Viruses, spies, trojans and dialers: who, why and how

I think that if today any student is asked what is lavsan, he will not tell you about the "synthetic fiber obtained by polycondensation of ethylene glycol and aromatic dibasic acid." No, his answer will be something like this: “Lovesan, aka msblast - penetrating the Microsoft Windows family operating system using a vulnerability in the Microsoft Windows DCOM RPC service.” I'm afraid to suggest what kind of associations will be with the word doom. Explicitly not only with the game of the same name.

As you can understand from the title and introduction, the conversation will now be about viruses and their ilk. Before proceeding to the answers to the questions posed in the title of the chapter, I would like to go directly to our “guests” today. Here, the answer will be given to the question of how all this gets into our computers.

The essence of the program, bearing some destructive consequences. And it doesn’t matter what they are: there can be anything from a banal replacement of file permissions and damage to its internal content to disruption of the Internet and the collapse of the operating system. Also, a virus means a program that not only carries destructive functions, but also can multiply. Here is what is said about this in one clever book: “A mandatory (necessary) property of a computer virus is the ability to create its own duplicates (not necessarily the same as the original) and embed them in computer networks and / or files, computer system areas and other executable objects. At the same time, duplicates retain the ability to spread further ”(Eugene Kaspersky,“ Computer viruses ”). Indeed, in order to survive, viruses need to multiply, and this is proved by a science such as biology. By the way, it was from those very biological viruses that the name computer came from. And they themselves fully justified their name: all viruses are simple and, nevertheless, despite the efforts of antivirus companies, whose costs are estimated in huge amounts, they live and thrive. You don’t have to go far for examples: take at least a virus like I-Worm.Mydoom.b. They have said so many times that it is impossible to open file attachments and e-mail messages from unknown persons, and messages from known ones should be treated with caution, especially if you did not agree on this. In addition, if the text of the letter contains something like the following: “Check out the cool photo of my girlfriend”, then it’s necessary to delete it right away. But if the text still makes sense in the above example, the content of the letters infected with mydoom’oM is rather strange. Judge for yourself: “The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment sendmail daemon reported: Error # 804 occured during SMTP session. Partial message has been received. The message contains Unicode characters and has been sent as a binary attachment. The message contains MIME-encoded graphics and has been sent as a binary attachment. Mail transaction failed. Partial message is available. "

Inside the letter contains a file that has 9 variants of the name of the attached file and 5 extension options. Two variations came to my box. The first is a zip file with an allegedly doc file, and the second is a simple exe’s file with an icon replaced with a notepad icon. If in the second case any user can notice the catch by looking at the resolution, then in the first case it is already more difficult to do. It is to the first case that I am inclined to attribute the greatest number of infections. What this virus does, I will not tell, because it has already been said about this many times in print publications and online resources. Using Mudom as an example, we got acquainted with the first method of spreading viruses - via email.

We will consider the following method using the example of Worm.Win32.Lovesan (also known as msblast). What is remarkable about this virus, and why did it become widespread? This individual is noteworthy in that, in principle, it does not affect the performance of the system as a whole. A computer infected by it simply cannot function normally on the Internet. After a while, the RPC error message pops up, after which the computer restarts.

Another way is through the Internet when you download files (in the desired or undesirable version). Again, I will explain with examples. An example of what is desired. You are downloading some new joke, or a program, or a game from the Web, and it is infected with a virus. After downloading the program / game / joke starts, and - voila - you are the owner of the virus. What can I say? Be vigilant, regularly update your antivirus databases, check all programs with antivirus and do not forget at least the basics of computer security. Someone may say: “Why should I, for example, check programs that could not be infected with a virus?” I would like to ask: “What kind of programs are these?” Any programs can be infected, especially if they are downloaded from stores or sites of hacker groups.

