NWA-PCUG Newsletter Article, June 2009
Things, Thinglets & Thingassoes
By Jack Lewtschuk, Columnist,
Monterey Bay Users Group, PC (MBUG-PC), California
mbug-pc newsletter, January 2010
The Journal of the Tucson Computer Society, January 2010

Blacklion (at) royal.net (click to email author)

This article has been obtained from APCUG with the author’s permission for publication by APCUG member groups; all other uses require the permission of the author (see e-mail address above).

The Bad Guys are after Your Money

Well, that’s nothing new.

Just as knowing the “computer language” is good to assist communication when seeking help or offering help to others, so is knowing the definition of words to describe cybercrime.

Just to better understand the nomenclature of cyber assaults, one has to be able to understand the lingo. I researched the Internet (some very helpful “e-letters”) and came up with this handy list:

A piece of software that displays advertisements on a computer after the software is installed. Adware can be benign, as in the case of a free program that displays ads in a manner that is agreed upon in advance. Or adware can be a nuisance, displaying unwanted ads with no apparent way to remove the program. The nuisance variety is often silently downloaded along with some other desired software, such as a game or toolbar.

“Arbitrary Code Execution”
When a security vulnerability is discovered in a piece of software, sometimes it is said that it allows for “arbitrary code” to be executed on the machine. This really means that the vulnerability can be used to cause that program to execute ANY set of commands or instructions on that computer.

“Black Hat”
A “bad guy” or hacker who breaks into computer networks, creates viruses, sends spam, or uses unethical tactics to influence engine results.

“Ethical Hacker”
A “good hacker” who uses a variety of techniques to test the safety of a computer network or system software. Typically an ethical hacker (also known as a “White Hat”) is hired by a company to see if there are any flaws in its systems that might allow Black Hats to gain entry.

A collection of ordinary home and office computers that have been compromised by rogue software. The term “botnet” is short for “robot network” and describes the situation rather well. Computers that have been caught up in a botnet have been effectively taken over and can be used to perform almost any task by the person or persons who control the botnet. Botnets are controlled by criminals and other miscreants whose motives include spewing spam to sell products, operating financial scams, and crippling websites through coordinated attacks. (See “Denial of Service Attack”.)

“Buffer Overrun”
This is a flaw in a computer program that occurs when the length of a user input is not validated. For example, if a program is expecting a 9-digit social security number as input, it should discard any input beyond the 9th character. If the program blindly accepts a longer input string, it could “overrun” the input buffer, thereby trashing some other part of the currently-running program with the extraneous characters. In some cases, this flaw can be used to overwrite the existing program with code that comes from the input string. (See “Arbitrary Code Execution”.)

“Denial of Service Attack”
A concerted effort by one or more remote attackers that attempts to flood a web server or network with meaningless requests. A sustained, coordinated attack can render the target unable to service the legitimate users who are attempting to connect.

A method of taking advantage of a bug or security hole in a computer program. It is possible that a hole may be known to exist, but no exploit has yet been created to capitalize on it.

Any form of malicious software. This can include computer viruses, spyware, worms, trojan horses, rootkits, and other software that is deliberately harmful, destructive, or invasive.

A fix for a software bug or security hole. When a bug is discovered, often there is a race by software vendors to provide a patch before an Exploit is created. Patches must be applied to the affected computers in order to prevent exploitation of the flaw.

The act of stealing information using lies or deception as bait. Online scammers try to trick people into voluntarily providing passwords, account numbers, and other personal information by pretending to be someone they trust. An example of phishing is an e-mail that appears to be from a bank, asking recipients to log in to a rogue site that looks exactly like the real one. When the victim logs in, the operators of the fake site then have that person’s login credentials and can access his or her bank account.

A rootkit is a software tool (or a set of programs) designed to conceal files, data, or active processes from the operating system. Because of their ability to hide deep in the operating system, rootkits are hard to detect and remove. Although rootkits may not cause damage when installed, they are often piggy-backed with additional code written for the purpose of taking control of a computer, disabling certain functions, or spying on the user and reporting activities back to the rootkit creator.

Software that is created for the purpose of tricking people into downloading or purchasing it, when in reality it is either unnecessary, marginally useful, or outright dangerous. Online ads that display fake warnings such as “Your computer may be infected—click here to scan for viruses” or “ERROR! Registry Damage Detected—click to download Registry Cleaner” would qualify as scareware. Scareware programs often run a fake or cursory scan, then present the user with a list of hazards that must be corrected. Fixing these “problems” then requires the user to pay a fee for a “full” or “registered” version of the software.

The act of stealing credit or debit card information while a legitimate transaction is taking place at an ATM (Automatic Teller Machine). Skimming involves an unauthorized device that is attached to the card slot of the ATM, which reads the magnetic strip as the card passes through. A hidden camera may also be used to capture the victim’s PIN (Personal Identification Number).

Spyware is a type of malicious software designed to take action on a computer without the informed consent of the user. Spyware may surreptitiously monitor the user, reporting personal information to a remote site, or subvert the computer’s operation for the benefit of a third party. Some spyware tracks what types of websites a user visits and send this information to an advertising agency. Others may launch annoying popup advertisements. More malicious versions try to intercept passwords or credit card numbers.

“Trojan Horse”
A Trojan horse is a malicious program that is disguised or embedded within other software. The term is derived from the classical myth of the Trojan Horse. Such a program may look useful or interesting but is actually harmful when executed.

Examples may include web browser toolbars, games, and file sharing programs. A Trojan horse cannot operate or spread on its own, so it relies on a social engineering approach (tricking the user into taking some action) rather than flaws in a computer’s security.

A computer virus is a malicious self-replicating computer program that spreads by inserting copies of itself into other programs or documents, similar to the way a real virus operates. When the infected program or document is opened, the destructive action (payload) is repeated, resulting in the infection, destruction, or deletion of other files.

Sometimes the infected programs continue to function normally, albeit with the side effects of the virus; in other cases, the original program is crippled or destroyed.

A worm is a malicious computer program that is self-contained and does not need help from another program to propagate itself. It can spread by trying to infect other files on a local network or by exploiting the host computer’s e-mail transmission capabilities to send copies of itself to everyone found in the e-mail address book. Some even look in the cache of recently visited web pages and extract other e-mail addresses to target.

“Zero-Day Exploit”
An attack that tries to exploit unpatched security vulnerabilities. The term “zero day” derives from the fact that software vendors sometimes have a window of time to fix a problem before an exploit is developed or before news of a vulnerability is made public. But when the exploit already exists before a patch is released, the vendors have “zero days” to fix it because users are already exposed.

A computer that has been compromised and can be controlled over a network to do the bidding of a criminal or miscreant. Computers that have been caught up in a botnet are zombies and can be used by the controller of the botnet to send spam or participate in a coordinated denial of service attack.

Click here to return to top