Malware - Evolving Technology

by Jack Barkstrom - Attorney, CPA

Origins - Simpler Times

It used to be that the only malicious technology encountered on the Internet was the occasional virus - or at least it seemed that way. Now it seems that malicious actors are everywhere - and the type of damage they can do has multiplied exponentially. Not only can intruders spy, they can encrypt files, hold businesses for ransom, and leave nasty messages. It's pretty bad when cyber insurance has become almost as familiar a term as auto insurance. Attackers now seem capable of, not just finding individuals to go after, but of bringing down entire electrical power grids, on a regional or national basis. Credit card information is being stolen. Businesses are becoming familiar with terms such as anti-virus software, multifactor authentication, instead of passwords, phishing attacks, and the difference between malware and ransomware. The calculation of risk has moved to the front of business considerations and the need for disaster and backup planning, along with restoration and data recovery planning have crowded out other considerations. None of this has been helped by the endless stories of cyber attacks and breaches.

Malicious Attacks

At first they were just annoying. Sometimes that was all they were - simple messages, such as "Hello." Others were annoying, as well as persistent, such as pop-ups advertising different products. Whether they really fell under the category of attacks is not clear. At times, in spite of their annoying presence, pop-up ads (adware) seemed to be helpful, offering suggestions about what shoes, boots, or jackets to buy. How could anyone know I was interested in new shoes, unless they were tracking me?

Sometimes the attacks would come in the form of threatening e-mails, or non-threatening, and seemingly informative, but suspicious e-mails. At other times the attacks would begin with visit to a malicious website. Sometimes you might have to click a link. At other times, the attacker could find vulnerabilities, without any clicking involved. Attackers could bring down a website by overloading it with thousands of visitors. They could collect informmation on visitors by hanging around a website and monitoring who was visiting.

Malicious and Destructive

The more sophisticated they became, the more damaging attacks could be. The messages became more malevolent and destructive. Some attacks defaced web pages or replaced them with pages created by the attackers. Some attacks did not alter websites, but bombarded them with so many requests or visits that the sites were overwhelmed and crashed, denying others access. Attackers began to steal or destroy information.

The problem was that computer technology was relatively new. What it promised, and even delivered, were easily observed benefits. Arithmetic, or any advanced math calculations could be done at lightning speed with new programs. The Internet could provide access and communication worldwide. Yet these capabilities blinded people to the potential dangers. New technologies had a tendency to do that. In the 1800s, it had been railroads. The ability to move freight and passengers was so impressive that the possibility of boiler explosions or derailments was not really considered - until they occurred. The automobile had a similar history. The promise of faster travel overshadowed the possibility of accidents - until they began to occur. Nuclear energy, once the atomic bomb had been invented, offered unlimited possibilities. It could be used to produce oil. In Colorado, a nuclear explosion was tried as an alternative to drilling. It seemed to work, until it was discovered that the product was too radioactive to be used.

Computer technology offered similar promises. Because of the ways it was developed, its vulnerabilities were present from the beginning. Computer hardware acted in response to commands from software and software followed the directions it was given from software programs. The ability to encrypt files and data was developed fairly early, although the idea behind ransomware using encryption was slow to catch on.

Computer programs, such as BASIC (Beginners All-Purpose Symbolic Instruction Code), came into existence (1964) before the introduction of the personal computer. What they could generate was impressive. There have always been individuals willing to experiment with new inventions. In the area of programming, there were challenges just learning some of the commands and results. Not all were good-intentioned - and there was nothing within the programs to prevent them from experimenting with malicious outcomes.

Pushing the Boundaries

The widespread use and success of remote system attacks seems to be a relatively recent phenomenon. However, the idea of exploiting computer vulnerabilities remotely did not suddenly occur yesterday. The benefits of computer technology were obvious from the beginning. But so were the pitfalls, less obvious or discussed because the programming skills and knowledge required were confined to a smaller group of individuals. Yet, the idea of pushing the boundaries beyond what was permitted or acceptable, began at the Massachusetts Institute of Technology (MIT) in 1961. Students in the Signals and Power subcommittee of the Tech Model Railroad Club (TMRC) began experimenting with the university's first interactive computer, the PDP-1. They worked with early programming tools and even coined the term "hacker" to describe the solutions they came up with and the results of their exploration.

Following the national network connections created by ARPANET in 1969, the hacker culture created at MIT, spread to other universities, such as Berkeley and Carnegie Mellon. The temptation to hack into established systems seemed irresistable. Steve Wozniak, the future co-founder of Apple, was expelled from the University of Colorado Boulder in 1969 during his freshman year for hacking into the university's mainframe computer system. He wrote and sent out prank messages.

