A piece of self-replicating code embedded within another program is called a

VIRUSES

A computer virus is defined as a self-replicating computer program that interferes with a computer’s hardware, software, or OS.

A virus’s primary purpose is to create a copy of itself.

Viruses contain enough information to replicate and perform other damage, such as deleting or corrupting important files on your system.

A virus must be executed to function (it must be loaded into the computer’s memory) and then the computer must follow the virus’s instructions.

The instructions of the virus constitute its payload. The payload may disrupt or change data files, display a message, or cause the OS to malfunction.

A virus can replicate by writing itself to removable media, hard drives, legitimate computer programs, across the local network, or even throughout the Internet.

18.6.17 Viruses

A computer virus is a malicious piece of executable code that is intentionally imported into a computer or a network and usually damages some aspect of the computer’s or the network’s operation. The virus may damage files, directories, other software, system configuration information, any one or all of the above. It may also make unauthorized use of information such as password files or email address books in order to gain access to other computers. In extreme cases, a computer system may need to be shut down and reconfigured from scratch. One of the major tasks of firewalls and other network security measures is to protect against viruses.

Fortunately, a virus can usually be recognized by characteristic patterns in its code or its behavior. Commercial software is available that detects and neutralizes incoming viruses and can be regularly updated as new viruses are developed. Virus detection has often depended on the fact that a virus had to be an executable file with an *.exe, *.vbs, *.pif, or *.com extension. More recently, however, macro viruses have taken advantage of the ability of certain programs (mainly Microsoft word and excel) to include small sets of executable instructions (macro viruses) in a document or spread sheet. A virus masked as one of these instructions sets as opposed to a separate file is much more difficult to detect and remove.

One of the most effective types of virus protection is user education. In a plant environment, the consequences of a virus infection are not only personal inconvenience and possible data loss, but also potential damage to the computer systems that run an operating plant.

Viruses

Much has been written about computer viruses – small pieces of code which have been maliciously inserted into floppy discs or other storage media to corrupt data – but at the time of writing there has been no study of viruses in real-time systems such as plant control programs. ‘However, it seems that asserting the dangers of virus infection in such systems is not an idle concern. Any disruption in the operation of such systems can have consequences more serious than the loss of accounting or technical data1.’

On the other hand, plant control software is harder to infect than other software as plant control computers are not usually connected to networks and, once set up, additional programs are added infrequently. For infection to occur, viruses would have to be present in the original software.

Computer viruses are like AIDS. Do not promiscuously share discs and data and you will not be infected2.

Some control software contains codes which will prevent it being used after 6 months if the bill has not been paid.

2.3.1 Case Study: The Duqu Virus

In November 2011, security researchers discovered a dangerous computer virus, dubbed Duqu. Similar to the Stuxnet attack described in Chapter 1, Duqu is believed to have been written by sophisticated attackers and takes advantage of a zero-day Windows vulnerability to gain access to embedded critical control infrastructure. As described in the Microsoft security advisory: “An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. The attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. We are aware of targeted attacks that try to use the reported vulnerability.”4 The National Vulnerability Database has assigned the vulnerability a severity rating of 9.3 (high),5 primarily due to its remote exploitability and the impact implied by malicious root access.

According to online reports, and corroborated by the aforementioned National Vulnerability Database entry overview, common Windows operating systems (XP, Vista, Windows 7, Windows Server) all execute the font-parsing engine in the kernel. In fact, the font parsing occurs in win32k.sys, the massive Windows system device driver module that has been the cause of many “blue screens of death” (BSOD) over the years.

Duqu’s authors crafted Word documents that would exploit the font-parsing vulnerability, enabling remote code execution at superuser privilege. As we have learned from many such vulnerabilities (Stuxnet being just one other case in point), once the attacker has an effective malware vehicle like this, it is a simple matter to socially engineer attack targets into opening the file. The attacker needs only one successful endpoint intrusion; the infected PC is then used as a launching point against electronics and computers accessible to the PC locally and across the network.

Duqu provides a wonderful example of the deleterious repercussions of monolithic operating system design. In some cases, win32k.sys consists of millions of bytes of device driver code executing in kernel/superuser mode.

Security and crime

Security has become a major issue in computer ethics, because of rampant computer crime and fraud, the spread of computer viruses, malware and spam, and national security concerns about the status of computer networks as breeding grounds for terrorist activity and as vulnerable targets for terrorist attacks. Computer security is the protection of computer systems against the unauthorized disclosure, manipulation, or deletion of information and against denial of service attacks. Breaches of computer security may cause harms and rights violations, including economic losses, personal injury and death, which may occur in so-called safety-critical systems, and violations of privacy and intellectual property rights.

