https://www.techtarget.com/cybersecurity/definition/What-is-malware-Prevention-detection-and-how-attacks-work
Malware, or malicious software, is any program or file that's intentionally harmful to a computer, network or server.
Types of malware include computer viruses, worms, Trojan horses, ransomware and spyware. These malicious programs steal, encrypt and delete sensitive data; alter or hijack core computing functions; and monitor end users' computer activity.
Malware can infect networks and devices and is designed to harm those devices, networks and their users in some way. Depending on the type of malware and its goal, this harm might present itself differently to the user or endpoint. In some cases, the effect of malware is relatively mild and benign, and in others, it can be disastrous.
Malware can typically perform the following harmful actions:
No matter the method, all types of malware are designed to exploit devices at the user's expense and to benefit the hacker -- the person who has designed or deployed the malware.
Malware authors use a variety of physical and virtual means to spread malware that infects devices and networks, including the following:
Different types of malware have the following unique traits and characteristics:
Users might be able to detect malware if they observe unusual activity. Common malware symptoms include the following:
Antivirus and antimalware software can be installed on a device to detect and remove malware. These tools can provide real-time protection through constant scanning or detect and remove malware by executing routine system scans.
Windows Defender, for example, is Microsoft's antimalware software included in various Windows OSes under the Windows Defender Security Center. Windows Defender protects against threats such as spyware, adware and viruses. Users can set automatic Quick and Full scans, as well as set low, medium, high and severe priority alerts.
Many security software products are designed to detect and prevent malware, as well as remove it from infected systems. Running antimalware tools is the best option to remove malware.
According to networking expert Andrew Froehlich, Westgate Networks, the following is a sampling of enterprise-grade antimalware tools that include ransomware protection. These tools, which are listed in alphabetical order, are designed for organizations of all sizes:
There could be instances when an antimalware tool might not completely remove the malware infection. It's best to manually inspect the system files, folders, registry entries and startup items in those cases. However, manually removing infected files should be cautiously attempted to avoid accidental deletion of critical files. For severely infected devices, users can also consider restoring the system through data recovery software to retrieve lost or corrupted files from a backup copy created before the infection occurred.
There are several ways users can prevent malware, including the following:
As previously mentioned, installing antimalware software is crucial when protecting PCs and network devices from malware infections.
Users can prevent malware by practicing safe behavior on their computers or other personal devices. This includes not opening email attachments from strange addresses that might contain malware disguised as a legitimate attachment -- such emails might even claim to be from legitimate companies but have unofficial email domains.
Users should enable or configure a firewall on their network router to monitor and control incoming and outgoing network traffic. Firewalls can help block unauthorized access and protect against the spread of malware.
Users should update their antimalware software regularly, as hackers continually adapt and develop new techniques to breach security software. Security software vendors respond by releasing updates that patch those vulnerabilities. If users neglect to update their software, they might miss a patch that leaves them vulnerable to a preventable exploit.
Users should always avoid clicking on pop-ups even if they look legitimate. Clicking on a pop-up advertisement can lead to unintentional downloads of malware or redirect users to malicious websites where malware could be automatically downloaded or installed without their consent. Additionally, web browser settings should be set to block both pop-ups and adware.
Strong and unique passwords that aren't easily guessable should be created for all accounts and devices. Additionally, multifactor authentication should be enabled wherever possible, as it requires multiple levels of authentication from a user before they can log in or access a system.
Users should be selective when browsing online and avoid websites that seem risky, such as those that offer screensavers for download.
Users should do regular offsite or offline backups to ensure the most recent version of data can't be breached but is available to be recovered after a malware attack.
In enterprise settings, networks are larger than home networks, and more is at stake financially. There are proactive steps companies should take to enforce malware protection and provide endpoint security.
