The geneology of malware

Abstract

Malware used to be simple. Viruses, then worms, were written by individuals or small numbers of people and were discrete, static examples of malicious code. Now that the malware world has become commercially focused, however, malware writers have stepped up the battle to take control of PC platforms. This has resulted in a myriad of different malware types and variants that are used to create new attacks. Fernando de la Cuadra examines how these malware variants develop, exploring the ways that different malware groups adapt each other's code. Thanks to a graphing mechanism that visually illustrates the functional structure of malware variants, we can see how this constant adaptation leads not to refinement, but to additional complexity and inefficiency as malware groups trade off elegance for time to market. This development also sheds new light on best practice methods for spotting and neutralising new malware variants more quickly. A long time ago, viruses were very simple. Today's features, such as hiding the virus or giving it a very fast propagation system, were not considered necessary. In the early days viruses were spread by transferring a floppy disc from one computer to another, and at that time virus creators were really experts, creating incredible infection systems in just a bunch of kilobytes.