7

Lately, I have been trying to dive into the realms of malware and hacking. I have learned that hackers exploit bugs in programs and malware does similarly, but I was wondering whether malware must exploit something or can it run without exploiting anything?

  • 4
    Sometimes they exploit the user. User receives an email "from the FBI" claiming they are entitled some money from OTAN and they must execute money-from-IMF.exe to get the money. And guess what? No money... – ThoriumBR Jun 15 '18 at 19:12
  • 1
    Malware is software that acts maliciously. It doesn't matter how it's introduced or how it manages to cause damage to classify it as malware. – Arminius Jun 15 '18 at 19:32
  • I see your point – Mattz Manz Jun 15 '18 at 20:52
  • Frivolous answer: Yes, although sometimes the bug exploited is the one sitting on the chair behind the keyboard. – Shadur Jun 16 '18 at 12:48
  • 2
    It's not a bug, it's a feature! (Anti-feature actually) - Always-listening TV microphone? "That's to improve customer experience!" Secret hard coded admin password in your router? "That's to improve customer support!" Auto-update without consent? "It's not remote arbitrary code execution. That's there so we can protect you from malware!" Contact list secretly uploaded? "That's ! ...Look, computers are really complicated. You wouldn't understand why we need to ..." – Future Security Jun 17 '18 at 3:15
14

Malware is any software which performs malicious activities. Malware comes in all shapes and sizes, and with all sorts of infection vectors. Exploiting a software vulnerability is one way malware can spread, but there are many other (often more common) techniques they use, for example:

  1. Brute forcing passwords over a network to gain access to a network.

  2. Spreading to other computers on the same network over shares, etc.

  3. Tricking the user into executing a malicious file with a benign name.

  4. Tricking the user into performing an action that executes code (e.g. ldd).

Never overestimate the difficulty of tricking the average person into executing malware. Often forgotten techniques such as using unicode reversal on filenames can show a user a different filename than is really present. For example, a file called history_of_rac‮4pm.msi‬ seems safe enough, right? It's actually history_of_rac4pm.msi, but due to unicode reversal, the last seven characters are mirrored, giving the impression that an executable installer is a video! Check the HTML!

It doesn't even have to involve making them run an executable file. There are many actions that execute attacker-controlled code that people do not think about. Consider ldd utility in Linux. All it does is list the libraries required by a given executable file. Seems safe enough, as long as you don't execute the file? The reality is that ldd is actually a wrapper that executes the file with an environmental variable set which causes the executable, if using a correctly-behaving libc, to output the libraries it requires to stdout and then exit. It is trivial to create an executable which will not do that, so running such a simple "safe" utility on it will actually end up executing malicious code.

  • I wish I could upvote It but I now get a clearer understanding of how this works. Thanks! – Mattz Manz Jun 15 '18 at 20:51
  • #3 is exploiting a bug, albeit an wetware bug rather than a software one. – Shadur Jun 16 '18 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.