Outward-facing precautions for enterprises include the following:
Business-facing, internal precautions for enterprises include the following:
Additionally, companies should provide security awareness training to all employees. Malware infections are often triggered by users unknowingly downloading counterfeit software or falling prey to phishing scams. Security awareness training equips users to recognize social engineering tactics, identify malicious websites and avoid downloading fake apps.
Malware can affect Macs as well as Windows devices. Historically, Windows devices are considered to be a larger target for malware than Macs, in part because users can download applications for macOS through the App Store.
In its "Malwarebytes Lab 2020 State of Malware Report," Malwarebytes reported that for the first time ever, malware on Macs outpaced malware on PCs. This is due in part to the popularity of Apple devices, drawing more attention from hackers.
Mac malware can take various forms, including viruses, trojans, adware, spyware and ransomware. A few real-world examples of Mac malware include the following:
Malware can be found on mobile phones and can provide access to a device's components, such as the camera, microphone, GPS or accelerometer. With the rise of mobile device usage and companies letting employees access corporate networks via personal devices, mobile malware is spreading rapidly. For example, malware can be contracted on a mobile device if a user downloads an unofficial application or clicks on a malicious link from an email or text message. A mobile device can also be infected through a Bluetooth or Wi-Fi connection.
Mobile malware is more commonly found on devices that run the Android OS rather than iOS. Malware on Android devices is usually downloaded through applications. Signs that an Android device is infected with malware include unusual increases in data usage, a quickly dissipating battery charge or calls, texts and emails being sent to the device contacts without the user's initial knowledge. Similarly, if a user receives a message from a recognized contact that seems suspicious, it might be from a type of mobile malware that spreads between devices.
Apple iOS devices are rarely infected with malware because Apple vets the applications sold in the App Store. However, it's still possible for an iOS device to be infected with malicious code by opening an unknown link found in an email or text message. iOS devices are also more vulnerable if jailbroken.
The term malware was first used by computer scientist and security researcher Yisrael Radai in 1990. However, malware existed long before this.
One of the first known examples of malware was the Creeper virus in 1971, which was created as an experiment by Raytheon BBN (formerly BBN Technologies) engineer Robert Thomas. Creeper was designed to infect mainframes on ARPANET. While the program didn't alter functions or steal or delete data, it moved from one mainframe to another without permission while displaying a teletype message that read, "I'm the creeper: Catch me if you can." Creeper was later altered by computer scientist Ray Tomlinson, who added the ability to self-replicate to the virus and created the first known computer worm.
The concept of malware took root in the technology industry, and examples of viruses and worms began to appear on Apple and IBM PCs in the early 1980s before becoming popularized following the introduction of the World Wide Web and the commercial internet in the 1990s. Since then, malware -- and the security strategies to prevent it -- have only grown more complex.
There are other types of programs that share common traits with malware but are distinctly different.
Common examples of viruses that are similar to malware but aren't technically classified as malware, include the following:
Grayware is a category of PUP applications that trick users into installing them on their systems -- such as browser toolbars -- but don't execute any malicious functions once they've been installed. However, there are cases where a PUP might contain spyware-like functionality or other hidden malicious features, in which case it would be classified as malware.
Browser hijackers are programs that can perform various actions without user consent. For example, they can change web browser settings, redirect users to unwanted websites and display intrusive ads. While they aren't classified as malware, they can certainly invade a user's privacy and disrupt their browsing experience.
Websites often track a user's browsing habits and preferences by placing little text files known as tracking cookies on their devices. They can cause privacy issues and be exploited for data collection and targeted advertising. Google will start decommissioning tracking cookies for its Chrome browser by the end of 2024, with a planned completion date of 2025.
RATs are legitimate tools that are often used for remote administration and troubleshooting purposes. However, sometimes threat actors can abuse them to gain unauthorized system access and cause privacy issues for users.
Despite belonging to the broader category of malware, ransomware comes with unique traits. Learn to identify the distinct characteristics of ransomware by examining the key differences between malware and ransomware.
26 Jul 2024