{"id":55282,"date":"2018-08-29T13:20:26","date_gmt":"2018-08-29T20:20:26","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=55282"},"modified":"2024-05-20T11:25:31","modified_gmt":"2024-05-20T18:25:31","slug":"viruses-worms-and-spyware-yikes-a-look-at-malware-terminology","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/viruses-worms-and-spyware-yikes-a-look-at-malware-terminology\/","title":{"rendered":"Viruses, Worms, and Spyware\u2014Oh My! A Look at Malware Terminology"},"content":{"rendered":"

\"Malware<\/p>\n

When you read about computer security and malware, the terminology can be dizzying. You may feel that you’ve entered a world with some very strange words whose meanings you can only guess at. In order to help you understand malware, here’s a look at the most common terms used to describe malicious software that can harm your computer and mobile device, and threaten your security and privacy.<\/p>\n

Read on for a comprehensive look at\u00a0malware terminology, including viruses, worms, spyware, and\u00a0all the other dangers that threaten your Mac and your data.<\/p>\n

Malware Terminology<\/h3>\n

Malware<\/strong> is the blanket term for all mal<\/strong>icious software<\/strong>. It’s a convenient word, because it can be used for any of the categories I discuss below. Sometimes, a specific piece of malware can be made up of more than one of these categories, so using the blanket term is economical, and makes things easy to understand. In addition, some of these terms describe the way malware is distributed, others the way they propagate, and others the type of actions they perform. Users don’t always need to know exactly what type of malware has infected their device. Since certain terms used to name malware explain how the software is installed, this can be useful to understand how users can protect themselves. (See phishing, Trojan horse, etc.)<\/p>\n

What is a Computer Virus?<\/h3>\n

\"Virus<\/p>\n

A virus<\/strong>\u00a0on a computer is a specific type of malware that self-replicates, like the similarly-named infectious agents in humans and animals. Like a living virus, computer viruses attach themselves to hosts in order to move around and reproduce. The term virus indicates the means of replication, not the way the malware acts on a computer. Viruses used to travel on floppy disks and CD-ROMs; now they move around over the Internet, hiding inside files and applications, or spread via infected USB sticks. The term virus is often used as a blanket term, while the word malware is generally more appropriate. And, because historically viruses were the first type of malware that attacked personal computers, the security industry often uses the term “anti-virus” for software that detects and eradicates malware.<\/p>\n

Example<\/span>: A proof of concept virus, identified as\u00a0Multi\/Clapzok.A,<\/a>\u00a0targeted Windows, Linux and OS X 32-bit executables.<\/p>\n

What is a Worm?<\/h3>\n

\"Worm<\/p>\n

On a computer, a\u00a0worm<\/strong> is similar to a virus, in that it replicates itself. But unlike viruses, worms don’t need to be attached to other files. They often replicate over networks, rendering them particularly dangerous.<\/p>\n

Example<\/span>: The “Oompa-Loompa” worm, discovered by Intego on February 16, 2006<\/a>\u00a0and identified as OSX\/Oomp.A, targeted Mac OS X users via iChat instant messenger.<\/p>\n

What is a\u00a0Trojan Horse?<\/h3>\n

\"Trojan<\/p>\n

A Trojan horse<\/strong>, or simply Trojan<\/strong>, is a type of malware that is disguised as a useful piece of software or data file. It may actually perform actions on a computer that are or seem legitimate, but will install malware or perform malicious actions. A Trojan horse may also be legitimate software that has been altered to install malware. The name comes from the wooden horse that the Greeks made to attack the city of Troy. Obviously, the people in that city didn’t know that they shouldn’t open unsolicited attachments.<\/p>\n

Example<\/span>: The Ventir Trojan<\/a>, identified by Intego VirusBarrier as OSX\/Ventir, used a\u00a0dropper program (e.g. Trojan horse) to infect Macs.<\/p>\n

What is\u00a0Ransomware?<\/h3>\n

\"Ransomware<\/p>\n

Ransomware<\/strong> is a type of malware that locks a computer or hijacks a user’s files until a ransom is paid. It can be installed by a Trojan horse, or downloaded when visiting a malicious website. Ransomware is big business, with cyber-criminals making a lot of money from users who need to access their files. These people often have sophisticated fulfillment setups, with call centers and customer support to take payments. The best prevention against ransomware, other than using anti-malware software, is to regularly back up your files, so you always have a copy of them available.<\/p>\n

