Defeating the Threat of Malware: Types, Tools, and Trends

Introduction

Throughout history, humans have constructed walls, palisades, moats, and other barriers as defenses against malicious attacks, but invaders have also responded with improved technologies capable of defeating those defenses. Just as medieval defenders built their walls higher and their moats deeper, software developers today also seek to create products that are safe from unauthorized intrusion through firewalls and other security measures, while hackers and other criminal elements try to defeat them with various stratagems — including the use of so-called "malware." Because malware can affect any consumer, identifying ways to defeat these programs represents a timely and valuable enterprise. This paper provides a review of the relevant peer-reviewed and scholarly literature concerning the different types of malware, typical proactive measures and tools that can be utilized against malware attacks, and the technologies involved. Finally, a discussion and assessment of future trends in malware development is followed by a summary of the research and important findings.

Types of Malware

The term "malware" stands for "malicious software," which is an umbrella term used to refer to any software application that "runs on a computer without the user's knowledge and performs predetermined functions that cause harm" (May, 2012). This broad definition includes relatively benign software that merely collects consumer data, but ranges to especially harmful applications that can disable entire computer networks or worse. This continuum of maliciousness includes some of the most common types of malware, described in the table below.

Adware refers specifically to programs that display pop-up advertisements. The subject matter of the ads is often based on surfing habits but may also be tied to a specific advertiser. Viruses are programs designed to spread themselves among files on a single computer or computers on a network — usually the Internet. Often, crackers (hackers with malicious intent) create these programs simply to see how far they will spread. Worms are similar to viruses in that they spread across a network, but do so by making copies of themselves as they travel; they may also change their profile to avoid detection. Trojans assume the appearance of something benign, such as an update or add-on to a legitimate program. Once installed, a Trojan may perform harmful functions such as erasing the hard disk or deleting image files, and, like spyware, it may also gather information and transmit it to the developer. Finally, cookies are small data files used by websites to store information on computers that can be used to detect personal information, such as recently visited sites. (Adapted from May, 2012.)

These malware threats clearly range in their impact on computer users, but in some cases the harm caused can extend far beyond an individual computer system. As Perrow notes, "Once your machine has been compromised [by malware], it can be used to send these threats to other machines; your machine becomes a member of a 'botnet,' after robots" (p. 252). While the malware threat continues to expand and become more difficult to detect and defeat, there are proactive measures and tools that can help protect computers from malware, discussed in the following section.

Proactive Measures and Tools Against Malware

Beyond firewalls, encryption, password protection, and other antimalware software tools, there are also a number of proactive strategies used by the information security community, including "trolling" communities of interest to gain fresh insights into what current malware is being developed and how these programs operate. According to Johnston (2009), "One strategy used by antivirus researchers to ascertain the skill sets of the 'thieves' is to troll the virus writers' underground virtual communities, bulletin boards, and Web sites, interacting with hackers, spammers, and virus code writers" (p. 34). Because participants in these online forums often conceal their true identities, anti-malware experts are able to penetrate these communities through social engineering methods that cater to the egos of hackers who may be willing to share their secrets with apparently like-minded criminals. Johnston emphasizes that "the lack of culturally specific embodied identities inherent in the electronic communication of the internet allows these researchers to mask their 'real-world' intentions in their virtual re-embodiment as malware-writing criminals" (2009, p. 34).

Another proactive strategy used to defeat malware writers is the analysis of malware samples provided by affected customers. Johnston (2009) notes that "virus writers also send their new creations to various antivirus vendors and researchers as a way of testing vendors' systems, as a 'courtesy,' or as a way of marking their status. Antivirus professionals take this information and share it across competitive vendor boundaries, developing industry-wide counterstrategies to be integrated into their next software releases" (pp. 34–35).

Yet another proactive approach involves content analysis of industry and hacker reports concerning the effectiveness of anti-malware applications. Hua (2011) reports that "in many circumstances, to fight such threats, internet security vendors can analyze billions of files, e-mails, and malware products to categorize and determine their 'reputation' in the cloud and quickly update their customers' firewalls and filters" (p. 37).

There are also common-sense steps that average consumers can take to help protect themselves from malware, including: (1) activating security solutions that reside on mobile devices; (2) password-protecting cellular phones; and (3) evaluating mobile apps before downloading them by finding reviews from reputable sources (Hua, 2011). While the measures and tools available against malware are generally effective as long as they are updated regularly, hackers and other criminal elements continue to work to identify ways to defeat these technologies.

Conclusion

The research showed that malware stands for "malicious software" and is an umbrella term that includes adware, viruses, worms, Trojans, and cookies. These applications can be introduced into a computer system through external means such as flash drives or DVDs, but the far more common approach is through various online connections. The research also showed that the level of harm caused by different types of malware ranges from the relatively benign — such as the collection of consumer data by cookies or the unwanted display of commercial advertisements through adware — to the disruption or even complete disabling of entire computer network systems by viruses, worms, and Trojans.

A consistent theme that emerged from the literature was that even as new and improved protections are developed by anti-malware researchers, a legion of hackers, crackers, and other criminal elements continues to develop ways to overcome those protections in a never-ending cycle. In the final analysis, there will likely be a malware threat even when pervasive computing is fully realized, and future hackers may target human brains rather than mere computer systems.

References

Gale, D. (2006). Can this virus be 'rooted' out? A new kind of hard-to-detect malware is increasing our vulnerability to hackers and creating headaches for makers of antiviral software. THE Journal, 33(1), 18–20.

Hua, V. (2011). Redefining the security wall. THE Journal, 38(7), 36–38.

Johnston, J. J. (2009). Technological turf wars: A case study of the computer antivirus industry. Philadelphia: Temple University Press.

May, P. (2012). How to avoid spyware. HowStuffWorks. Retrieved from http://electronics.howstuffworks.com/how-to-tech/how-to-avoid-spyware1.htm.

Perrow, C. (2007). The next catastrophe: Reducing our vulnerabilities to natural, industrial, and terrorist disasters. Princeton, NJ: Princeton University Press.