Now let's move on to junk download. I would single out two types of such loading. The first is when the user does not suspect that something is loading on his computer. This download is performed by running scripts. The second type of unwanted download is when it downloads not what you need. I will give an example. At one time, one site with cracking immediately before downloading a file suggested installing either “Free XXX bar” or “100% Internet crack”. If the user agreed to this (and I’m sure there were such, because I still remember the question of the month in “Virtual Joys” about “one hundred percent crack Internet”), then a Trojan or virus was downloaded. The difference, in principle, is small. However, this is still not the most interesting: in the case of rejection of such a tempting offer, a sign popped up with an inscription of approximately the following contents: “Site error” and the OK button or Continue, by clicking on which the Trojan was downloaded, however, without the user's knowledge. And could save from this only firewall (firewall).

Troyan - this is a program that provides unauthorized access to a computer for performing any actions at the destination without warning the owner of the computer or sends information collected to a specific address. However, she, as a rule, poses as something peaceful and extremely useful.

Some trojans are limited to sending your passwords by mail to their creator or to the person who configured this program ( e-mail trojan). However, for Internet users, the most dangerous programs that allow remote access to their machine from ( BackDoor ) Very often trojans get to the computer along with useful programs or popular utilities, disguising themselves as them.

A feature of these programs that force them to be classified as harmful is the absence of a warning about their installation and launch. When launched, the trojan installs itself in the system and then monitors it, while the user does not receive any messages about his actions. Moreover, the link to the Trojan may not be in the list of active applications or merge with them. As a result, the computer user may not be aware of his presence in the system, while the computer is open for remote control.

Quite often, the term “trojan” refers to a virus. In fact, this is far from the case. Unlike viruses, trojans are aimed at obtaining confidential information and access to certain computer resources.

There are various ways that a trojan can penetrate your system. Most often this happens when you start some useful program in which the Trojan server is embedded. At the time of the first launch, the server copies itself to a directory, prescribes itself to be launched in the system registry, and even if the host program never starts again, your system is already infected with a trojan. You can infect a machine by running an infected program. This usually happens if the programs are not downloaded from official servers, but from personal pages. Unauthorized people can also introduce the trojan if they have access to your machine by simply running it from a floppy disk.

At the moment, the following Trojans are most widely used:

1. Hidden (Remote) Administration Utilities(BackDoor - from the English "back door"), Trojan horses of this class are inherently quite powerful utilities for remote administration of computers on a network. In their functionality, they are largely reminiscent of various administration systems developed by well-known software companies. Modern utilities for hidden administration (BackDoor) are quite easy to use. They usually consist mainly of two main parts: the server (executor) and the client (server governing body). Server - it is an executable file that is embedded in your machine in a certain way, loaded into memory at the same time as Windows starts, and executes commands received from the remote client. The server is sent to the victim, and in the future, all work is done through the client on the hacker's computer, that is, commands are sent through the client, and the server executes them. Outwardly, his presence is not detected in any way. After the server part of the trojan is launched, a certain port is reserved on the user's computer, which is responsible for communication with the Internet.

After these actions, the attacker launches the client part of the program, connects to this computer through an open port online and can perform almost any action on your machine (this is limited only by the capabilities of the program used). After connecting to the server, you can manage the remote computer as if it were your own: reboot, shut down, open the CD-ROM, delete, write, change files, display messages, etc.

On some trojans, you can change the open port during operation and even set an access password for the “owner” of this trojan. There are also trojans that allow you to use a “lost” machine as a proxy server (HTTP or Socks protocols) to hide the hacker's real IP address.

2. Postage(e-mail trojan).

Trojans that allow you to “pull out” passwords and other information from your computer’s files and send them by email to the owner. This can be the provider's logins and Internet passwords, mailbox password, ICQ, IRC passwords, and others. To send an email to the owner, the trojan communicates with the site’s mail server via SMTP protocol (for example, on smtp.mail.ru). After collecting the necessary data, the trojan will check whether this data was sent. If not, the data is sent and stored in the register. If you have already sent, then the previous letter is extracted from the register and it is compared with the current one. If any changes have occurred in the information (new data has appeared), then the letter is sent, and the latest password data is recorded in the register. In a word, this type of trojans simply collects information, and the victim may not even realize that her passwords are already known to someone.

