Malware and its types

Why sort by behaviour rather than by name

The names everybody has heard, virus and worm and trojan, are all talking about one thing: how the program got in and how it spreads. A virus attaches itself to another file and travels with it. A worm moves from one machine to the next without human help. A trojan does not spread at all; it poses as something useful and you invite it in.

Those names do not tell you what you will see once you are infected or what you should do. Behaviour tells you that: encrypting your files, reading what you type, holding a door open, burning your processor to mine currency, or simply showing adverts.

And one fact separates this classification from a classroom exercise: a modern sample is usually several of these at once. Something that arrives like a trojan holds the door open for the next thing, collects passwords, and if it is worth the trouble encrypts the files at the end. So which type is this is almost never the useful question.

The useful question is: what is being lost, and what prevents it? If the answer is my files, the defence is backups. If the answer is my passwords, the defence is two-factor and changing passwords from a different device. If the answer is control of my site, the defence lives somewhere else and comes in the fifth section. This lesson is laid out on exactly that basis.

Seven behaviours, each with the symptom that gives it away

Seven behaviours that almost everything fits into. For each, one sentence on what it does and one symptom an ordinary user can actually see.

Virus. Attaches itself to other files. Its symptom has faded these days and shows up mostly as programs whose behaviour changed or that throw odd errors.

Worm. Moves from machine to machine without human involvement, usually inside a network. A network administrator sees its symptom more often than a user does: internal traffic with no reason for existing.

Trojan. Poses as a useful program. Its symptom is the moment of installation: something that, for a simple job, asks for permissions unrelated to that job.

Ransomware. Encrypts the files and wants money for the key. Its symptom cannot be missed: files that will not open and have a changed extension, plus a note giving payment instructions.

Spyware. Watches and sends: what you type, what your browser saved, sometimes the screen. It is the least visible category and that is what makes it dangerous; its only indirect trace is unfamiliar logins on your accounts.

Adware. Shows adverts and changes browser behaviour. Its symptom is obvious: a start page and a search engine you did not choose, and extensions you do not remember installing.

Miner. Uses your processor to mine currency. Its symptom is physical: a fan running for no reason, a hot device and a battery draining fast while nothing heavy is open.

There is an eighth category with no common name, and for anybody who runs a site it matters more than all of these: a backdoor, a file that exists for no purpose except letting somebody in again. The fifth section is about exactly that.

Ransomware: why the real answer is a backup

Ransomware differs from the rest because it steals nothing; it takes away your access. The files are still there and they do not open. And for exactly that reason it is the only category with one clearly defined defence, and that defence is not technical but operational: having another copy of those same files.

Let us settle the question of paying first, because everybody asks it first. Paying guarantees nothing; what you are buying is a promise from somebody who has already lied to you. Even when a key does arrive, the restore is rarely complete. And in many countries paying such groups carries legal consequences of its own; we put that generally because laws differ and we are not legal advisers. Our practical line: paying is the last option, and with a proper backup you never enter that discussion at all.

Now the real question: which kind of backup survives ransomware? Because much of what people call a backup gets encrypted right alongside the original.

Three properties are needed. First, the copy has to sit somewhere the malware cannot write to. A drive permanently plugged into the computer, a network share that is always mounted, or a synced folder are all reachable by the very program encrypting your files. Second, old versions have to be kept. Syncing alone is not a backup: when the encrypted file replaces the healthy one, the sync service faithfully carries that encrypted version everywhere. What saves you is version history. Third, it has to have been restored at least once for real. A backup that was never tested is an assumption, not a backup.

How to build such a thing in practice, with the tools and the details, has its own lesson in the computer basics track, and we will not repeat it here. We will borrow one sentence from it because it bears directly on this lesson: a backup that has not proved itself is only a claim.

Where malware actually comes from

The common picture is that infection comes from a dodgy site somebody opened by mistake. In practice there is almost always a human step in the middle, and the user took that step because it seemed reasonable at the time.

Four routes cover nearly all of it. First, the email attachment: a file claiming to be an invoice, a CV or a legal notice. Its tell is usually what the file asks for once opened, such as enabling editing or allowing content to run. If an invoice needs permission to run something in order to display, it is not an invoice.

Second, cracked software and repackaged installers. Somebody has been inside the file to get around the licence, and you do not know whether they only touched the licence or added something else. This route is heavier in Iran because of payment restrictions, and the computer basics track has a lesson that opens it up fully.

Third, the fake update. A page saying your browser or your media player is out of date and you should install the file it offers. One rule closes this route completely: a real update never comes from a web page. Browsers and operating systems update themselves, from inside themselves.

Fourth, the browser extension. It gets said too rarely and its reach is large: an extension is allowed to read and change the content of every page you open. An extension that has been passed around or has changed owners is one of the cleanest ways to watch somebody.

And a fifth route that concerns site owners only: a file a stranger uploads to your site. The next section is about that.

What malware looks like on a website

On a website, malware usually takes the shape of one small file that does one job: it lets anybody who knows its address run commands. The general name is a backdoor, and its value to an attacker is that it keeps working even after every password has been changed. That is why deleting one unfamiliar file and moving on usually does not work.

Now the point that pulls this whole section together: such a file has to sit somewhere the server is willing to execute it. And on a website those places are few. The only folders a visitor can cause a file to be written into are the ones built for uploads and for cache. Which turns the problem from how do we recognise a bad file into a much simpler question: is the folder that strangers write into allowed to execute code?

The right answer is no, and that is a few lines of web server configuration, not a security product. The place where uploaded files land should be able to hand a file over and nothing more. Other work is needed too, such as checking the real content of a file at upload time instead of trusting its extension, but this is the line of defence that stays standing even when the others fail.

And if one day you find an unfamiliar file on a site you run, the order is this: first assume it is not the only one, then restore the site from a backup dated before the event, then change every password and key from a different device, and last of all go looking for how it got in. Skip that last step and the same thing happens again. The service side of this work is on the website security page, and the signs that a site has been compromised are listed in the warning signs of a hacked site.

You think you are infected; what to do, in order

The first thing most people do is the most wrong: they log into email and banking from that same device to check everything is fine. If something really is on the machine, you have just handed it a fresh round of information.

The right order is this. Disconnect the device from the internet so whatever is there can neither send anything out nor pull anything new in. Then from a different device you are confident is healthy, change the password of the main email account and then the other important ones, and in the same settings close the active sessions. Up to this point you have not touched the device itself, and that is correct: rescuing the accounts is more urgent than cleaning the machine.

Then it is the device turn, and here we have an honest answer that is not pleasant. Scanning with a good tool and removing what it finds is enough for simple cases. But when something serious has been on a machine, no tool can promise everything is gone, because the thing that was hiding was good at hiding. For a device that work and money pass through, a fresh install of the operating system and restoring files from a backup is a more reliable answer than any scan.

And one job everybody forgets: after it is clean, change the passwords again. Passwords typed during the infected period, including new ones you created in the middle of it, are no longer trustworthy.