What is Malicious Code?
Malicious code refers to any executable instruction that performs actions for which the user did not authorise it. It can be embedded in a file or delivered as a bespoke script, macro, or application that executes without the user’s knowledge. Intent is what distinguishes malware from buggy software: malicious code is written specifically to serve the attacker's interests at the victim's expense.
It’s worth noting that although malware is often used interchangeably with malicious code, they are, strictly speaking, not one and the same. Malware is defined as a complete piece of software, whereas malicious code refers to small, harmful chunks of software injected or embedded into an otherwise legitimate application.
How Malware Spreads
Malware can spread through various methods, each more insidious than the last.
Phishing attacks trick individuals into disclosing personal information via emails or messages with harmful links or attachments. These attacks often mimic legitimate communications, making them difficult to spot.
Drive-by downloads install malware on a device merely by visiting a compromised website, requiring no user interaction. This method exploits vulnerabilities in web browsers or plugins, making it a silent but effective threat.
Malvertising embeds malicious code in advertisements. Interacting with these ads on legitimate websites can result in infection. This technique leverages the trust users have in well-known websites, making it a particularly deceptive method of spreading malware.
Spoofed websites mimic legitimate sites, tricking users into downloading malware or providing personal information. These sites often resemble their legitimate counterparts, easily deceiving users.
Hackers use exploit kits to identify and exploit system vulnerabilities, delivering malware to devices. Available on the dark web, these kits make advanced malware attacks accessible to many cybercriminals.
Worms exploit network vulnerabilities to propagate independently across systems. Unlike viruses, worms spread without user interaction, quickly infecting numerous devices.
Types of Malware
A virus is a type of malware that attaches itself to a legitimate executable and replicates whenever the executable runs. Its name comes from the fact that, much like a biological virus, the software virus spreads by infecting other files on the same system or network. In most cases, viruses require input from the unwitting user for them to activate.
Trojan horses, or simply Trojans, are a type of malware that disguises itself as legitimate software to trick users into installing them. Once inside, they can perform a range of malicious functions, such as stealing data or providing remote access to the attacker. The term “trojan horse” aptly describes this deceptive tactic.
Ransomware is another prevalent type of malware that encrypts the victim’s data and demands a ransom for the decryption key. This type of malware has gained notoriety for targeting critical infrastructure and organizations, causing widespread disruption and financial loss.
Spyware, as the name suggests, is designed to spy on the user by collecting sensitive data, such as passwords and credit card information, without their knowledge. Rootkits, on the other hand, are designed to gain unauthorized access to a computer system while concealing their presence, making them difficult to detect and remove.
The rootkit is designed to conceal itself and potentially other malicious processes. In doing so, it can persist undetected for prolonged periods of time and cause immense damage in the background. Rootkits give malicious actors ongoing access to the affected system and prevent the operating system from defending the legitimate user.
Signs of Malware Infection
Common signs include slow performance, unexpected pop-ups, and unusual network activity. These symptoms often indicate that your system is under duress from malicious software.
A decrease in available storage space can indicate malware, as it often consumes significant resources. Random file disappearances may suggest the malware is deleting data. Programs opening and closing on their own can signal malware manipulation.
Changes to your browser’s homepage or frequent redirects can indicate malware. Frequent, intrusive pop-up ads often indicate adware, a type of malware designed to bombard users with advertisements. Unsolicited error messages or fake virus alerts can also be another sign.
However, a device may function normally while underlying malware remains active and undetected.
Code Signing and Malware Defence
Code signing cannot prevent malware from being created, but it does make tampering detectable. When a developer signs software with a certificate issued by a trusted Certificate Authority, the signature becomes a tamper-evident seal. Any modifications to the file made after signing will invalidate the signature and alert users to the change.
Similarly, code signing provides attribution to a particular developer and/or publisher. Accountability is part of why the Browser Forum now requires private keys to be stored on dedicated hardware.
To Summarize
Malicious code is software designed specifically to act against the interests of the system it runs on. It takes many shapes and forms and can be used for a variety of purposes. These include, but are not limited to, sensitive information extraction, file lockdowns, and further infection vectors. Code signing provides users with a mechanism to verify that their software is from a known publisher and has not been altered since it was signed.