Book description
Malicious mobile code is a new term to describe all sorts of destructive programs: viruses, worms, Trojans, and rogue Internet content. Until fairly recently, experts worried mostly about computer viruses that spread only through executable files, not data files, and certainly not through email exchange. The Melissa virus and the Love Bug proved the experts wrong, attacking Windows computers when recipients did nothing more than open an email. Today, writing programs is easier than ever, and so is writing malicious code. The idea that someone could write malicious code and spread it to 60 million computers in a matter of hours is no longer a fantasy.The good news is that there are effective ways to thwart Windows malicious code attacks, and author Roger Grimes maps them out inMalicious Mobile Code: Virus Protection for Windows. His opening chapter on the history of malicious code and the multi-million dollar anti-virus industry sets the stage for a comprehensive rundown on today's viruses and the nuts and bolts of protecting a system from them. He ranges through the best ways to configure Windows for maximum protection, what a DOS virus can and can't do, what today's biggest threats are, and other important and frequently surprising information. For example, how many people know that joining a chat discussion can turn one's entire computer system into an open book?Malicious Mobile Code delivers the strategies, tips, and tricks to secure a system against attack. It covers:
- The current state of the malicious code writing and cracker community
- How malicious code works, what types there are, and what it can and cannot do
- Common anti-virus defenses, including anti-virus software
- How malicious code affects the various Windows operating systems, and how to recognize, remove, and prevent it
- Macro viruses affecting MS Word, MS Excel, and VBScript
- Java applets and ActiveX controls
- Enterprise-wide malicious code protection
- Hoaxes
- The future of malicious mobile code and how to combat such code
Publisher resources
Table of contents
-
Malicious Mobile Code
- Preface
- 1. Introduction
- 2. DOS Computer Viruses
-
3. Windows Technologies
-
Windows Technologies
- Windows APIs
- Windows Booting
-
Windows Technologies Introduced with Windows 3.x
- Text mode to GUI mode booting
- Virtual machines
- Program information files
- Virtual memory and swap files
- NE executable
- Core Windows files
- Dynamic linking libraries
- Processes and services
- Initialization files
- SYSTEM.INI
- WIN.INI
- WININIT.INI
- Startup folder
- Registration database
- File type associations
- Hidden file extensions
- File types that can hurt
- Resource sharing
- Windows 3.x Startup Sequence
- New Technologies in Windows 9x
- Windows 9x Startup Sequence
- Windows NT
- NT 4.0 Boot Process
- New Windows Versions
- Summary
-
Windows Technologies
-
4. Viruses in a Windows World
- DOS Viruses on Windows Platforms
- Windows Viruses on Windows Platforms
- Signs and Symptoms of Windows NT Virus Infections
- Windows Virus Examples
-
Detecting a Windows Virus
- Unplug the PC from the Network
- Use an Antivirus Scanner
- Use AV Boot in Windows 2000
- Troubleshoot Any Boot Problems
- Run Scandisk
- Boot to Safe Mode
- Look for Newly Modified Executables
- Look for Strange Programs That Automatically Start
- Look for Strange Device Drivers
- Look for 32-bit Performance to be Disabled
- Unexpected System File Protection Messages
- Removing Viruses
- Removing Infected Files
- Preventing Viruses in Windows
- Future
- Risk Assessment -- Medium
- Summary
-
5. Macro Viruses
- Microsoft Office Version Numbers
- What Is a Macro Virus?
- Microsoft Word and Excel Macros
- Working with Macros
- Office 2000 Security
-
Macro Virus Technologies
- Word Infections
- Excel Infections
-
General Macro Virus Techniques
- Class module viruses
- Office disables macro copying commands
- MRU exploits
- Email viruses
- Add-in viruses
- Stealth macro viruses
- Encrypted and polymorphic macro viruses
- Dropping off a friend
- More external manipulation with VBA
- Startup directory files
- Random evolution
- Construction kits
- Cross-platform infectors
- Shiver cross-platform virus
- Language problems
- Macro Virus Examples
- Detecting Macro Viruses
- Removing Macro Viruses and Repairing the Damage
- Preventing Macro Viruses
- Risk Assessment -- High
- Summary
-
6. Trojans and Worms
- The Threat
- What Are Trojan Horses and Worms?