3. Keyboard(Keyloggers).

These trojans write everything that was typed on the keyboard (including passwords) to a file that is subsequently sent to a specific e-mail or viewed via FTP (File Transfer Protocol). Keylogger’bi usually take up little space and can disguise themselves as other useful programs, making them difficult to detect. Another reason for the difficulty of detecting such a trojan is that its files are called system files. Some trojans of this type can extract and decrypt passwords found in special fields for entering passwords.

Such programs require manual configuration and masking. Keylogger’bi can be used not only for hooligan purposes. For example, they are very convenient to put at your workplace or at home at the time of departure.

4. Joke programs(Joke programs).

These programs are harmless in nature. They do not cause the computer any direct harm, however, they display messages that such harm has already been done, may be caused under any conditions, or warn the user about a non-existent danger. Joke programs intimidate the user with messages about formatting the hard disk, detect viruses in uninfected files, display strange virus-like messages, etc. - it depends on the humor of the creator of such a program. Of course, there is no reason for excitement if other inexperienced users do not work at this computer, which such messages can greatly scare.

5. “Trojan horses” can also include infected files, the code of which is in a certain way corrected or changed by cryptographic method. For example, a file is encrypted with a special program and / or packed by an unknown archiver. As a result, even the latest versions of antiviruses cannot determine the presence of a trojan in the file, since the code medium is not in their antivirus database.

The methods of their penetration do not differ from the above. Therefore, we immediately proceed to consideration. Here it is necessary to make a reservation that there are quite peaceful dialers, popularly called "dialers". These programs are used to help dial-up’a users reach the provider and, if possible, maintain stable communication with them even on old or “modernized” lines. The ones that we will talk about have a different name - combat dialers. Using gaps in the operating system, and sometimes due to negligence or naivety of users (see above about “100% Internet crack”), these programs replace the provider’s phone with the telephone of a telecom operator from some exotic country. Moreover, in most cases, the old good provider telephone remains in the dialing window. Even the dialers prescribe in the scheduler the task to call at a given time. And it’s good if the user has the habit of turning off the modem or if he has an external one and screams so that his mother does not worry. And if the modem is quiet and built-in? Here I am about that. And the poor fellow learns of his grief only upon the arrival of such a telephone bill.

It's time to talk about who writes and launches all this muck on the Web. Here I will try to classify those groups of people who are engaged in this unseemly matter. It will not be said about the so-called "white" hackers. I will explain why. This variety does not pose a danger to society and rather benefits it. It is they who most often write antivirus viruses to neutralize particularly harmful individuals. Why viruses? These programs spread by the same mechanism as viruses. Why anti? Because they block or remove a certain type of virus from the computer. Their main difference from viruses is also self-destruction after completing their task and the absence of any destructive functions. An example is a similar virus that appeared on the Web some time after the recurrence of Lovesan’a. After downloading the antivirus, Lovesan was deleted, and the user was prompted to download updates for Windows. White hackers also find flaws in software and computer systems, and then report bugs to companies. Now we proceed directly to our classification.

Type one: "children of scripts." They call themselves only HaCkeR-rr, read the Hacker magazine, do not know a single programming language, and create all their “own” Trojans and viruses by downloading ready-made programs from the Web. (To avoid arrivals, I will make a reservation that the Hacker magazine, in principle, is not bad, and the material in it is presented in a rather simple form - sometimes, in truth. But in a simple form for people who already have some kind of knowledge. And they they give it wisely - they don’t tell everything to the end - so as not to get them anywhere, you have to think.) These "hackers" usually, after they send a Trojan downloaded from somewhere else, and the last one works, they immediately start yelling at the forums about their steepness, etc., etc. For which, right there, quite rightly, they receive a bunch of awkwardness at their address riyatnyh statements, because it does not matter. Since I’ve done it, then better shut up. These individuals do not represent a particular danger, because they simply do not have enough experience or (in some cases) brains for a more or less large-scale business.