In spite of the hacking culture created at MIT in 1969, interest in hacking remained fairly confined to a small for much of the 1970s, due to the state of technology, the lack of public awareness of computers generally, and the limited number of individuals interested in the computer field. Once exposed to the field of computer science, students quickly discovered more advanced capabilities, and armed with these tools, started to dream up more ambitious projects. In 1981, a group of German computer enthusiasts formed the Chaos Computer Club in Hamburg, Germany, They were able to hack into the German post office system and found a number of security vulnerabilies, which they exploited to transfer a sizable amount of money into their own bank accounts. In 1983, a group of teenagers who called themselves the 414s (after their area code in Milwaukee, Wisconsin), hacked into the the computer systems of the Memorial Sloan Kettering Cancer Center in Manhattan, New York and the Los Alamos National Laboratory in New Mexico.

Criminal Minds - New Tools and a World of Opportunity to Explore

Computer crime began much earlier. In 1973, a chief teller at Union Dime Savings Bank embezzled money from the bank by manipulating account data in the bank's comoputer system. (Intro to Crime, 29) In 1981 Ian Murphy (aka Captain Zap) and three of his friends broke into the AT&T computer system and changed the internal clocks used to charge customers. Discounted charges, usually assigned to late-night callers, were assigned to day-time calls.

In 1981, Kevin Mitnick, perhaps the most notorious career criminial in cyber history, begins his crime spree. In May, as a seventeen-year-old, he was arrested for stealing computer manuals from the switching center at Pacific Bell. In May 1982 he cracked the Pacific Telephone system and TRW and destroyed data on their computer systems. In December 1988, he steals $1 million in software from Digital Equipment Corporation, causing the firm $4 million in damages. In February 1995, he is arrested and charged with unauthorized access to the computers of a number of software manufacturers, cellular telephone manufacturers, Internet service providers, and educational institutions. In addition, he is charged with stealing, copying, and misappropriating proprietary software from companies such as Motorola, Fujitsu, Nokia, Sun, Novell, and NEC. At the time he is arrested, he is in possession of 20,000 credit card numbers.

In 1986, Herbert Zinn, a teenager living in New Jersey, who went by the hacker name Shadow Hawk hacked into the computer systems of AT&T to steal data, valued at $1 million. He went further than just the theft. He bragged on a hacker bulletin board that he had breached AT&T's security, had access to their files, and wished to create a Trojan horse to place on their network. On another bulletin board he posted the information required to gain access to the network so that others could use the information. He also broke into the Department of Defense. In 1989 he would be the first person convicted under the 1986 Computer Fraud and Abuse Act.

In June 1994, the first publicly revealed international bank robbery using the Internet takes place when a 23-year-old Russian, Vladimir Levin, steals about $10 million from Citibank, by transferring the money to international bank accounts. Another financial theft occurs in August the same year, when Justin Petersen steals $150,000 from Heller Financial.

In 1995, the National Science Foundation (NSF) decommissioned the NSFNET, the primary Internet backbone network, and privatized the network. Even before privatization the network had spread worldwide. It quickly gained popularity as a method of communication, but that convenience also made it vulnerable. In June 1982 members of the 414 gang broke into the military computers at Los Alamos. In 1983 a 19-year-old UCLA student used his personal computer to hack into the Department of Defense's international communications system. In September 1986, German hackers in a group known as the Data Travelers breach the computers at NASA and other top-secret computer installations around the world. Another German hacker group, Chaos Computer Club, in 1986, break into the computers at the German Nuclear Power Program during the Chernobyl nuclear crisis. In November 1987, they hack into NASA's computer network.

Sabotage - The Urge to Disrupt and Destroy

In July 1996 Tim Lloyd is accused of placing a software time bomb in the computer systems at Omega Engineering in New Jersey. When executed the malware destroys the company's computer network. The company was unable to manufacture goods through the summer of 1996. Damages were estimated at $12 million, with 80 employees losing their jobs. The Sony Hack, in November 2014, was an attack by hackers from North Korea against the servers of Sony Pictures Entertainment in Los Angeles, California. The hackers were trying to prevent the release of the comedy file The Interview, which depicted the assassiation of North Korean leader Kim Jong-un.

On November 24, 2014 a short video played on Sony's networked computers, from a group calling itself the Guardians of Peace. Soon after, malware erased data on approximately half of Sony's computers and servers, and also caused Sony's network to crash. Sony was effectively prevented from computer communications and was forced to build an entirely new network. The direct effects of the attack were an estimated $41 million. In addition, sensitive information was leaked in the days and weeks that followed.

