The Social Graph of Malware

Viruses, to be effective, must spread themselves to other computer systems. We’ve already discussed replication by infecting other programs, which if copied and shared, would infect additional computers.

The most common of these, initially, was to read the address book (say from Outlook) and then the virus would “mail itself” to everyone in the address book.

Here are two of the most common avenues of approach in use today.

Email attachments: Since a virus depends on computer code that must be executed on your computer, they have to trick you into running a program. But it’s not always obvious to you what’s a program! One way to camouflage malware code is to embed it inside another program and attach that program to an email. When you receive the email and run this program, your computer is immediately infected^[1][3]. The attachment might look as if it’s a screen-saver, or a video file, for instance. Because this type of virus transmission depends upon opening an attachment, the best protection is to avoid opening attached files in messages from people you don’t know. [But, of course it’s more complex than this.]

Poisoned websites: There are other avenues of approach that involve exploiting flaws in the browser you use (Microsoft Internet Explorer is particularly targeted). All you have to do is open a web page that contains an object that is appropriately poisoned, and your computer will be infected. Anti-virus software manufacturers try to keep up with these exploits and protect you against them^[4], but there’s always a period of at least a few days where a particular exploit has been discovered by the bad guys but you’re not yet protected, and during that time you can still be infected. [How they trick you into going to the poisoned web site is another story.]

---

[1] There are lots of ways the code may be executed. One is simply to embed it in another program which is attached. A screen-saver program. A media player (“you’ve got to see this movie!”). Or as a macro^[2] inside a Microsoft Office file.

[2] A macro is a script (as opposed to actual computer instructions), that is executed by another program. MS Word and some other programs can read macros from data files, execute them, and do lots of things with dangerous side-effects on your computer.

[3] Protection: Anti-virus programs scan incoming email for viruses and delete or side-track attached files that contain suspicious code.

[4] Protection: Browser plug-ins contain lists of websites that have been scanned and found to contain malware. These lists may be updated as frequently as necessary (typically daily), and Google provides a site-scanning service as part of its search mechanism — as sites are indexed so they can be searched, Google is also examining the files for viruses and creating a blacklist of sites that contain possible malware, so they can warn you when you try to open a poisoned site.