The Life and Times of the virus: Let’s explore what it meant to be a virus before we get too far along. Simply put, a virus is a self-replicating application that attaches itself to other executable programs.
Many viruses affect the host as soon as they are executed; other lie in wait, dormant, until a predetermined even or time, before carrying out their instructions. What does the virus do then? Many potential actions can take place, such as these:
- Altering data
- Infecting other programs
- Replicating
- Encrypting itself
- Transforming itself into another form
- Altering configuration settings
- Destroying data
- Corrupting or destroying hardware
NOTE: Viruses are not restricted to the actions listed here and can easily perform a wide range of potential activities. The authors of malware are constantly developing and refining their crafts, so you must be ever vigilant in order to pick up the new variations.
The process of developing a virus is very methodical. The author is concerned with creating an effective virus that can be spread easily. The process occurs in six steps.
- Design—The author envisions and creates the virus. The author may choose to create the virus completely from scratch or use one of the many construction kits that are available to create the virus of their choice.
- Replication—Once deployed, the new virus spreads through replication: multiplying and then ultimately spreading to different systems. How this process takes place depends on the authors original intent. But the process can be very rapid, with new systems becoming infected in short order.
- Launch—The virus starts to do its dirty work by carrying out the task for which it was created (such as destroying data or changing a system’s settings). Once the virus activates through a user action or other predetermined action, the infection begins.
- Detection––The virus is recognized as such after infecting systems for some period of time. During this phase, the nature of the infection is typically reported to antivirus makers, who begin their initial research into how the software works and how to eradicate it.
- Incorporation––The antivirus makers determine a way to identify the virus and incorporate the process into their products through updates. Typically, the newly identified malware is incorporate into signature files, which are downloaded and installed by the antivirus application.
- Elimination––Users of the antivirus products incorporates the updates into their systems and eliminates the virus.
It is important to realize that this process is not linear; it is a loop or cycle. When step 6 is reached, the whole process starts over at step 1 with another round of a virus development.
NOTE: Why do people create viruses? There are a number of reasons, such as curiosity, hacktivism, showing off, and many others that may or may not make sense to an outsider. As a pentester, you may find that creating a virus is something you need to do properly test defensive systems.
