Worms and Rootkits and Trojans

Worms and  Rootkits and Trojans

• Programs that infect other computers across a network

• Often exploit known vulnerabilities in software

• Keep all your software up to date to prevent infection

• Install on victims computer

• Allow attacker to access any information stored there

• Often also allow privileged access, so attacker can:

• run programs

• control webcams, microphones, etc.

• attack other computers

worms

A worm is a type of computer program that tries to spread by replicating itself from computer to
computer using a network connection (usually, but not always, the Internet). It will often attack a
computer by using known vulnerabilities (bugs) in the networking part of the operating system.
Worms often deliver a payload such as a trojan or backdoor, so can be very damaging to your
computer. Worms also often launch denial of service attacks and other remote threats, using your
computer as a “zombie” host to hide the attacker's identity.
To guard against worms, protect your computer by updating the operating system regularly (see
the section called “Patching and Updating”) and by keeping your virus protection up to date.

Rootkits and Trojans


These are perhaps the most damaging of all types of software attack, and certainly they are the
most difficult to detect and remove. A trojan (or trojan horse) is a type of program that runs
Phishing Emails
97
invisibly on your computer, but allows a remote attacker to log in or extract information from
your disks
Rootkits can also be used legitimately to provide privileged access to a computer by a trusted
third party, or to recover lost passwords or other data, though this is something of a grey area,
and is not generally considered good practice, due to the risk of abuse.
Recently, Sony used an adaptation of a rootkit to install mediaplayer software when a copyprotected
music CD is used on a PC. The intention was that though the CD could be played in a
normal CD audio player, when used on a computer (i.e. a device able to duplicate the disc) the
CD would appear to have errors, which could only be corrected using the installed mediaplayer.
Unfortunately, the player software was quickly broken into and used by attackers; Sony has since
withdrawn CDs using this mechanism