INTRODUCTION.

Advanced intelligent malware is both a tool for carrying out cyberattacks (both offensive and defensive), and a cyber threat (to offensive malware, as in the case of defensive malware, and to our humanity, as in the case of defensive malware). It is also a cyberweapon that can be of two types: offensive (malicious, as in the case of offensive malware) or defensive (neutralizing, mitigating, hunting, and blocking all attempts at cyberattacks in general, as well as those of offensive malware in particular), with unprecedented dynamism (as in the case of defensive advanced intelligent malware or DAIM/MIAD). Whether we like it or not, offensive malware is embedded in our connected digital society. It appears in a wide variety of increasingly hidden forms, such as spyware/creepware, time bombs, botnets, spam/phishing emails, web browser hijackers, Trojans, worms, viruses, rootkits, backdoors, adware, infected websites, some public USB mobile phone chargers, and so on.

CHARACTERIZATION OF THE DIMENSIONS OF OFFENSIVE MALWARE.

Offensive malware cyberattacks everything; nothing and no one is spared, from people, animals, the environment, software, firmware, hardware, infrastructure, telecommunications (such as SWIFT (Society for Worldwide Interbank Financial Telecommunication), an effective tool for integrating services like interbank payments, investments, transfers, foreign trade, checks, etc.), traffic, vehicles, healthcare, industry, OT, IT, satellites, IoE, etc. An example of its implementation in the field of cybersecurity is MIAD (Advanced Defensive Intelligent Malware), designed with AI, cyber-resilience, adaptability, autonomy, self-control, update capabilities, etc., to neutralize any attempt at malicious micro-actions by offensive cyberattacks originating from any type of malicious entity (offensive malware, AI bots, people, etc.).

In the ObservaCiber report (ONTSI/National Observatory of Technology and Society and Incibe) for the last quarter of 2021 in Spain, only one in four (25%) companies had implemented a cybersecurity program/formal cybersecurity policy in the previous twelve months. According to PwC's 25th Annual Global CEO Survey, cyber risks (such as cyberattacks that can impact innovation and sales) top the list of senior management concerns at 49%. A global study by Trend Micro and Sapio Research found that 90% of IT managers believe organizations compromise cybersecurity in favor of other objectives (digital transformation, productivity, etc.), and 49% of respondents stated that cyber risks continue to be treated as an IT problem rather than a business/industrial risk. The dimensions of offensive malware can be observed from different perspectives. For example, from the point of view of impacts, we can identify: (1) Impact (on resources and information) due to cyberattacks in general and those due to offensive malware in particular. These can be characterized as: (i) Discovery. Of entities to act upon. Discovering unknown information when a scanning tool probes for data; this discovered information can be used to launch malware cyberattacks against a specific target. (ii) Disclosure. Information, data, intelligence, etc. Disclosure of information typically gives malware insight into information to which it does not normally have access. The disclosure of unauthorized information can lead to other types of compromises. (iii) Destruction. Data, people, resources of all kinds, etc. The destruction of information usually occurs when malware has caused file deletion or the removal of access. Destruction is one of the greatest impacts since it involves the deletion of the file or the removal of information from the victim. (iv) Distortion. Communications, reality, etc. Information distortion typically occurs when a cyberattack has caused a file modification. When a malware cyberattack involves distortion, it changes the data within a file or modifies the victim's information. Distortion can generate misinformation. (v) Disrupt. Equipment, software, people, etc. (vi) Interrupt. Processes, communications with packet flooding, RF jamming, etc. A service interruption is usually due to a DoS/DDoS type cyberattack. When a malware cyberattack involves interruption, it is a change in access or removal of access to the victim or the information. (vii) Hijack . Information, devices, etc., is denying services (to people, processes, servers, etc.). Encrypting files, folders, hard drives, and, for example, demanding a ransom. (viii) Modify/change information. Altering configuration values/settings, data, spreading misinformation/trolls/bots/deepfakes, etc. (ix) Interfere. In communications between entities, in supply chains, etc. (x) Conduct active and passive stealth eavesdropping, for example, for data exfiltration, doxware, or blackmail through disclosure, etc. (xi) Reduce user capacity (operational, CPU, quality, etc.). (xii) Deceive. Use disinformation, deepfakes, synthetic media, trolls, etc. (xiii) Damage. Reputation, health, QoS, etc. (xiv) Break down. Software, firmware, hardware, devices, vehicles, protocols, organization, trust, etc., and in the supply chain, disrupt, cause planned obsolescence, etc. (2) Operational impact of cyberattacks in general and those due to offensive malware in particular. These can be characterized as: (i) Compromising root. This involves gaining unauthorized administrator privileges on a device/system. Similarly, elevating privileges above those of a normal user, including administrator and/or root privileges for a specific system. (ii) Web-level compromise. This involves compromising a website or web application by exploiting vulnerabilities. A malware cyberattack can occur through a compromised website, typically using site scripting or SQL injection. (iii) Simple or distributed denial of service (DoS/DDoS). This involves denying a victim access to specific legitimate resources or services. DoS/DDoS attacks can be of four types: application-directed (preventing access to applications/apps), system/device/server-directed (maliciously attacking a system's configuration, operating system, software, etc., to overwhelm the system by consuming all its resources and crashing it), network-directed (preventing the network and/or subnetwork and all its connected devices from providing or receiving authorized services, typically through packet "flooding" to damage network connectivity, bandwidth, and increase latency), and distributed (simply put, DDoS, based on multiple coordinated cyberattacks from different infected devices, forming a botnet; Mirai is an example). (iv) Misuse of IT/OT resources. This involves the unauthorized use of resources, as well as any IT/OT function (BD-ERP, CPS-ICS-SCADA) that requires certain privileges. (v) User compromise. This involves offensive malware gaining unauthorized access to user privileges on a system/device/network as a compromised user. (vi) Malicious code installation. This involves exploiting vulnerabilities to install malware and launch a cyberattack, either because the user opens an email attachment or visits an infected website (drive-by compromise/installation), etc. This allows the malware to gain complete control of the compromised system, leading to exposure of sensitive information, remote system control, data modification, etc.