The possibility of using malware as a remote weapon to physically destroy facilities was demonstrated in 2010, with the discovery of Stuxnet, a computer worm. It is believed that it destroyed 1,000 of the 5,000 centrifuges at Iran's Natanz nuclear facility. The centrifuges began to spin out of control, although to the technicians monitoring their operation, things appeared to be functioning normally. Although Stuxnet is reputed to have been installed remotely, it was likely installed on the network with a flash drive or USB, rather than remotely. Eventually, it began to spread to other countries in the Middle East. The ability to destroy or sabotage systems remotely had implications for electrical power grids, rail transportation networks, or other infrastructure in other countries.

Antivirus Software - The Cyber Battlefield Expands

The first antivirus was created in 1972 by Ray Tomlinson. Known as Reaper, it was designed to track down and delete a virus called Creeper, created in 1971, which only displayed a message: "I'm the creeper, catch me if you can." Intended more as a prank, it was not the most destructive program. Since the only network it appeared on was the ARPANET, it was relatively limited in distribution. The increase in virus attacks created a market for anti-virus programs. John McAfee founded the McAfee company in 1987 and the Symantic company released the Norton anti-virus in the 1990s. Kaspersky Lab enterd the market about the same time.

The Beginnings of a Global Virus Culture

Hacking into local university computers to leave messages or change grades, in comparison to current experience, seems almost benign. If hackers were looking to prove their worth, there was no shortage of challenges in the wider world. Just as mountain climbers were motivated by the idea of summitting Mount Everest, hackers were looking for the next great goal - pushing the boundary of what was possible. While not the first demonstration of hacker ingenuity, but perhaps the first to receive widespread notoriety, came in November 1988 when a graduate student at Cornell University, Robert T. Morris, programmed a nondestructive worm and released it over the ARPANET. The challenge for Morris was the security of computer network systems. Finding a way to overcome network security measures and break into supposedly secure systems would represent a real accomplishment.

The program worm Morris designed was intended to propagate itself across university, governmental, and military computers around the country, but was also programmed to hide itself, with features that made it difficult for programmers to detect and read. Morris also took steps to disguise his authorship. When he released it on November 2, 1988 he used a a computer at the Massachusetts Institute of Technology (MIT), rather than a computer at Cornell, where he was a student. The worm spread more quickly than expected. While it was not destructive, in the sense of destroying files, it did cause problems for about 6,000 of the 60,000 hosts connected to the network. The affected machines either crashed or became "catatonic." The estimated cost of dealing with the worm at each installation ranged from $200 to more than $53,000. In total, the damages were estimated to be $100 million.

Robert Morris and the Morris worm may have moved the boundaries of what was possible, but they did not move the boundaries of what was acceptable or permissible. Morris was found guilty of violating the Computer Fraud and Abuse Act and was sentenced to three years of probation, 400 hours of community service, fined $10,050, plus the costs of his supervision. Nevertheless, the Morris worm did move the boundaries for system security defense systems. They had proved inadequate and defenders were faced with their own challenge - come up with new defense measures, not only against the Morris worm, but against undiscovered methods of attack.

Ransomware - The Transformation of Encryption from Defender to Attacker

The evolution of computer systems and networks held great promise for society. Criminals quickly saw an opportunity to use the technology for personal gain, transforming the technology from a promising dream to a dreaded nightmare. Embezlers found they could manipulate computer accounts to steal funds. Those with remote connections saw an opportunity to rob banks by transferring funds remotely. Encryption promised to provide a level of protection for the confidentiality of communication. It didn't take long to discover that encryption had more destructive possibilities.

Demanding ransom payments for the return of something valuable, whether it was for kidnapped people or valuable objects was nothing new. Julius Caesar, some 2,000 years ago had been held captive by pirates, who demanded payment for his release. In the Middle Ages, the king of France, who had been captured by Spain, was held captive until France agreed to pay for his return. In the computer age innovative individuals soon realized that data was as valuable as people, when it came to making money, and could be held hostage in return for some form of payment.

The first documented use of encryption for ransom purposes, known as ransomware, came in 1989, with what became known as the AIDS Trojan or PC Cyborg virus. A biologist named Joseph Popp mailed 20,000 infected floppy disks to attendees of the World Health Organization's AIDS conference. The disks were labeled "Aids Information - Introductory Diskettes" and contained an interactive questionnaire which would activate the malware after approximately 90 reboots of the victim's machine. When activated the malware encrypted files located on the victim's machine. In order to restore the files, the victim was instructed to pay $189 to a PO box in Panama. Popp's use of a PO box was a clumsy, easily discovered, attempt at extortion, but his malware programming was not. Designing a program with multiple reboots required knowledge of programming, as did knowledge of both encryption and the programming involved in encrypting remote media.