Much attention goes to the moral and social evaluation of computer crime and other forms of disruptive behavior, including hacking (non-malicious break-ins into systems and networks), cracking (malicious break-ins), cybervandalism (disrupting the operations of computer networks or corrupting data), software piracy (the illegal reproduction or dissemination of proprietary software), and computer fraud (the deception for personal gain in online business transactions by assuming a false online identity or by altering or misrepresenting data). Another recently important security-related issue is how state interests in monitoring and controlling information infrastructures to better protect against terrorist attacks should be balanced against the right to privacy and other civil rights [Nissenbaum, 2005].

Definitions

Cybersecurity

the measures taken to prevent harmful attacks on patient data and health systems.

when a worm or other computer virus generates massive communication attempts to reduce/stop normal functions or drain the device’s battery.

harmful software that appears to be part of normal operations; similarity to existing programs often lead users to unintentionally activate an embedded program with varying degree of harm to the system.

measures, documents, and reports outputs throughout the software development lifecycle using a series of verifications derived from standards and technical reports to achieve regulatory adherence and operational capabilities according to the device manufacturer’s stated intended use.

24.4 Large-Scale Dynamics of Independent Cascades

At the scale of the network, the emergent behavior of information cascades displays several typical characteristics that are common in most diffusion processes, including epidemics and computer viruses. For instance, Fig. 24.1 shows the number of identified cases of Ebola during a recent crisis, the number of queries for “Pokemon go” when the game became viral, and the simulation of an independent cascade (see Model 24.4 in Section 24.3). All these diffusion processes exhibit similar behavior:

Explosive start: The cascade starts with an exponential increase and quickly reaches a nonnegligible amount.

Saturation point: After a sharp increase during the early phase of the diffusion, the process reaches a saturation point and comes to a halt. Note that, for information cascades, a residual activity may produce a linear slope after the end of the diffusion. However, we ignore this aspect in our study.

As a consequence, we focus on four main characteristics of interest to describe the large-scale dynamics of information cascades:

Existence: Is the cascade powerful enough to enter the explosive phase?

Saturation point: What is the final reach of the cascade?

Time for action: When is the explosion taking place?

Explosive rate: How fast is the initial exponential increase of the cascade?

These four characteristics are summarized in a simulated toy example on Fig. 24.1C. In the following sections, we provide estimates of these quantities depending on the diffusive properties of the process as well as the structure of the social network.

24.4.2 Long-Term Behavior of Independent Cascades

When the cascade is efficient enough to propagate to a large proportion of the network, it displays a sharp increase before saturating to a limit value. Although the precise value of this limit influence is hard to evaluate, several upper bounds have been provided and proven in the literature [12, 54]. We now provide such a result relating the long-term influence to the Hazard radius of the cascade.

Proposition 24.4

Let S0⊂Vbe a set of n0 influencer nodes, and ρH(F)the Hazard radius of a CTIC(F). Then, if ρH(F)>1, the long-term influence of S0 in CTIC(F)is upper bounded by:

(24.16)σ(S0)≤n0+γ(n−n0)+cnn0(n−n0),

where cn=η1−η, η=(1−γ)ρH(F)and γ ∈ [0, 1] is the unique positive solution of the equation:

(24.17)γ=1−exp−ρH(F)γ.

Proof

This result is also a consequence of Eq. (24.15) relating the expected activations Zi. See [12].

In essence, the proportion of active nodes after the cascade is negligible when ρH(F)<1, and at most γ when ρH(F)>1, where γ is defined by the implicit equation γ=1−exp−ρH(F)γ. Fig. 24.2 shows the proportion γ of Proposition 24.4 with respect to the Hazard radius ρH(F).

Fig. 24.2. Upper bound on the saturation point. Function γ defined in Eq. 24.17. When ρH(F)<1, the function is equal to 0, then increases and saturates to γ = 1 as ρH(F)tends to infinity.

Malware Technology

Malware is considered a portmanteau for malicious software, which is intentionally designed to cause damage to a computer, server, client, or computer network. The code is described as computer viruses, worms, Trojan horses, ransomware, spyware, adware, and scareware, among other terms.

The Internet has given us the good, the bad, and the ugly. Fig. 9.15 clearly shows the impact on our societal fabric. In fact, the impact is so globally ubiquitous. The most stupefying phenomenon is that within 30 years, the Internet existence, the Dark Web—like cancer—occupied most of the Web. Although the Deep Web will not take over all of the Internet, many applications of the surface Web will have private front ends with virtual pipelines into the Deep Web. As technology keeps producing new applications, malware hackers will be standing on the fence before developing new attack vectors and distributed payloads. So the Internet iceberg is split into three layers.

Surface Web: This is the portion where the content that the average users used it on daily basis. This is your Facebook.com, reddit.com, justice.gov, and harvard.edu.

