📔
eCPPTv2 Notes
  • About
  • 1-System Security
    • Architecture Fundamentals
      • Security Implementations
      • References
    • Assembler Debuggers and Tool Arsenal
      • Compiler
      • NASM
      • Tool Arsenal
      • References
    • Buffer Overflow
      • Finding Buffer Overflows
      • Exploiting Buffer Overflow
      • Security Implementations
      • References
    • Shellcoding
      • Types of Shellcode
      • Encoding of Shellcode
      • Debugging a Shellcode
      • Creating our First Shellcode
      • More Advanced Shellcode
      • Shellcode and Payload Generators
      • References
    • Cryptography and Password Cracking
      • Cryptography Hash Function
      • Public Key Infrastructure
      • Pretty Good Privacy (PGP)
      • Secure Shell (SSH)
      • Cryptographic Attack
      • Security Pitfalls
      • Windows 2000/XP/2k3/Vista/7/8 Passwords
      • References
    • MALWARE
      • Techniques Used by Malware
      • How Malware Spreads
      • Samples
      • References
  • 2-Network Security
    • Information Gathering
      • Search Engines
      • Social Media
      • Infrastructures
      • Tools
      • References
    • Scanning
      • Detect Live Hosts and Ports
      • Service and OS detection
      • Firewall/IDS Evasion
      • References
    • Enumeration
      • NetBIOS
      • SNMP
      • References
    • Sniffing and MitM Attacks
      • What is Sniffing
      • Sniffing in Action
      • Basic of ARP
      • Sniffing Tools
      • Man in the Middle Attacks
      • Attacking Tools
      • Intercepting SSL Traffic
      • References
    • Exploitation
      • Vulnerability Assessment
      • Low Hanging Fruits
      • Exploitation
      • References
    • Post Exploitation
      • Privilege Escalation and Maintaining Access
      • Pillaging / Data Harvesting
      • Mapping the internal network
      • Exploitation through Pivoting
      • References
    • Anonymity
      • Browsing Anonymously
      • Tunneling for Anonymity
      • References
    • Social Engineering
      • Types of Social Engineering
      • Samples of Social Engineering Attacks
      • Pretexting Samples
      • Tools
      • References
  • 3-Powershell for Pentesters
    • Introduction
      • Why PowerShell ?
      • References
    • PowerShell Fundamentals
      • Cmdlets
      • Modules
      • Scripts
      • Objects
      • References
    • Offensive PowerShell
      • Downloading & Execution
      • Obfuscation
      • Information Gathering & Recon
      • Post-Exploitation With Powershell
      • References
Powered by GitBook
On this page

Was this helpful?

  1. 1-System Security
  2. MALWARE

How Malware Spreads

3. How Malware Spreads

Malware basically spreads via a large number of mechanism such as:

  • Email attachments We can change the extension from .exe into .jpg so that user will be tricked believing that it is an image

  • Already infected files If you have been infected by a virus for a day, you need to think about what it might have already done during the 1-day time-frame. If the virus was the re-infection kind, then it must have infected numerous of other files, which open access/execution will activate the virus again. Once you are infected by a virus, it is then very hard to remove the infection from the system.

  • Peer-2-peer file sharing Nowadays, around 30%-40% of all available files in file-sharing networks can be assumed to be infected with malware. Some of the clients are ad-supported or are pre-bundled with malware. They also may contain hidden backdoors (intentionally or unintentionally).

  • Web-sites These kinds of attacks are also called drive-by-downloads. A website Y will exploit your browser in a way and then download the remaining part/body of the malware. Drive-by-downloads are triggered upon visiting a HTML page.

  • Internet connection/Local network For example, there are some kind of glitches in Windows networking stack (Linux also has its own set of bugs) which are found time and time, and then rapidly exploited by malware to spread directly.

    Some of the known examples are RPC-DCOM vulnerability in Windows 2000/XP which was exploited on a very large scale all over the world.

    This kind of vulnerability do not require any user action. However, these kind of attacks can be stopped by using correctly configured firewalls or simply applying patches.

    Remember that we have written Correctly configure firewalls because a badly configured firewall does not offer any protection at all.

    However, do note that firewalls themselves have their own set of bugs, so they themselves can be vulnerable, so the best way to be protected is to update your software as soon as possible.

PreviousTechniques Used by MalwareNextSamples

Last updated 4 years ago

Was this helpful?