Apart from the conference attendees, AIDS research facilities, and programmers, the AIDS Trojan did not attract much public notice, probably because the Internet was still in its infancy. Other than programmers or members of the military, few would be familiar with computer viruses or encryption. Little would change in 1996, when two researchers presented a paper at the IEEE Security & Privacy Conference, which suggested a proof-of-concept program to create malicious code. The proposed program incorporated public key encryption to encrypt victim computers and then use this capability to extort money from the victims. The paper suggested the terms cryptoviral extortion and cryptovirology as names for this type of attack. Cryptovirology was a term used to describe the combination of cryptographic technology and malware which would result in malicious software viruses.

Whether hackers paid much attention to the 1996 conference, cybercriminals did begin to use encryption in their malicious code around 2005, when ransomware programs, such as Krotten, Archiveus, and GPCoder emerged. Vundo came out in 2009. Vundo extorted monet using a tactic called scareware, which informed victims that their computers had been infected with a virus and asked for a ransom payment to decrypt the files. A 2017 variant was perpetrated by schemes known as Reveton and Kovter, which impersonated law enforcement agencies with a message that the victims had broken the law and thier computers had been locked. To unlock their computer they needed to pay the law enforcement agency. The ransom was collected using anonymous cash cards or in Bitcoin.

Between 2013 and 2015, new versions of ransomware emerged. They used stronger encryption methods, so it was more difficult to decrypt the encrypted files. The most notable names included Cryptolocker, Torrentlocker, Cryptowall, and Teslacrypt. Locky, Petya, and SamSam appeared in 2016. WannaCry/WCry, which was released in 2017, was the most serious. Of the $5 billion estimated total cost of ransomware attacks occurring in 2017, WannaCry caused $4 billion. WannaCry was first discovered in February 2017, which was followed by a second version released on May 12, 2017. The vulnerability was the Windows Server Message Block (SMB). The most common method of spreading involved the victim opening an infected file, usually by opening an e-mail attachment. The file would encrypt data found in files it attacked and at the end of the malware code it would append a message containing ransomware code instructions. Because of the level of encryption used, it was difficult to analyze and remove the ransomware files quickly. Encrypted data was effectively lost or destroyed. In addition, because of the widespread use of Microsoft Windows, the attack affected more than 230,000 computers in 150 countries. It is believed that North Korea may have been behind the attack.

Ransomware attacks declined in 2018, probably because anti-virus security measures were adopted and known vulnerabilties were fixed. In addition there were other, less high profile ways to make money. Cryptojacking allowed crypto mining - the use of computer resources in the background to mine for Bitcoin or other cryptocurrencies, withou attracting attention. Hackers did not stop using ransomware, but needed more sophisticated programs. Added security measures included a move to real-time analysis of network activity, more robust antivirus programs, and even worldwide surveillance of Internet activity. It added to security costs.

ARPANET - Computer Network Beginnings

In 1958, President Eisenhower created the Advanced Research Projects Agency (ARPA). The U.S. Department of Defense, in the early 1960s, assigned ARPA a project to design an electronic communications system with pathways to send information so that, as the fear was then of nuclear attack, if one of the pathways was knocked out, the network could still function. Although the project was created with the military in mind, the military network was never built. It took about 10 years to develop the technology, but finally in 1969, it established the system, called ARPAnet. While ARPAnet was the first national network, networks linking computers at a single location had been in use by 1964.

ARPA computer research did not stop, even with its military focus gone. The research was being done at different university locations across the U.S. The researchers began looking for a way to better communicate, so that they could provide information about their research to other researchers. The distributed network idea they came up with, called ARPAnet, was built around something called interface message processor (IMP), which connected computers at university research centers. Long-distance communication networks, such as telephone and radio, had a relatively long history, so the concept was not new. What was needed was a method tailored to computers.

Interface message processor (IMP) incorporated a technology called TCP/IP (transmission control protocol/Internet protocol), which had been developed at the National Science Foundation (NSF). Because there were a number of independent networks, it was necessary to create a common standard, which was successfully tested in 1977 and adopted in 1983. Instead of transmitting data in a single stream, like a radio wave or telephone call, messages were broken up into packets of data, known as packet-switching, containing a payload of computer message bits and bytes before transmission. The packet contained addressing/destination information, error correction code, and identification. The individual packets would be re-assembled by the receiving computer into the message which had been transmitted.

