Question

Describe a historic malware that impacted the world. Provide details of the impacts it had and how it worked.

Answer 1

ZEUS MALWARE:-

Zeus Virus (or Zeus Trojan malware) is a form of malicious software that targets Microsoft Windows and is often used to steal financial data. First detected in 2007, the Zeus Trojan, which is often called Zbot, has become one of the most successful pieces of botnet software in the world, afflicting millions of machines and spawning a host of similar pieces of malware built off of its code.

IMPACTS OF ZEUS MALWARE:-

  The Zeus Virus can do a number of nasty things once it infects a computer, but it really has two major pieces of functionality.

First, it creates a botnet, which is a network of corrupted machines that are covertly controlled by a command and control server under the control of the malware's owner. A botnet allows the owner to collect massive amounts of information or execute large-scale attacks.

Zeus also acts as a financial services Trojan designed to steal banking credentials from the machines it infects. It accomplishes this through website monitoring and keylogging, where the malware recognizes when the user is on a banking website and records the keystrokes used to log in. This means that the Trojan can get around the security in place on these websites, as the keystrokes required for logging in are recorded as the user enters them.

Some forms of this malware also affect mobile devices, attempting to get around two-factor authentication that is gaining popularity in the financial services world.

Originally, the Trojan only affected computers running versions of the Microsoft Windows operating system, but some newer versions of the malware have been found on Symbian, BlackBerry and Android mobile devices.

HOW IT WORKED:-

  The Zeus Virus has two main methods of infection:

• Spam messages
• Drive-by downloads

The spam messages often come in the form of email, but there have been social media campaigns designed to spread the malware through messages and postings on social media sites. Once users click on a link in the email or message, they are directed to a website that automatically installs the malware. Because the malware is adept at stealing login credentials, it can sometimes be configured to steal email and social media credentials, enabling the botnet to spam messages from trusted sources and greatly expand its range.

Drive-by downloads happen when the hackers are able to corrupt legitimate websites, inserting their malicious code into a website that the user trusts. The malware then installs itself when the user visits the website or when the user downloads and installs a benign program.