-1

How malicious can malware/spyware be? What do common malware/spyware usually do on a computer? (According to websites, they usually touch on retrieval of information like passwords, credit card data. Are file, photos, video retrieval possible?)

3
  • 3
    This question is too broad but to give your some ideas: delete your data, encrypt them and require you to pay for decryption, steal the data and blackmail you, use your computer to attack other systems or to send spam, manipulate online banking ... Sep 10, 2016 at 16:11
  • 2
    It can replace your OS and become an OS itself
    – VarunAgw
    Sep 10, 2016 at 19:16
  • 4
    Why do you believe there are any limits on what malware can do? I think this question lacks any research effort.
    – schroeder
    Sep 10, 2016 at 21:27

3 Answers 3

3

Imagine you leave your computer unattended for some minutes, and someone comes and installs a program. This program runs in the background, and you can't easily see it (for example, there is no window).

What can that program do? Pretty much anything.

It can read all the files on your disk, it can delete them, overwrite them, encrypt them. It can use your network connection, so it can access any server in the world and send your files, or receive orders on what to do. It can access your microphone and webcam and spy on you, and send the content to someone on the net. It can use your CPU and GPU to mine bitcoins (although this would be easier for you to notice). It can replace your drivers with others that do something undesired (for example it can install drivers for your video card that stop the fan, thus causing it to be damaged due to lack of cooling - years ago, nVidia released drivers that had a bug like this, so this is real).

Now, malware is normally not installed by someone with physical access to your pc, it comes from an email attachment or from a website that uses drive-by-download or something. But once it is installed, it is a program running on your pc, and there's no difference.

Some malwares are so sophisticated that they can infect some parts of your pc that are not your hard disk. Which means that you format your disk, reinstall your OS from a clean DVD... And you are still infected. Well, normally the average user doesn't need to worry about attacks of this level. But it's possible.

There are really no limits.

1
  • To add to this, malware can even operate undetectable to any operating system (even booted from a R/O medium), and what's the most scary,even while the computer is turned off (not with a physical breaker, but "off" in the usual sense). Intel explicitly builds this into all modern computers, it's called "management engine", basically an autonomous programmable microcontroller wired directly to the ethernet circuitry, can do all kinds of covert stuff, remote controllable, and nothing you can do.
    – Damon
    Sep 10, 2016 at 22:34
3

The answers present argue that malware can do pretty much anything to your computer, and that is correct. Yet, that does not necessarily mean that every malware will be able to perform anything once installed. Malware infection has two main phases: injection and privilege escalation.

Injection

First of all malware needs to reach an execution context on your computer. This can be achieved in several manners (these are not exhaustive):

  • Making a program (e.g. a mail client) to execute the malware (e.g. email attachment) dues to vulnerability;
  • Asking you to download the malware and expecting you to run it (e.g. by clicking on it);
  • Someone with physical access can install and run it;
  • Someone may install and run it through a backdoor.

If the malware is running as an unprivileged user, the damage it may cause is limited to the permission (and privileges of that user). Yet a lot of malware is designed to go further, and attempt privilege escalation.

Privilege escalation

A malware running as an unprivileged user user does not have direct control over hardware (on most operating systems). For example, a malware running inside a web browser will not be able to turn on your webcam (or at least not without cleverly making you give that permission to it). Privilegde escalation happens in the context of a malware running inside a semi-sandboxed environment (as the browser in the example of the webcam) or in the case it is running as an unprivileged user.

If the malware can escalate its privileges to enter into execution context as the root user (*nix OS family) or the administrator (MS OS family) only then it is free to do anything on a computer. Privilege escalation is heavily dependent on the OS (or sandbox) construction but may include:

  • setuid programs on *nix
  • registry changes on MS family
  • phishing the user for a password to allow for higher privileges (e.g. exec sudo ...)

Conclusion

Not all malware can pass through both phases. Some malware can only inject itself into a sandbox or an unprivileged execution context (i.e. it never manages to escalate privileges further). This limits what the malware can do.

And that is a good reason to run applications that may enter in contact with malware (e.g. mail clients, browsers) as an unprivileged user.

1
  • 1
    Malware running as an unprivileged user can still do really bad things, if it is the same unprivileged user with which the owner e.g. manage their photos and documents or is doing their internet banking. xkcd.com/1200 Sep 11, 2016 at 0:44
1

Totally.

Common malware can take over every aspect of your PC. There is plenty of malware that will, for example, turn on a webcam and capture video and transfer it elsewhere. Any files can be transferred. Or encrypted, or deleted.

Not the answer you're looking for? Browse other questions tagged or ask your own question.