The Department of Defense (still involved in spite of having given up on a military network) in 1969 set up four "nodes" or locations for the ARPANET at university research centers. The four nodes were at UCLA, the Stanford Research Institute (SRI), the University of Utah in Salt Lake City, and UCSB (University of California Santa Barbara). When the network was set up, it was based on the packet-switching technology. The first test of the network was the transmission of the letter "L" sent from UCLA to the Stanford Research Institute. By 1972, ARPANET had expanded to 23 host sites.

ARPANET's public debut came in October 1972, at the First International Conference on Computer Communications (ICCC) in the Washington, D.C. Hilton. Electronic mail (e-mail) had been introduced in July 1972 as part of the File Transfer Protocol (FTP). By 1973, three-fourths of all traffic on ARPANET was through e-mail.

Even as the ARPANET was expanding host sites, it was still largely confined to large universities or organizations. There was potentially a growing market for access, but cost was a prohibitive factor. In response, in 1979 the National Science Foundation (NSF) created the Computer Science Network (CSNET). In order to connect, the networks needed to adopt TCP/IP as their standard. There was no formal gateway yet, but by 1982 there were enough networks adopting the standard, that the term "Internet" was used for the first time. In 1983 the gateway was set up by the NSF between CSNET and ARPAnet using TCP/IP as the common standard. This new network would be called the NSFNET. By the late 1980s it had become the primary Internet backbone. Although the internet term had been used as part of the transmission control protocol/internet protocol when ARPANET was set up in 1969, it was not used in the sense of the Internet as known today. The lowercase "internet" referred to the generic linkage of two or more networks. The capitalized "Internet" referred to the system built on the U.S. government's network "backbone."

To support the network, the NSF built a high-speed (56Kbps) backbone connecting five supercomputing centers. In 1991, the NSF lifted restrictions on the commercial use of the Internet. Commercialization was helped by the development of Hypertext Markup Language (HTML) in 1990/1991, by Tim Berners-Lee, a researcher at CERN, the high-energy physics laboratory in Geneva, Switzerland. HTML would transform text appearance from ordinary fonts to fonts with different colors and sizes. In 1991, the first Web browser was designed. In 1993, a browser named Mosaic included a feature that allowed users to load images to the Web, an improvement almost as important as HTML, since pictures were more exciting to view than print alone. In 1995, the NSF decommissioned the NSF backbone and the Internet backbone was privatized. Five large Network Access Points (NAPs) for the new backbone were established in Chicago, New Jersey, San Francisco, San Jose, and Washington, D.C.

Cryptography - The Search for Security

Cryptography, by one definition, is the practice of concealing the true meaning of language within a code that is unreadable to all except the intended recipient. Put another way, cryptography is the study of methods for encrypting (turning a message into unreadable code) and decrypting (translating a coded message back into an understandable message) a message. In simpler computer terms, cryptography is the technology of encoding information so that it cannot be read by an unauthorized person. Cryptanalysis is the study of ways to break codes. Cryptology is the combined study of both cryptography (creating codes) and cryptanalysis (breaking codes).

The need to encrypt data goes back thousands of years. The need to communicate commands or instructions was not limited to ancient armies, although it is associated with the military. Empires and cities, as well as armies, needed to communicate over long distances. Rulers needed to send instructions to their ambassadors and administrators, and receive reports and news in return. The Egyptians, around 2000 B.C. used hieroglyphics to decorate their tombs. Julius Caesar (100-44 B.C.) is credited with the creation or use of the Caesar cipher, which shifted alphabetic characters around to disguise the message.

The problem of communication over long distances has been summarized by what is known as the Byzantine generals problem. An army is trying to capture a large city and must communicate orders, such as the time of an attack, between its various parts. The problem is determining whether any commands are reaching the various commanders, and whether they are received as written. What if one of the generals doesn't receive a message, or what if there is a traitor and the original message is changed? The problem would seem to only apply to the ancient world. Wouldn't modern communication technology, such as the radio, solve the problem? They might solve problems caused by distance and time delays.

However, even the instantaneous communications of radio technology does not solve all problems. Transmissions can be intercepted and altered. There is still the need to verify the identity of the sender. There is also the problem of interception and eavesdropping. The enemy can learn of your plans and, with that knowledge, can act to counter them.

Modern governments and military were quick to understand the importance of keeping communications secret. The most famous recent example may be the German Enigma machine, used in World War II, although serious work on encryption and cryptography had begun in the 1920s.

