[:en]

Two weeks ago we explored lesser known malware, Trojans and worms, after 1985. This time around, we look at more recent threats, starting with zombies…

2003 Zombie, Phishing
The Sobig worm gave control of the PC to hackers, so that it became a “zombie,” which could be used to send spam. The Mimail worm posed as an email from Paypal, asking users to confirm credit card information.

2004 IRC bots
Malicious IRC (Internet Relay Chat) bots were developed. Trojans could place the bot on a computer, where it would connect to an IRC channel without the user’s knowledge and give control of the computer to hackers.

2005 Rootkits
Sony’s DRM copy protection system, included on music CDs, installed a “rootkit” on users’ PCs, hiding files so that they could not be duplicated. Hackers wrote Trojans to exploit this security weakness and installed a hidden “back door.”

2006 Share price scams
Spam mail hyping shares in small companies (“pump-and-dump” spam) became common.

2006 Ransomware
The Zippo and Archiveus Trojan horse programs, which encrypted users’ files and demanded payment in exchange for the password, were early examples of ransomware.

2006 First advanced persistent threat (APT) identified 
First coined by the U.S. Air Force in 2006 and functionally defined by Alexandria, Virginia security firm Mandiant in 2008 as a group of sophisticated, determined and coordinated attackers. APTs are equipped with both the capability and the intent to persistently and effectively target a specific entity. Recognized attack vectors include infected media, supply chain compromise and social engineering.

2008 Fake antivirus software
Scaremongering tactics encourage people to hand over credit card details for fake antivirus products like AntiVirus 2008.

2008 First iPhone malware
The US Computer Emergency Response Team (US-CERT) issues a warning that a fraudulent iPhone upgrade, “iPhone firmware 1.1.3 prep,” is making its way around the Internet and users should not be fooled into installing it. When a user installs the Trojan, other application components are altered. If the Trojan is uninstalled, the affected applications may also be removed.

2009 Conficker hits the headlines
Conficker, a worm that initially infects via unpatched machines, creates a media storm across the world.

2009 Polymorphic viruses rise again
Complex viruses return with a vengeance, including Scribble, a virus which mutates its appearance on each infection and used multiple vectors of attack.

2009 First Android malware
Android FakePlayerAndroid/FakePlayer.A is a Trojan that sends SMS messages to premium rate phone numbers. The Trojan penetrates Android-based smartphones disguised as an ordinary application. Users are prompted to install a small file of around 13 KB that has the standard Android extension .APK. But once the “app” is installed on the device, the Trojan bundled with it begins texting premium rate phone numbers (those that charge). The criminals are the ones operating these numbers, so they end up collecting charges to the victims’ accounts.

2010 Stuxnet
Discovered in June 2010 the Stuxnet worm initially spreads indiscriminately, but is later found to contain a highly specialized malware payload that is designed to target only Siemens supervisory control and data acquisition (SCADA) systems configured to control and monitor specific industrial processes. Stuxnet’s most prominent target is widely believed to be uranium enrichment infrastructure in Iran.

2012 First drive-by Android malware
The first Android drive-by malware is discovered, a Trojan called NotCompatible that poses as a system update but acts as a proxy redirect. The site checks the victim’s browser’s user-agent string to confirm that it is an Android visiting, then automatically installs the Trojan. A device infected with NotCompatible could potentially be used to gain access to normally protected information or systems, such as those maintained by enterprise or government.

2013 Ransomware is back
Ransomware emerges as one of the top malware threats. With some variants using advanced encryption that makes recovering locked files nearly impossible, ransomware replaces fake antivirus as malicious actors’ money-soliciting threat of choice.

Take note that information below is an extract from the Sophos Threatsaurus, compiled by Sophos, a security software and hardware company.

[:af]

Twee weke gelede het ons ondersoek ingestel na malware, Trojaanse virusse en wurms na 1985. Dié keer is dit meer onlangse bedreigings se beurt. Ons begin by zombies … 

2003 Zombies en Phishing
Met behulp van die Sobig-wurm kry krakers beheer oor rekenaars, verander dit in `n zombie en stuur daarmee gemorspos uit. Die Mimail-wurm kamoefleer homself as `n Paypal e-pos en vra gebruikers om kredietkaartinligting te bevestig. 