Deep Web: Right below the surface of where the Internet iceberg meets the Deep Web. It comprises the same general hostnames as sites on the Surface Web, but along with the extension of those domains. This is the specific URL of your Facebook Messenger thread with a friend, or the Department of Justice's public archival material, or Harvard's internal communications system. The Deep Web is most of the Internet as a whole.

Dark Web: The dwindling portion at the very bottom of the iceberg is a subset of the Deep Web that is only accessible through software that guards anonymity. Because of this, the Dark Web is home to entities that do not want to be found. To expand on that visual, it is necessary to explain that the Dark Web contains URLs that end in .onion rather than .com, .gov, or .edu. The network that these .onion URLs reside on cannot be accessed with the same browser you use to access your Facebook messages, the justice department's archive, or your Harvard email account. You can use a simple Chrome or Safari to access these.

The Dark Web requires a specific software program—the Onion Router (the Tor browser)—to do the trick, and it offers you a special layer of anonymity that the Surface Web and the Deep Web cannot. As such, the Dark Web is a place for people and activities who do not want to be found through standard means. It is complete with illegal trade markets and forums, hacking communities, private communications between journalists and whistleblowers, and more.

2 Most widespread cybersecurity threats

Currently the most widespread cybersecurity threats are as follows (Carfagno, 2018):

Malware: Any program or file that is harmful to a computer user. Types of malware can include computer viruses, worms, Trojan horses, and spyware. These malicious programs can perform a variety of different functions such as stealing, encrypting, or deleting sensitive data; altering or hijacking core computing functions; and monitoring users’ computer activity without their permission. Today, over 90% of malware is delivered via email, typically hidden in the form of infected attachments or inconspicuous links. One well-intentioned employee, just clicking or downloading a malware, can cross also the best defensive moats. The average cost of a malware attack hovers around $2.4 million, according to research from Accenture. If that figure seems high, remember it considers the nearly 50 needed to identify, address, patch, and repair affected systems.

Phishing: Uses disguised email as a weapon. The goal is to trick the email receiver into believing that the message is something they want or need—a request from their bank, for instance, or a note from someone in their company—and, thus, to trick the user to click a link or download an attachment. What really distinguishes phishing is the form the message takes: the attackers personify a trusted entity of some kind, often a real or plausibly real person or a company the victim might do business with. In a global survey of IT decision makers, over half stated targeting phishing schemes were the top cybersecurity threat faced by their organisation. A single lost or stolen individual's record costs business $225. Yet, few cyberattacks only target one record. Over 74% of cyberattacked companies who experienced stolen data averaged 1000 files lost during their breaches.

Ransomware: Is a type of malware that prevents or limits users from accessing their system, either by locking the system's screen or by locking the users’ files unless a ransom is paid (Trend Micro (s.d.), n.d.). More modern ransomware families, collectively categorized as cryptoransomware, encrypt certain file types on infected systems and force users to pay the ransom through certain online payment methods to get a decryption key, as already shown in (Me, 2003). Ransomware attacks strike every 14 s. They are amongst the most rapid paced and prevalent of cybersecurity threats lodged at organisations, with the usual intent of shutting down servers or holding data and file hostage until a suitable ransom is paid. Without holistic data backup, ransomware can cause chaos. Between system downtimes, lost data, damaged data, patching systems, and cost to training employees to avoid repeat incidents, ransomware attacks cost businesses approximately $11.5 billion in 2019, without considering the cost of the ransom itself if companies opt to pay.

Fileless attacks (Carbon Black (s.d.), n.d.): They operate without using traditional executable files as a first level of attack like traditional malware. Rather than using malicious software or downloads of executable files as its primary entry point onto corporate networks, fileless malware often hides in memory or other difficult-to-detect locations. From there, it is written directly to RAM rather than to disk to execute a series of events or is coupled with other attack vectors such as ransomware to accomplish its malicious intent. Because fileless malware doesn’t write anything to disk like traditional malware does, it leaves no immediate trace of its existence behind and thus avoids detection by traditional antivirus security. Like ransomware, fileless attacks have seen an uptick in recent years. Nearly 77% of 2017’s known attacks were fileless. Fileless attacks cost businesses $5 million when fully executed. Other research indicates fileless attacks’ costs can be projected to be $300 per employee.

Human error: Unintended disclosures, accidental data deletions, or improper disposals of sensitive files all fall under human errors, a common yet under-the-radar enterprise threat. Human errors should focus the attention on terms like cybersecurity awareness and the data-handling policies. Accounting for 27% of data breaches, this type of cybersecurity threat costs businesses around $148 per compromised record and can take up to 196 days to uncover and reconcile.

Is a piece of self replicating code embedded within another program?

Is a program with a benign capability that conceals a sinister purpose?

Is a software application installed on a single computer that can selectively block network traffic to and from that computer?

Is the hijacking of an open web session by the capturing of a user's cookie?