Cryptographic work with applications for the Internet probably can be dated to around the 1960s, when the National Institute of Standards (NIST) researched the need for a protection standard. Dating the start is not exact, because it was not the sudden realization that computer technology required a unique encryption method. It was more of an understanding of the need to adapt existing knowledge as computer applications attained wider acceptance. In 1974, IBM offered an encryption algorithm, named Lucifer. It was modified by the National Security Agency (NSA), which it named the Data Encryption Algorithm (DEA). It became the U.S. national cryptographic standard - Data Enryption Standard (DES) in 1977 and an American National Standards Institute (ANSI) standard in 1978. In 1997, it was decided that a new standard was needed, with the result being the Advanced Encryption Standard (AES).

In spite of what was called an ANSI "standard" in 1978, there were alternative encryption frameworks developed, which sometimes were intended as replacements, or were developed for specific situations. Being able to encrypt data from plaintext - the original readable (by humans or computers) form - into ciphertext - the encrypted, unreadable form - was one thing. Converting encrypted date back into plaintext - decryption - was another. The total process of conversion from plaintext to encrypted and back into plaintext is termed a cryptosystem. Crucial to decryption is what is termed a "key," known as a cryptovariable.

Keys come in different forms. One classification method divides the cryptosystem between symmetric algorithms (encryption calculation programs) and assymetric algorithms. Symmetric cryptography uses the same key to encrypt and decrypt data. Symmetric keys are also called secret keys because the key must be kept secret by both the sender and the receiver. If keeping them secret is a problem, their advantage is that they are faster and, for large amounts of data, they are a better system. Depending on the algorithm used, they can be difficult to break.

Assymetric cryptographic systems use different keys for encryption and decryption. Asymmetric key systems are also known as public and private key systems, or public key systems, for short. Public key systems are made up of one public key, which can be known to anyone, and one private key, known and used only by the owner. Allowing a public key to be available to anyone seems counterintuitive to the concept of security. On the other hand, without the private key, the encrypted message cannot be read. A major disadvantage of private key systems is that they are slower and do not handle complex mathematical messages very well.

While key algorithm development for both symmetric and asymmetric systems follow similar, almost parallel paths, the algorithms used for each method are essentially independent. Because symmetric systems focus more on secrecy, especially important in a military or governmental context, they require more sophisticated algorithms. Asymmetric systems, because they combine both private and public aspects, with wider general use, have relied on different algorithms, with a different history. Asymmetric cryptography came later and was intended to address some of the shortcomings of symmetric systems - the growing market for secure methods of communication by, among others, the business community, were practically beyond the capabilities of secret systems. Too many people needed to use the system to keep it secret for long.

The Diffie-Hellman algorithm was one of the first asymmetric algorithms developed, although it worked by creating a symmetric (private) key between two users. The Rivest-Shamir-Adleman (RSA) algorithm was developed in 1978, about the time (1977-1978) when the DEA was being adopted as a standard. In some ways, it was similar to symmetric algorithms, but was difficult to break, because both the public and private keys used large prime numbers. Another innovation was the elliptic curve cryptosystem (ECC), which did not start with a specific number, but used points on an elliptic curve to derive the starting value for encryption, which made it difficult to easily decypher. It's main advantage was that it was more efficient than RSA or other asymmetric algorithms, saving computer resources.

The evolution of cryptosystems in the search for a more secure communication method, was matched by attacker efforts to find countermeasures to decrypt each new security measure. While crypto security measures could be analyized in an attempt to understand the code, there were other ways to carry out attacks. Social media attacks, where attackers tricked people into providing their cryptographic key material, were comparatively easier to carry out. All the energy put into developing new cryptographic systems was wasted if one social media attack was successful against one target. Even more discouraging, cryptography is just one security area, dealing primarily with messages and communication. Attackers had any number of other ways of attacking victims, unrelated to cryptography. Easier to carry out, the chances of success were greater than the likelihood of breaking a cryptographic code.

Malware, Ransomware, Viruses and Other Attack Types

Ransomware is only the latest headline-grabbing threat. Computer technology certainly made life more convenient. Sometimes it delivered as promised. Businesses were able to use math capabilities to compile and deliver reports. The spectacular achievements however, blinded many to the downsides. Internet access was expected to open up societies and promote democracy, but dictatorships found ways to use the technology available on the Internet to reinforce their control. The increase in wealth created by computers seemed a modern phenomenon. And yet, ancient societies were able to use the technology of the time to become wealthy. Those left out found ways to access this wealth, whether it involved theft or holding things or people for ransom. Julius Caesar, some 2000 years ago, was held by pirates in return for ransom. (Once the ransom was paid he was released. He re-paid them by returning and killed them.) The king of France, in the Middle Ages, managed to get captured by Spain in a battle, and was held there until the French managed to collect enough money to pay Spain for his return.