Type two: "beginner". This species is a direct descendant of the first. Some of the representatives of the first type, after a certain period of time, begin to realize that they are not as cool as it seemed to them that, it turns out, there are also programming languages \u200b\u200bthat you can do something and then do not yell to the whole world about "how good I am." Some of them in the future may turn into a representative of the pro class. These people begin to learn some language, try to write something, a creative thought begins to wake up in them. And at the same time they begin to pose a certain danger to society, for who knows what a terrifying work of inexperience such a representative of the class of virus writers can compose. After all, when a professional writes the code, he nevertheless realizes that some things do not need to be done, since they can play against him. The beginner does not have such knowledge, and this is dangerous.

Type three: "pros." Develop from the second species. “Profi” are distinguished by a deep knowledge of programming languages, network security, they understand the depths of operating systems and, most importantly, they have very serious knowledge and understanding of the mechanism of operation of networks and computer systems. Moreover, “pros” not only learn about security holes from company newsletters, but they themselves find them. Often they join in hacker groups to improve the quality of their “work”. These people, mostly secretive and not greedy for fame, do not run to report this to the whole world during any successful operation, but prefer to peacefully celebrate success with friends. Of course, they represent a great danger, but since they are all knowledgeable people, they will not go for actions that can cause a global collapse of any system - for example, the Internet. Although there are exceptions (not everyone has forgotten about Slammer’a).

Type Four: Industrial Hackers. The most dangerous for society representatives of the hacker family. They can rightly be called real criminals. It is on their conscience to write most of the dialers and hack into the networks of banks, large companies and government agencies. Why and for what they do it, we will talk below. "Industrialists" do not reckon with anything or anyone, these individuals are able to do anything to achieve their goals.

Now summarize what is written.

  "Children of scripts": young, green and inexperienced. I want to show that you are the coolest of all, but only Cool Sam is cooler than you.

"Beginner": there was a craving for writing something independent. Fortunately, some of them, after trying to learn the tricks of Internet protocols and programming languages, abandon this business and go on to do something more peaceful.

  “Pros”: if the state “has realized his guilt, measure, degree, depth” suddenly arises, then a representative of this type becomes a highly qualified specialist in computer security. I would like more pros to switch to this state.

  "Industrialists": nothing sacred. People’s wisdom speaks well of these: “He will correct the hunchbacked grave.”

This is a rough division into types of representatives of the class of computer attackers. Now we turn to the question: why are they doing this.

Indeed, why are viruses, trojans, dialers and other evil spirits written? One reason is the desire for self-affirmation. It is characteristic of representatives of the first and second type. One just needs to show his friends that he is “like that, real, cool kid”, the second - first of all, to raise the level of self-esteem. The second reason is to gain experience. Typical for beginners. After writing my first masterpiece, of course, I want to test it on someone - not on myself, in fact. So a certain number of new, not always very dangerous, viruses appear on the Web.

The next reason is the spirit of competition. Have you ever heard of hacking competitions? The last thing I knew took place in the summer. The Brazilian hacker group won (it turns out that not only their football is strong). The task was as follows: who will break the most sites. But I am sure that there is competition for the most sophisticated virus and the best keylogger.

Adrenaline is another reason. Imagine: night, the light of the monitor, fingers running around the keyboard, a breach in the security system was found yesterday, today you need to try to access the system and show your fellow administrator who the boss is in the house. Following this reason is the next - romance. But what, who likes to watch the sunset, who looks at the stars, and who writes viruses. How many people, so many tastes.

The reason for this is political or social protest. For this reason, most government sites, sites of political parties, print and online publications, as well as large corporations are hacked. You don’t have to go far for examples. Immediately after the outbreak of war in Iraq, attacks were launched on US government sites by dissatisfied with Bush’s policies, as well as on the site of the Arab newspaper Al Jazeera and a number of other Arab resources from the opposite side.

And perhaps the last reason is the ubiquitous money. For their sake, industrial hackers basically work, so to speak. By hacking into bank networks, they gain access to customer accounts. What follows will not be difficult to guess. Gathering information about any Web user through spyware, they further engage in commonplace blackmail. The actions that the “industrialists” are taking can be listed for a very long time. I just want to say once again that they are the full-fledged computer criminals, and you need to treat them like criminals.