- Signs and Symptoms
- Types of Trojans
- Trojan Technology
- Becoming Familiar with Your PC
- Trojan and Worm Examples
- Detecting and Removing Trojansand Worms
-
Preventing Trojans and Worms
- Don’t Run Unknown Executable Content
- Scanners and Detector Programs
- Disable NetBIOS over TCP/IP
- Download the Latest IE and OS Patches
- Password-Protect Drive Shares
- Consider Limiting Email Attachments
- Rename or Remove Key Executables
- Change File Associations of Potentially Harmful Programs
- Use Firewalls
- Run Programs as a Nonadmin
- Risk Assessment -- High
- Summary
- 7. Instant Messaging Attacks
- 8. Internet Browser Technologies
-
9. Internet Browser Attacks
- Browser-Based Exploits
- Examples of Attacks and Exploits
- Detecting Internet Browser Attacks
- Removing and Repairing the Damage
- Preventing Internet Browser Attacks
- Risk Assessment -- Medium
- Summary
-
10. Malicious Java Applets
- Java
- Java Security
- Java Exploits
- Example Java Exploits
- Detecting Malicious Java Applets
- Removing Malicious Java Code
-
Protecting Yourself from Malicious Java Code
- Total Security: Disable Java
- Run Only Trusted Java
- Use an Antivirus Scanner
- Configure Stronger Browser Java Security
- Apply the Latest Security Patches
- Use the Latest Browser Version
- Know Your Java CLASSPATH
- Disable Plug-ins
- Remove Unneeded Applets
- Avoid Malicious Sites
- Be Aware of Social-Engineered Malicious Code
- Risk Assessment -- Low
- Summary
-
11. Malicious ActiveX Controls
- ActiveX
- ActiveX Security
-
ActiveX Security Criticisms
- ActiveX Has No Sandbox
- Safe for Scripting Vulnerability
- Buffer Overflows
- Users Can’t Be Trusted
- Authenticity Doesn’t Prevent Tampering
- Authenticode Is Only as Strong as Its Private Keys
- Weak Revocation
- No Granularity
- ActiveX Controls Are Registered to the Machine
- No Easy Way to See All Controls
- Security in Browser
- Malicious ActiveX Examples
- Detecting Malicious ActiveX Controls
- Removing and Preventing Malicious Active Controls
- Risk Assessment -- Medium
- Summary
-
12. Email Attacks
- Introduction
- Email Programs
- Email Exploits
- Detecting Email Attacks
- Removing Infected Email
-
Preventing Email Attacks
- Disable Scripting and HTML Content in Email
- Treat Unexpected Emails with Caution
- Keep Email Client Updated
- Run Antivirus Software
- Implement Outlook Security Patch
- Remove WSH Association
- Reveal Hidden File Extensions
- If You Use Web-based Email, Use Vendors Who Use Antivirus Scanners
- Modify Security on Outlook Clients
- Set Up Message Monitoring
- Risk Assessment -- High
- Summary
- 13. Hoax Viruses
-
14. Defense
- Defense Strategy
-
Malicious Mobile Code Defense Plan
-
How to Create a Malicious Mobile Code Defense Plan
- Get management to buy in
- Pick a plan team
- Pick an operational team
- Take a technology inventory
- Determine plan coverage
- Discuss and write the plan
- Test the plan
- Implement the plan
- Provide quality assurance testing
- Protect new assets
- Test Rapid Response Team
- Predefine a process for updating and reviewing plan
- The Plan
- Rapid Response Plan Steps
-
How to Create a Malicious Mobile Code Defense Plan
-
Use a Good Antivirus Scanner
- Checksums Versus Scan Strings
-
Traits of a Good Antivirus Scanner
- Fast and accurate
- Stability
- Transparency
- Runs on your platforms
- Customizable
- Scanner should protect itself
- Good cleaning rate
- Scanning archived files
- Heuristics
- Rescue diskette
- Automated updates
- Good technical support
- Proactive research
- Enterprise capabilities
- Logging
- Notification
- Email capabilities
- Antivirus Scanning Locations
- The Best Steps Toward Securing Any Windows PC
- Additional Defense Tools
- Antivirus Product Review
- Future
- Summary
- 15. The Future
- Index
- Colophon
Product information
- Title: Malicious Mobile Code
- Author(s):
- Release date: August 2001
- Publisher(s): O'Reilly Media, Inc.
- ISBN: 9781565926820
You might also like
book
The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System, 2nd Edition
While forensic analysis has proven to be a valuable investigative tool in the field of computer …
book
The IDA Pro Book, 2nd Edition
IDA Pro is a commercial disassembler and debugger used by reverse engineers to dissect compiled computer …
audiobook
Intentional Mindset
Some people seem to be born with a mental makeup that predestines them for success. But …
audiobook
Difficult Conversations
You have to talk with a colleague about a fraught situation, but you're worried that they'll …