In some places, ransom demands have become more widespread, with a more sinister turn, including death threats if ransom is not paid, or not paid fast enough. Carrying out the threats has become commonplace.

Ransomware is still around as a threat, but attackers have found other methods easier to master, and just as profitable. Telephone or e-mail scams, used personal contact to trick victims into willingly sending then money or cryptocurrency. Malware was another threat, although it was a broad category, describing anything malicious, including ransomware. It could involve demands for money, theft of data, or data encryption, but it could also involve destructive attacks, meant to do as much damage as possible, sometimes with a revenge motive, sometimes with seemingly no motive at all.

Malware can be classified by the delivery method used. Some is delivered as an e-mail attachment, which is activated or downloaded to a computer, when the user clicks on a link in the attachment. Others can be delivered simply by visiting a website opening a web page. Some can still be delivered by USB and removable media. Attackers have had some success by dropping USB drives in the parking lots of targeted organizations on the chance that employees will insert them into their work machines. Some employees did just that. The Stuxnet worm in 2010 was spread using USB drives.

Spyware is another dangerous category. Some of it can be relatively benign, such as for enforcing copyright protection or displaying targeted advertisements. Key loggers, which can log keystrokes on a keyboard and transmit them to a remote operator. This may enable hackers to obtain passwords or credit card numbers. More sophisticated versions can transmit voice recordings and screen shots, as well as installing microphones and cameras.

Viruses are another broad category. They are programs which can replicate, or create copies of themselves, which can infect a computer or other computers. Depending on what other instructions are included or added in the program, they can perform different tasks. They can take measures to evade detection, such as renaming files they hide in, or can be instructed to remain dormant for a time. They can encrypt and decrypt data, as part of a ransom scheme, in which they are classified as ransomware.

Electronic mail, or e-mail, has proven to be one of the greatest vulnerabilities of computer systems, almost since its introduction on the ARPANET in 1971. The desire to be able to communicate instantly anywhere in a country or in the world was potentially one of the greatest markets to exploit. The telephone, since its invention, had demonstrated the strength of the potential market, even if the market was for nothing more than gossip. Like electricity, the demand was there, once the technology was available. Unlike other system and computer vulnerabilities, which require fairly technical skills, e-mail attacks were relatively easy to master and carry out.

Most e-mail attacks involve either unsolicited e-mails, known as spam or fraudulent schemes, carried out using "phishing" e-mails. Phishing attacks, a type of fraud, have become so common or widespread, with a number of different forms, that they have been given individual names. They rely on social engineering - Phishing scams, as a general category, are phishing e-mails, seemingly from a genuine source, such as a legitimate company, sent in bulk, which ask the victim to provide sensitive information, such as a password, or invite them to click on a link in an attachment. Spear phishing is a personalized e-mail targeting a specific individual, organization, or business. Whale phishing is a type of spear fishing which targets high-level employees, such as corporate officers or board members.

E-mail spoofing is a combination spamming or phishing attack which uses e-mails "forged" to look like they came from a legitimate source. The forging involves small changes in the header or e-mail address, such as a letter change or letter addition, or a change in the suffix - the organization name following the period in an e-mail - such as .com or .net. They can carry malicious attachments or instructions which, when clicked, will install malicious software.

Spam, or junk e-mail, is simply unsolicited, usually unwanted, e-mail, often involving advertising. It is often illegal, although granting permisssion may take it out of the unwanted category. A spammer is someone who sends out SPAM.

Viruses

Computer viruses - simple computer programs - are infamous for their ability to mimic their biological cousins - the organisms in nature which cause human disease. In that sense, computer viruses are capable of infecting software and computer systems. Computer viruses even operate like real viruses: They rely on the host application, and system activities to spread. In one sense, like any computer program, they cannot replicate or do anything on their on, if the program is not run. (Programs which cannot self-replicate are not considered "viruses," but it only takes a few lines of added code to give a program the ability to self-replicate.) Viruses may be reliant on other systems to replicate, but they are not exactly passive. They have potential capabilities for doing mischief, but those capabilities are only potential, if the program is not run. Once run, the potential capabilities can turn very malicious. It can include computer code which will delete files, display messages, encrypt files, reconfigure systems, and make copies of itself. While the trigger mechanism required to activate viruses may seem a high bar, there are no shortage of trigger mechanisms lying in wait. Simply turning on a computer and booting up a system can be enough. Opening or sending an e-mail may be enough.

