Lately, I have been trying to dive into the realms of malware and hacking. I have learned that hackers exploit bugs in programs and malware does similarly, but I was wondering whether malware must exploit something or can it run without exploiting anything?

  • 4
    Sometimes they exploit the user. User receives an email "from the FBI" claiming they are entitled some money from OTAN and they must execute money-from-IMF.exe to get the money. And guess what? No money...
    – ThoriumBR
    Commented Jun 15, 2018 at 19:12
  • 1
    Malware is software that acts maliciously. It doesn't matter how it's introduced or how it manages to cause damage to classify it as malware.
    – Arminius
    Commented Jun 15, 2018 at 19:32
  • I see your point
    – Mattz Manz
    Commented Jun 15, 2018 at 20:52
  • Frivolous answer: Yes, although sometimes the bug exploited is the one sitting on the chair behind the keyboard. Commented Jun 16, 2018 at 12:48
  • 2
    It's not a bug, it's a feature! (Anti-feature actually) - Always-listening TV microphone? "That's to improve customer experience!" Secret hard coded admin password in your router? "That's to improve customer support!" Auto-update without consent? "It's not remote arbitrary code execution. That's there so we can protect you from malware!" Contact list secretly uploaded? "That's ! ...Look, computers are really complicated. You wouldn't understand why we need to ..." Commented Jun 17, 2018 at 3:15

1 Answer 1


Malware is any software which performs malicious activities. Malware comes in all shapes and sizes, and with all sorts of infection vectors. Exploiting a software vulnerability is one way malware can spread, but there are many other (often more common) techniques they use, for example:

  1. Brute forcing passwords over a network to gain access to a network.

  2. Spreading to other computers on the same network over shares, etc.

  3. Tricking the user into executing a malicious file with a benign name.

  4. Tricking the user into performing an action that executes code (e.g. ldd).

Never overestimate the difficulty of tricking the average person into executing malware. Often forgotten techniques such as using unicode reversal on filenames can show a user a different filename than is really present. For example, a file called history_of_rac‮4pm.msi‬ seems safe enough, right? It's actually history_of_rac4pm.msi, but due to unicode reversal, the last seven characters are mirrored, giving the impression that an executable installer is a video! Check the HTML!

It doesn't even have to involve making them run an executable file. There are many actions that execute attacker-controlled code that people do not think about. Consider ldd utility in Linux. All it does is list the libraries required by a given executable file. Seems safe enough, as long as you don't execute the file? The reality is that ldd is actually a wrapper that executes the file with an environmental variable set which causes the executable, if using a correctly-behaving libc, to output the libraries it requires to stdout and then exit. It is trivial to create an executable which will not do that, so running such a simple "safe" utility on it will actually end up executing malicious code.

  • I wish I could upvote It but I now get a clearer understanding of how this works. Thanks!
    – Mattz Manz
    Commented Jun 15, 2018 at 20:51
  • #3 is exploiting a bug, albeit an wetware bug rather than a software one. Commented Jun 16, 2018 at 12:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .