Does malware have to exploit a bug?

Question

Lately, I have been trying to dive into the realms of malware and hacking. I have learned that hackers exploit bugs in programs and malware does similarly, but I was wondering whether malware must exploit something or can it run without exploiting anything?

Answer 1

Malware is any software which performs malicious activities. Malware comes in all shapes and sizes, and with all sorts of infection vectors. Exploiting a software vulnerability is one way malware can spread, but there are many other (often more common) techniques they use, for example:

1. Brute forcing passwords over a network to gain access to a network.

2. Spreading to other computers on the same network over shares, etc.

3. Tricking the user into executing a malicious file with a benign name.

4. Tricking the user into performing an action that executes code (e.g. ldd).

Never overestimate the difficulty of tricking the average person into executing malware. Often forgotten techniques such as using unicode reversal on filenames can show a user a different filename than is really present. For example, a file called history_of_rac‮4pm.msi‬ seems safe enough, right? It's actually history_of_rac4pm.msi, but due to unicode reversal, the last seven characters are mirrored, giving the impression that an executable installer is a video! Check the HTML!

It doesn't even have to involve making them run an executable file. There are many actions that execute attacker-controlled code that people do not think about. Consider ldd utility in Linux. All it does is list the libraries required by a given executable file. Seems safe enough, as long as you don't execute the file? The reality is that ldd is actually a wrapper that executes the file with an environmental variable set which causes the executable, if using a correctly-behaving libc, to output the libraries it requires to stdout and then exit. It is trivial to create an executable which will not do that, so running such a simple "safe" utility on it will actually end up executing malicious code.