0

I order to understand malware, I've tried to create a toy-example myself.

However, I don't understand how the malware install itself on the computer as a service, without the credentials of the user.

Having looked at service examples on MSDN (C++), I need to give user credentials in order to create an automatic-startup service.

What techniques does malware employ? Can someone give clarification and provide me with some links?

  • This is a basic Windows programming question, not a security-related question. I've voted to migrate to stackoverflow – Stephane Jan 8 '16 at 14:37
  • After the recent edit, I think the question is on-topic. I've retracted my close vote. – Neil Smithline Jan 8 '16 at 17:24
3

Malware often comes piggy-bagging on installers for other software. When the user starts the installer of a piece of software they believe to be legitimate, they expect to be prompted for granting admin rights. The installer will then use these admin rights to install both the legitimate program and the malware.

This can easily happen when you obtain software from questionable or illegal sources.

A hypothetical method I never heard about in practice but which would be possible in theory could be a malware which waits for the user to download any form of installer and then modifies that installer to also permanently install the malware. This would require that the user downloads a software installer during the same session where they got infected with a malware in user-space, so I don't think this propagation method would be very effective.

2

Malware can be installed by users accounts running with full Administrator privileges, or in standard accounts by programs exploiting privilege escalation.

Privilege escalation is an exploit of an OS or application that acquires elevated access to resources that are normally protected from an application or user. That gives an application more privileges than intended, and can then provide privileges to perform unauthorized actions.

Many legacy versions of Windows created default users as administrators. Even today, many users user these admin accounts as their default logins.

If certain security features are not secured or configured properly (User Account Control), and/or a user is running as an Administrator type user, or via privilege escalation, then it is quite trivial to install any program as a service: either as a named service, or more stealthily, as a program running under svchost.exe, where it will be placed in a particular service group, which is then launched by svchost.exe.

Most email "phishing" attacks rely on these vulnerabilities: The UPS "package delivered notifications", the Better Business Bureau, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.