Example<\/span>: KeRanger<\/a>, detected by Intego VirusBarrier as OSX\/KeRanger, was the first major macOS ransomware.<\/p>\n

What is a Botnet?<\/h3>\n

\"Botnet<\/p>\n

A\u00a0botnet<\/strong>\u00a0is a network of computers whose access has been compromised, and that are controlled remotely. These individual computers are often called\u00a0bots<\/strong>\u00a0or\u00a0zombies<\/strong>. Botnets are generally used to send spam emails, or to launch denial of service attacks, where thousands of computers block a website or server by flooding that server with more requests than it can handle.<\/p>\n

Example<\/span>: iWorm, detected as OSX\/iWorm, is a sophisticated botnet that used Reddit<\/a>\u00a0to communicate to infected Macs.<\/p>\n

What is a Keylogger?<\/h3>\n

\"Keylogger<\/p>\n

A\u00a0keylogger<\/strong>, or keystroke logger<\/strong>,\u00a0is a type of malware that records all keystrokes that a user types on their computer. A keylogger can also be a hardware device, connected somewhere between a keyboard and a computer. Keyloggers can record all sorts of personal information, such as user names, passwords, credit card numbers, and personal documents such as emails and reports. Keyloggers can be useful to obtain information that can be later used to access a user’s online accounts, or for espionage.<\/p>\n

Example<\/span>: Spyware called\u00a0OSX\/Dockster.A<\/a> included a keylogger component that recorded an affected user’s typing.<\/p>\n

What is a Rootkit?<\/h3>\n

 <\/p>\n

\"Rootkit<\/p>\n

A\u00a0rootkit<\/strong>\u00a0is software that gives a malicious user “root access,” or total control over a computer. It can be installed via a\u00a0Trojan horse, through a\u00a0phishing\u00a0attack, or in other ways. A rootkit is a virtual\u00a0backdoor, and when installed on a computer, malicious users can control the computer and access all its files. Rootkits often mask their presence, or the presence of other\u00a0malware.<\/p>\n

Example<\/span>: A\u00a0Trojan dropper threat, detected by Intego VirusBarrier as OSX\/Crisis<\/a>,\u00a0would drop a rootkit to hide itself.<\/p>\n

What is a Backdoor, and What is a RAT?<\/h3>\n

\"Backdoor<\/p>\n

A backdoor<\/strong> is a way to access a computer or device without authentication. It may provide access to encrypted files without requiring a user’s password or passcode, or it may offer a means of accessing all the files on a computer. In some cases, manufacturers or developers create intentional backdoors so they can restore access to users who are locked out of a system, or to reset a device to factory settings.<\/p>\n

A RAT<\/strong>, short for remote administration tool or remote access Trojan, is a type of backdoor that gives an attacker similar remote control, data exfiltration, and spying capabilities, and often includes a keystroke logger.<\/p>\n

Example<\/span>: Mac malware\u00a0identified as OSX\/Eleanor<\/a>\u00a0masqueraded as a file converter app and would open a backdoor on infected Macs to steal data, execute code, and more. There are many examples of Mac RATs<\/a>, such as OSX\/CrossRAT (part of a global cyber-espionage campaign) and OSX\/EvilOSX (an open-source RAT that anyone can download and customize).<\/p>\n

What is Spyware?<\/h3>\n

\"Spyware<\/p>\n

Spyware<\/strong>\u00a0is malicious software that spies on a user. It may record keystrokes (i.e. keylogger) such as user names and passwords, track user activity on the internet, or activate the camera or microphone on a computer to see or hear what the user is doing.<\/p>\n

Example<\/span>: Spyware ported from Windows to OS X, identified as OSX\/XSLCmd<\/a>, included key logging and screen capturing capabilities.<\/p>\n

What is Adware?<\/h3>\n

\"Adware<\/p>\n

Adware<\/strong>\u00a0is software that causes advertisements to be displayed on a computer’s desktop or in a web browser, in order to generate income from these ads being shown. Some free software displays ads, and is technically not adware; the term is generally used for malicious software, which users cannot remove easily.<\/p>\n

Example<\/span>: A shady adware installer, detected\u00a0as OSX\/Okaz.A<\/a>, was discovered embedded in fake software downloaded from Softonic.<\/p>\n

