I was wondering whether anyone knew if malware could spread without internet connectivity? Also, can you defend against malware by releasing counter-malware that spreads exploiting the same vulnerability, but upon infection uninstall the original malware?
It depends which malware and what it was designed to do.
If the malware author wants so, the malware could either attack other computers on the network (not necessarily Internet, just two computers connected to a network for example to share files) and try some exploits on them, in hopes that one of them isn't patched on the target machine and thus that machine gets infected which in turn will attack others, and so on...
Another solution would be to silently leave "surprises" on storage drives connected to the infected machine, that is copies of itself with an
autorun.inf to make it execute automatically (or with some social engineering like making the icon and file name mimick an installer or a video player so people execute it themselves) once the drive is connected to other machines.
Yet another solution would be to leave "surprises" in the firmware of connected devices, which often makes the devices appear as keyboards that will type in malicious commands (often to download the actual payload from a remote server) as soon as they're plugged into another machine.
Of course all of these techniques can be combined together.
About releasing counter-malware, it may work, but there are several issues :
- even if this "malware" isn't as evil as the other malware out there, it still exploits your machine, installs on it and then tries to exploit other machines to replicate itself and so on... even if it's for a good cause, it still turns your computer into a zombie that will "attack" other machines and waste bandwidth/resources
- malware authors develop them for money (often so they can rent parts of their botnet to other cybercriminals for DDoS, spamming, proxying, etc); what incentive does someone have for making the "counter-malware" you propose ?
- I don't know if this is actually frequent with common malware found in the Windows world, but the evil malware can, in addition to being evil also patch the vulnerability itself so that neither "counter-malware" nor rival attackers can "steal" their newly compromised machine
- the only reliable way to clean up a compromised machine is to reinstall it from scratch which your counter-malware can't do as it requires physical intervention on the machine
Finally, OS developers provide equivalents of this "counter-malware" in the form of updates.