Some viruses, such as WannaCry or the Morris Worm, have received their own names because of their novelty or destructiveness. Most however, are described or classified, by how they act, what computer areas or functions they target, or by some special attribute. Macro viruses are viruses written in Visual Basic or VBScript, using macros, mini-programs designed to automate tasks, generally used with Microsoft Office products. They infect and replicate in templates and within documents. They are common because they are easy to write and because Microsoft Office is a popular product. Boot sector viruses infect the boot sector and operate when a system boots up when started.

Stealth viruses use various methods to conceal their presence, such as by making an infected file appear to have a normal file size or by moving to a different location. Armored viruses use techniques, such as code compression or sections of innert code, which make it hard to analyze. Sparse infection viruses are intermittently active for short periods, remaining dormant most of the time and activating at random intervals. Multipartite (or multipart) viruses attack systems in multiple ways or attack more than one part of a system. They usually infect the boot system and also attack another area, such as specific files or a registry. Sometimes a term called a tunneling virus is used to describe a hiding technique used to hide their presence.

Polymorphic viruses are named for their ability to change form in order to avoid detection. They can combine a number of different characteristics, such as being both armored and multipartite. Other capabilities include the ability to encrypt parts of itself, sometimes using more than one encryption scheme for different parts. They can also change their own code, change the sequence of instructions, add noise or bogus instructions, along with the capability to produce hundreds or thousands of variations (or mutations). Even if virus scanners discover some variants, others may escape detection and remain active.

Script viruses involve files or instructions that can be embedded in other files or programs, such as HTML, and transferred. Since scripts are program instructions that are executed once activated, they can include malicious instructions including the installation of virus programs.

Bot malware is another vulnerability area. A "bot" is a short term for "robot." Bot malware is a form of "command-and-control" program which allows a hacker to remotely control hacked computers. If a large number of computers are controlled, they can become part of a botnet, which can be instructed to attack and overwhelm a single system, in a Distributed Denial of Service (DDoS) attack.

Other Attack Types

Back-door programs are programs which install an access capability for a hacker. Back-doors allow a hacker to gain entry to a system without having to go through an authentication process. They are not themselves viruses, although they may have been created using a virus.

Network eavesdropping, or sniffing, is a method of collecting information about a network by monitoring traffic going in and out of a network. Historically, it has required an attacker to breach a network in order to install a sniffer. The sniffing agent had to be inside the network in order to monitor network traffic. In order to work, the sniffer had to intercept transmitted packets. (Since the communication mechanism used today involves the transmission of small data packets, it is likely that any sniffing will require the interception of the packets themselves. Absent the creation of some new transmission method, that requirement is unlikely to change.) The difficulty, from an attacker's perspective, is that many security systems will detect sniffing activity and take measures to prevent it. There are network scanners, such as Wireshark and Nmap with more advanced capabilities. Whether their advanced capabilities are so advanced that they do not need to install a sniffer inside the network is unclear.

Requiring both a breach to install an inside network agent and actual packet interception for network eavesdropping to work would seem an impossibly high bar. Difficult maybe, but not impossible. Router attacks, which can misdirect traffic, have proven successful in the past, and only require the creation of a new attack opening. Packet interception attacks could be possible with a type of "man-in-the middle" attack, where the packet is intercepted and then forwarded. The greatest obstacle is speed. If the packet can be intercepted, copied, and then forwarded without any delay, it would not alert detection/protection systems. All that is needed is a high-speed computer and program. Like the breach, a difficult, but not impossible prospect.

Logic bombs are programs or strings of code designed to execute when certain conditions are met, such as on a specific date. In many cases they are intended to damaage computer systems or destroy data. They may or may not be installed using a virus. Some have been installed by disgruntled employees with access to a system.

Denial of service attacks generally involve botnets, ordered to attack a website, web page, or address. The number of requests become great enough to crash a system. While botnet attacks may be associated with installed bot malware on one system, the attack is not necessarily associated with the attacked system. The attack order may originate with almost any botnet, not necessarily the victim attacked.

How malware or attack methods are labeled may be helpful in trying to remember what they are and what they do, even how to combat them. It should be kept in mind however that the exploit market is wide open and new methods are likely to be coming on line at a faster-than-expected rate. Attack methodology may have achieved a kind of milestone when attackers are offering packages for sale in the form of Ransomware-as-a-Service (RaaS) or exploit packages are offered for rent on a monthly subscription basis, with an appropiately nameed exploit kit as a service (EKaaS).