP system and more generally versions prior to Windows 10 (mainly Windows 7) that did not perform the security updates, in particular that of March 14, 2017.
Vulnerabilities obviously exploited by the NSA, since they served as a base for various tools of US agency spies unveiled by the Shadow Brokers, a group of pirates.

Among the most important organizations affected by this attack are Vodafone, FedEx, Renault, Telefónica, the National Health Service, the Liège University Hospital Center, the Russian Ministry of the Interior and Deutsche Bahn.

We do not know exactly who is behind Wannacry, but the person who managed to stop his spread is Marcus Hutchins. The solution he found to stop the spread of the WannaCry ransomware was simple and he had found it by chance.
The ransomware was activated only if a specific domain name was not purchased: when he bought the domain name on behalf of the company Kryptos Logic, the malware was automatically turned off.

Zeus

The Zeus Trojan is a type of malicious program (malware) that targets Microsoft Windows and is often used to steal financial data. Originally detected in 2007, the Zeus Trojan, often called Zbot, has become one of the most efficient botnets in the world, infecting millions of machines and spawning many similar malicious programs developed from its code.

It first creates a botnet, which is a network of infected machines that are secretly controlled by a command and a control server that the owner of the malicious program manages. As we saw in the first part of this article, a botnet allows the owner to collect astronomical amounts of information or execute large-scale attacks.

Zeus also acts as a banking Trojan designed to steal banking login credentials on machines it infects by monitoring websites and recording keystrokes.

Some forms of this malicious program also affect mobile devices by attempting to bypass the two-factor authentication that is becoming widespread in the financial services sector.

It uses two main methods of infection:

• Junk mail (spam)
• Inadvertent download

Mirai

Mirai is malware that transforms computers using the Linux operating system into remote-controlled bots, forming a botnet (see beginning of the article) used in particular to carry out large-scale attacks on networks. It mainly targets consumer devices such as remote controllable cameras or routers for the home... (IOTs)

Mirai then identifies vulnerable IoT objects using a table of default IDs and passwords and then simply logs on to install the malware.

There are hundreds of thousands of devices connected to the Internetthat use default settings, which makes them vulnerable to this type of attack. Once infected, the device monitors a Command and Control (C & C) server that is used to indicate the target of an attack.

On October 21, 2016, several major DDoS attacks on Dyn DNS services were carried out using Mirai botnets, causing difficulties to access sites such as GitHub, Twitter, Reddit, Netflix, Airbnb and many others...

The source code for Mirai malware was released in late October 2016 on hacker forums and then on Github. Since this source code has been released, the same techniques have been adapted in other malware projects.

The author of Mirai will hide behind the pseudonym Anna-Senpai. I invite you to discover Bryan Krebs' article on this subject:
https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/

Petya/NotPetya

If you thought it sounded like the WannaCry ransomware attack, you were right.

Petya is a ransomware for Windows systems: it makes unavailable data from a computer, which can only be unlocked by paying a ransom.

Just like Wannacry, the unknown attacker used a feat developed by the National Security Agency (NSA), EternalBlue, which leaked a few months earlier. The attacker installed the backdoor on thousands of computers, which was then used to deliver a ransomware payload.

Once installed on a computer, Petya will seek full authority and identify other devices on the same network.
The ransomware will then search the computer it has infected to recover identifiers and passwords that it will then be able to reuse in the network to take control of more devices and multiply its spread.
Then, using conventional Windows features used to manage networks, it will transfer to other machines.

Petya has clearly burdened the turnover of the flagship of the French industry Saint-Gobain, the French company hardest hit by this destructive software. The latter estimates that her infection cost her in the first half 220 million euros in sales and 65 million euros in operating income (4.4%).

I love you

This worm also bore the names Loveletter and The Love Bug. He was hiding a malicious VBS scriptfake love letter. This script allowed the spread of this worm through a massive spread through Outlook. It added keys in the registry allowing it to start every time Windows starts. It was inserted in the files * .JPG, * .JPEG, * .VBS, * .VBE, * .JS, * .JSE, * .CSS, * .WSH, * .SCT, * .DOC * .HTA and renamed them by adding .VBS

ILOVEYOU first infected the Philippines, then almost all of Asia, Europe, Africa and the Americas. It spread over four days on more than 3.1 million machines worldwide

I love you infected 10% of computers connected to the Internet : approximately $ 5 billion in estimated damages.

Its authors were Filipinos, Irene and Onel de Guzman and Reomel Lamores.