Phishing\u00a0vs.\u00a0Spear Phishing<\/h3>\n

\"Phishing<\/p>\n

Phishing<\/strong>\u00a0occurs when cyber-criminals send emails that look exactly like those from real companies\u2014banks, PayPal, Amazon, Apple, and others\u2014to trick you into logging into your account through poisoned links. These links take you to websites that look real, but that are designed simply to harvest your credentials: your user names, passwords, and credit card numbers. Phishing may also take you to a website designed to install malware on your computer, such as ransomware, spyware, adware, and so on.<\/p>\n

Spear phishing<\/strong>\u00a0is a kind of\u00a0phishing<\/strong>\u00a0that is generally targeted at a specific person, and isn’t as random as phishing. It purports to come from someone you know: a business you work with, or a person in your contacts. Its goal is, like phishing, to obtain information about you, such as your user name and password to online accounts, or to your user account on your computer.<\/p>\n

Example<\/span>: Scammers found a way to generate a vast number of phishing websites<\/a> all designed to steal Apple IDs and passwords.<\/p>\n

Exploits\u00a0vs.\u00a0Vulnerabilities vs.\u00a0Zero-Day Flaws<\/h3>\n

\"Exploit<\/p>\n

An\u00a0exploit<\/strong>\u00a0is what malicious users leverage to take advantage of\u00a0vulnerabilities<\/strong>. It could be a piece of software or code injected into web pages that allows malicious users to gain access to a computer or to its files. Exploits often use vulnerabilities to install malware such as\u00a0Trojan horses,\u00a0ransomware, and more.<\/p>\n

A\u00a0vulnerability<\/strong>\u00a0is a flaw or weakness in an operating system or application that allows malicious users to gain access to a computer, or to infect files. A vulnerability could be the result of a bug or of poor design. Vulnerabilities in web browsers and plug-ins, such as Adobe Flash, are often targeted, since this software is so widely used.<\/p>\n

A\u00a0zero-day vulnerability<\/strong>\u00a0is one that has been recently discovered, but not yet corrected by a software developer. The term comes from the idea that the developer has\u00a0zero days<\/em>\u00a0to correct the vulnerability before malicious users begin to\u00a0exploit\u00a0it. Software updates are required as soon as possible to protect against these vulnerabilities.<\/p>\n

Malware vs. Vulnerabilities<\/h3>\n

The difference between malware and vulnerabilities is the difference between software made with the intent to cause harm, and the absence of security in a product. Malware is something you can see, interact with, and analyze, whereas a vulnerability is a weakness in software or hardware that can be exploited by malware or a hacker. That may sound a bit esoteric, so let’s break down the differences even further.<\/p>\n

Take a look at the below infographic for a more detailed look at the differences between malware and vulnerabilities:<\/p>\n

\"Malware<\/p>\n

No matter how savvy a Mac user is, any piece of malware is one password or vulnerability away from taking over your machine. Security is about layers, and one layer failing shouldn’t defeat all security;\u00a0therefore, it’s imperative to rely on multiple layers of protection with different properties. Regularly updating\u00a0third-party\u00a0software and passwords, scheduling routine backups, and running a trusted macOS security\u00a0solution with real-time antivirus protection should be an essential part of your security strategy.<\/p>\n

Mac Premium Bundle X9<\/a><\/strong> is the most complete Mac security solution providing\u00a0multiple layers of protection. It boasts\u00a0real-time antivirus scanning and\u00a0anti-phishing features, and\u00a0a two-way firewall with\u00a0anti-spyware measures to protect outgoing data sent from your Mac. It\u00a0even includes a Mac cleaner to optimize your Mac, and Intego Personal Backup for a layer of\u00a0ransomware protection. Mac Premium Bundle fortifies your Mac with layers of protection against all different types of malware.<\/p>\n

\n
This story comes to you as part of our Think Security<\/a> series helping students and parents prepare for back to school, with educational guides and Mac tips and tricks.<\/em><\/address>\n","protected":false},"excerpt":{"rendered":"

The difference between malware and a virus, worm or spyware (or even vulnerabilities) can be confusing. Here’s an in-depth look at malware terminology.<\/p>\n","protected":false},"author":46,"featured_media":56062,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[190,151],"tags":[323,30,505,419,52,159,3076,86,3073,102,109,517,319,3079,125,3085,132,160,144,150,982],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n