Malware惡意軟體

This topic describes malware.

本主題說明惡意軟體。

The Morris worm is often credited as the first internet-based worm. It was launched in 1988. It was named after its author, a graduate student at Cornell University. The author claimed that it was not written to cause any damage but instead to gauge the size of the internet. However, the worm did cause damage as systems could be infected multiple times. The more copies of the worm running on a system, the greater drain of resources it caused, potentially making systems unusable. The worm was released from a network belonging to the Massachusetts Institute of Technology to disguise its origin. It had the capability of exploiting multiple vulnerabilities in sendmail, finger, and rsh/rexec. It could use the local C compiler on systems to compile code. It utilized the words file on Unix systems for dictionary attacks against weak passwords. Potentially the most interesting aspect of this worm is that it was written so long ago. The use of multiple attack vectors and the use of resources available on the compromised systems were quite ingenious for the first worm. The security professional must understand that the ingenuity brought to malware development has continued to compound over the decades.

莫里斯蠕蟲（Morris worm）通常被認為是第一個以網際網路為傳播媒介的蠕蟲，於 1988 年發動。它以其作者（康乃爾大學一名研究生）命名。作者聲稱撰寫此蠕蟲並非為了造成損害，而是為了估算網際網路的規模。然而，由於系統可能被重複感染，這個蠕蟲確實造成了損害。系統上執行的蠕蟲副本越多，所耗用的資源就越多，可能使系統變得無法使用。該蠕蟲是從麻省理工學院所屬的網路釋出，以掩飾其來源。它能夠利用 sendmail、finger 及 rsh/rexec 中的多個弱點。它可以使用系統上的本機 C 編譯器來編譯程式碼。它利用 Unix 系統上的字典檔，對弱密碼進行字典攻擊。這個蠕蟲最有趣的一點，或許是它撰寫的年代如此久遠。使用多種攻擊向量，以及利用已入侵系統上可用資源的手法，對於第一個蠕蟲來說相當巧妙。資安專業人員必須了解，惡意軟體開發的巧思在數十年間持續不斷加深累積。

Internet worm production was especially prolific between 1999 and 2004. Examples of worms from this period include Melissa, ILOVEYOU, Anna Kournikova, Code Red, Nimda, SQL Slammer, MyDoom, and Sasser. Details for any of these worms can be found with simple internet search queries. In general, these worms were mostly about wreaking havoc. Their targets were not directed as they victimized any vulnerable system. They consumed resources such as networking bandwidth, system CPU and memory, and IT resources to eradicate them.

1999 年到 2004 年間，網際網路蠕蟲的產出特別多產。這段時期的蠕蟲範例包括 Melissa、ILOVEYOU、Anna Kournikova、Code Red、Nimda、SQL Slammer、MyDoom 及 Sasser。透過簡單的網路搜尋即可找到這些蠕蟲的詳細資訊。整體而言，這些蠕蟲大多以造成破壞為目的。它們的目標並非精準鎖定，而是危害任何有弱點的系統，消耗網路頻寬、系統 CPU 與記憶體，以及用來清除它們的 IT 資源。

Since the early 2000s, much has changed about worms in particular and network security in general. The Conficker worm, first identified in late 2008, was very different. It was very stealthy and resulted in a botnet with millions of infected machines. The worm mutated from version to version with ever-changing propagation and update strategies. The Stuxnet worm was discovered in June 2010. It was designed to attack industrial programmable logic controllers. It reportedly targeted the country of Iran’s nuclear program and was successful in destroying approximately one-fifth of the country’s nuclear centrifuges.

自 2000 年代初期以來，蠕蟲以及整體網路安全都發生了許多變化。Conficker 蠕蟲於 2008 年底首次被發現，情況大不相同。它非常隱密，並形成了一個擁有數百萬台受感染機器的殭屍網路。這個蠕蟲隨著版本演進而不斷變異，其傳播與更新策略也不斷改變。Stuxnet 蠕蟲於 2010 年 6 月被發現，其設計目的是攻擊工業可程式邏輯控制器。據報導，它鎖定了伊朗的核子計畫，並成功摧毀該國約五分之一的核子離心機。

More recently, with the rise of cryptocurrencies, ransomware has risen in prominence. Ransomware is an attack that encrypts the data on your local drives and the shared network drives, making it unusable without a key. The ransomware then presents means of buying the encryption key from the attackers, usually utilizing cryptocurrencies. An example of a ransomware attack is the WannaCry cryptoworm, which was introduced in May 2017.

近年來，隨著加密貨幣的興起，勒索軟體（ransomware）也日益盛行。勒索軟體是一種攻擊手法，會加密你本機硬碟及共用網路磁碟機上的資料，使其在沒有金鑰的情況下無法使用。之後，勒索軟體會提出向攻擊者購買解密金鑰的方式，通常透過加密貨幣進行。WannaCry 加密蠕蟲即為勒索軟體攻擊的一個例子，於 2017 年 5 月推出。

Malware is commonly utilized by advanced persistent threats (APTs), a set of continuous hacking processes targeting a specific entity, often with a specific goal. Some characteristics of APTs are obvious from the name. They are advanced; the attackers have the most advanced intelligence systems and techniques at their disposal and will use what is optimal for each step. They may utilize commonly available security tools when they are sufficient, but they may also discover and exploit zero-day (unpublished) vulnerabilities when necessary. They are also persistent. The attackers focus on their goal. They do not cash in on short-term opportunities. Instead, they maintain discreet access, slowly but surely infiltrating deeper into systems until their objectives can be met.

進階持續性威脅（APT）經常利用惡意軟體，這是一組針對特定目標、且通常帶有特定目的之持續性駭客攻擊流程。從名稱即可看出 APT 的一些特徵。它們是「進階的」；攻擊者掌握最先進的情報系統與技術，並會針對每個步驟使用最合適的手段。在常見的安全工具已足夠時，他們也可能使用這些工具，但必要時也會發掘並利用尚未公開（零日）的弱點。它們也是「持續性的」。攻擊者專注於自身目標，不會為了短期機會而輕舉妄動。相反地，他們維持隱密的存取權，緩慢但穩步地滲透系統，直到達成目標為止。

Each of these steps is taken very stealthily, with the goal of evading detection and maintaining a presence.

以上每個步驟都會非常隱密地進行，目的是躲避偵測並維持存在。