2004 IRC robotte
Kwaadwillige IRC (Internet Relay Chat) robotte word ontwikkel. Trojaanse virusse laai die robotte op rekenaars, laat dit aan `n IRC-kanaal verbind, sonder die gebruiker se medewete en kry beheer oor die rekenaars.

2005 Rootkits
Sony se DRM kopie-beskermingstelsel op musiek CDs, installeer `n rootkit, wat leêrs wegsteek sodat dit nie gedupliseer kan word nie, op rekenaars. Kuberkrakers skryf Trojaanse virusse om hierdie sekuriteit-swakplek te misbruik en `n versteekte back door te installeer.

2006 Aandeleprys-bedrog
Gemorspos wat aandele in klein maatskappye opjaag (pump-and-dump-gemorspos) raak die nuutste kubergevaar.

2006 Ransomware
Die Zippo en Archiveus Trojaanse virusprogramme word die eerste ransomware. Hulle enkripteer leêrs en eis `n losprys in ruil vir die wagwoord.

2006 Eerste moderne bedreiging (APT) identifiseer
APTs is die eerste keer in 2006 deur die Amerikaanse lugmag uitgewys. Hulle is toegerus met beide die vermoë en oogmerk om `n spesifieke teiken effektief en aanhoudend te teiken. Die gesofistikeerde, doelgerigte en gekoördineerde aanvalle word geloods geloods op media en verskaffingskettings en sluit sosiale manipulasie in.

2008 Vervalste anti-virus sagteware
Deur middel van bangmaak-taktieke word gebruikers oortuig om hul kredietkaartinligting te gee vir vervalste anti-virus produkte soos AntiVirus 2008.

2008 Eerste iPhone malware
Die US Computer Emergency Response Team (US-CERT) reik `n waarskuwing uit oor `n misleidende iPhone opgradering, die iPhone firmware 1.1.3 prep. As `n gebruiker die Trojaanse virus installeer, word komponente van die foontoepassing aangepas. As die virus verwyder word, word die toepassings wat aangetas is, daarmee saam verwyder. 

2009 Conficker haal die nuus
Conficker, `n wurm wat aanvanklik versprei word deur middel van verouderde rekenaars, veroorsaak wêreldwye mediadekking.

2009 Polimorfiese virusse is terug
Komplekse virusse maak met mening weer hul verskyning. Een van hulle is Scribble, `n virus wat sy kenmerke met elke infeksie verander en talle metodes gebruik om te versprei.

2009 Eerste Android malware
Android FakePlayer is `n Trojaanse virus wat SMSe na foonnommers stuur en Android slimfone indring omdat dit soos `n gewone toepassings lyk. Gebruikers word versoek om `n klein lêer van ongeveer 13 KB, met die gewone Android uitbreidingnaam .APK, te installeer. Sodra die “toepassing” op die toestel installeer is, begin die Trojaanse virus premium tarief foonnommers SMS. Diegene wat hierdie nommers bestuur, is deel van die kriminele netwerk en vorder die fooie vanaf die slagoffers se rekeninge in.

2010 Stuxnet
Die Stuxnet-wurm, `n hoogs gespesialiseerde malware program wat Siemens se kontrolebeheer- en datawerwingstelsels  (SCADA), verantwoordelik is vir die monitering van spesifieke industriële prosesse, teiken, word in Junie 2010 ontdek. Stuxnet se mees prominente teiken was blykbaar Iran se uraanverryking infrastruktuur.

2012 Eerste drive-by Android malware
`n Trojaanse virus, NotCompatible, word waargeneem. Dit lyk soos `n stelselopdatering, maar tree op as `n proxy herleier na `n ander webwerf. Die webwerf kyk of die gebruiker `n Android-toestel is en installeer dan die Trojaanse virus. `n Toestel wat met NotCompatible besmet is, kan gebruik word om toegang te verkry tot informasie of stelsels wat normaalweg beskerm is, byvoorbeeld dié van groot besighede of die regering. 

2013 Ransomware is terug
Ransomware is terug as een van die grootste malware bedreigings. Sommige variante gebruik gevorderde enkripsie wat die herwinning van gesluite lêers feitlik onmoontlik maak. 

Neem kennis dat al hierdie inligting geneem is van die Sophos Threatsaurus, saamgestel deur Sophos, `n sekuriteit sagte- en hardwaremaatskappy. 

[:]