Malware for Profit: Spyware, Botnets, Keystroke Loggers, and Dialers

During the 1980s and 1990s, it was usually taken for granted that malicious programs were created as a form of vandalism or prank. More recently, the greater share of malware programs have been written with a financial or profit motive in mind. This can be taken as the malware authors' choice to monetize their control over infected systems: to turn that control into a source of revenue.

Spyware programs are commercially produced for the purpose of gathering information about computer users, showing them pop-up ads, or altering web-browser behaviour for the financial benefit of the spyware creator. For instance, some spyware programs redirect search engine results to paid advertisements. Others overwrite affiliate marketing codes so that revenue is redirected to the spyware creator rather than the intended recipient.

Spyware programs are sometimes installed as Trojan horses of one sort or another. They differ in that their creators present themselves openly as businesses, for instance by selling advertising space on the pop-ups created by the malware. Most such programs present the user with an end-user license agreement that purportedly protects the creator from prosecution under computer laws.

Another way that financially-motivated malware creators can profit from their infections is to directly use the infected computers to do work for the creator. The infected computers are used as proxies to send out spam messages. A computer left in this state is often known as a zombie computer. The advantage to spammers of using infected computers is providing anonymity, protecting the spammer from prosecution. Spammers have also used infected PCs to target anti-spam organizations with distributed denial-of-service attacks.

In order to coordinate the activity of many infected computers, attackers have used coordinating systems known as botnets. In a botnet, the malware logs in to an Internet Relay Chat channel or other chat system. The attacker can then give instructions to all the infected systems simultaneously. Botnets can also be used to push upgraded malware to the infected systems, keeping them resistant to antivirus software or other security measures.

It is possible for a malware creator to profit by stealing sensitive information from a victim. Some malware programs install a key logger, which intercepts the user's keystrokes when entering a password, credit card number, or other information that may be exploited. This is then transmitted to the malware creator automatically, enabling credit card fraud and other theft. Similarly, malware may copy the CD key or password for online games, allowing the creator to steal accounts or virtual items.

Another way of stealing money from the infected PC owner is to take control of a dial-up modem and dial an expensive toll call. Dialer software dials up a premium-rate telephone number such as a U.S. "900 number" and leaves the line open, charging the toll to the infected user.

Exercise 43. Answer the following questions.

1. Has the greater share of malware programs been written as a form of vandalism or prank more recently?

2. What are spyware programs produced for?

3. What are spyware programs sometimes installed as?

4. How can financially-motivated malware creators profit from their infections?

5. What is a zombie computer?

6. What systems are used by attackers in order to coordinate the activity of many infected computers?

7. What are botnets used for?

8. What is the principle of a key logger operation?

9. What is the other way of stealing money from the infected PC owner?

Exercise 44. Write the verbs related to the following words. Translate them.

Logger, dialer, behaviour, advertisement, agreement, prosecution, infection, directly, spammer, resistant, recipient.

Exercise 45. Make up questions to the underlined word combinations.

1. Malicious programs were created as a form of vandalism or prank.

2. Spyware programs are commercially produced for the purpose of gathering information about computer users.

3. Some spyware programs redirect search engine results to paid advertisements.

4. Other programs overwrite affiliate marketing codes.

5. They differ in that their creators present themselves openly as businesses.

6. Another way that financially-motivated malware creators can profit from their infections is to directly use the infected computers to do work for the creator.

7. The infected computers are used as proxies to send out spam messages.

8. Spammers have also used infected PCs to target anti-spam organizations with distributed denial-of-service attacks.

9. The attacker can then give instructions to all the infected systems simultaneously.

10. Dialer software dials up a premium-rate telephone number such as a U.S. "900 number" and leaves the line open, charging the toll to the infected user.

Exercise 46. Memorize the following words and word combinations:

data-stealing malware – шкідливі програми, що крадуть дані (інформацію)

divest – позбавляти (прав, повноважень, власності)

proprietary - приватний

monetizing – перетворювати в гроші

underground – таємний, нелегальний, секретний, підпільний

content security threat – загроза інформаційному наповненню

fall under the umbrella – тут: стосуються цієї теми

keylogger – логер клавіатури

bot - (скорочено від robot) - мережевий агент-робот (програма, що автономно вирішує задачі)

phishing – фішинг (різновидність Інтернет-шахрайства -випитування конфіденційної інформації за допомогою запитів, що мають вигляд офіційних листів)

DNS – 1) Domain Name System - служба імен доменів;

2) Domain Name Server – сервер доменних імен

poisoning – тут: зміна, псування, викривлення

SEO – search engine optimization - оптимізація пошукових систем

proxy - проксі-сервер, віддалений комп’ютер, що виконує роль кешу; довірений, вповноважений

trace– слід, признак

routinely – щодня, регулярно, як заведено

flush – вимикати(ся) з роботи, скидати на диск (вміст файлових буферів)

drive-by download process – процес автоматичного завантаження непотрібної програми в комп’ютер

host - приймати, містити

temporary - тимчасовий

rogue - некерований

frequently - часто

extend - розширювати

multiple – складний, різноманітний, чисельний

thwart– руйнувати, заважати, перешкоджати

Intrusion Detection Systems (IDS)– система виявлення (мережевих) атак

perceivable - відчутний

anomaly – відхилення від норми

stealthy – непомітний, таємний, скритний

in terms of – в (якихсь одиницях)

decryption – декодування, дешифрування

keystroke – хід клавіші, натискання клавіші

screenshot – моментальний знімок екрану

Data Loss Prevention(DLP) – попередження втрати даних

leakage protection – захист від втрати

hinge - петля

metadata – метадані, (дані з описом інших даних)

tagging – маркування, тегування (супроводження даних тегами)

tag – маркувати, розставляти теги

miscreant – злодій, негідник

port – переносити, адаптувати

incident- випадок

spoof – обманювати, вводити в оману

covertly - таємно

upload – завантажувати у віддалений комп’ютер (в головний комп’ютер)

account name – реєстраційне (облікове) ім’я

DNS server - сервер служба імен доменів

credentials – мандат (обліковий запис з параметрами доступу користувача, сформований після його успішної аутентифікації)

masterminde a ring – керувати злочинним угрупуванням

cybercriminal – кіберзлочинець, кіберзлочинець, комп’ютерний злодій

craft – виготовити, створити

plant – встановлювати, розміщувати, ховати

hit - вразити

class-action – колективний позов

law suit – судовий процес

approximately - приблизно

Exercise 47. Read and translate the text.