TYPIFICATION OF CYBER-ATTACK VECTORS.

A cyberattack vector (in general, and for an offensive malware attack in particular) is a path (of vulnerabilities) through which malware can evolve and gain access to a target (device, system, IoT object, network, etc.). Several vulnerability vectors may be needed to successfully launch a cyberattack. Some examples of cyberattack vectors or vulnerabilities are: (1) Insufficient input validation. A program fails to validate input sent to the program by a user. Malware can exploit an insufficient input validation vulnerability and inject arbitrary code, which typically occurs within web applications, apps, etc. (2) Kernel flaws. Malware can use a kernel flaw or vulnerability within an operating system (the kernel is the core code of the operating system) to gain certain privileges when exploiting a vulnerability within the operating system. (3) Buffer overflow (stack or heap type). It is caused when a piece of code fails to properly check the appropriate length of the input, and the input value is not the size the program expects. A buffer overflow occurs when a buffer with poor or unbounded checking is filled with user-supplied data. A malware cyberattack can exploit a buffer overflow vulnerability, leading to the potential execution of arbitrary code, often with administrator-level privileges, while the program is running. Buffer overflows can occur both on the stack and in heap memory locations. A heap buffer overflow occurs in the heap data area, which is dynamically allocated by the running application. (4) File Descriptor.

A file descriptor that uses system numbers to track files, as opposed to filenames. Exploiting a file descriptor vulnerability allows malware to gain elevated privileges to program-related files. (5) Poor configuration (usually default settings). Malware can use a configuration vulnerability or flaw within a specific application to gain access to a network or computing device to launch a variety of cyberattacks. Inappropriately configured settings (usually defaults) are easy targets for malware to exploit. (6) Social engineering. The process of using social interactions to acquire information from a victim or computing device. These types of cyberattacks provide quick ways to reveal information that might not be available under normal circumstances. (7) Incorrect file/directory permission. Incorrect permissions associated with a file or directory involve not properly assigning users and processes. Exploiting this vulnerability can lead to a multitude of malware attacks. (8) Race condition. This occurs when a program attempts to execute a process and the object concurrently switches between repeated references, allowing malware to gain access to elevated privileges while a program or process is in privileged mode. (9) Bugs in CPUs, FPGAs, SoCs, microcontrollers, GPUs, etc. These vulnerabilities can cause disasters in all types of IT/OT systems, even those based on artificial intelligence. (10) Symbolic links. This is a file that points to another file. Malware can exploit a symbolic link vulnerability to point to a target file for which an operating system process has write permissions. (11) Cyberattack vectors correlated with malware names. The "slammer worm" malware uses misconfiguration as a cyberattack vector/vulnerability; the main targets are networks/applications, and the impacts on information are discovery/distortion. The “conflicker” malware uses stack buffer overflow as its attack vector/vulnerability, targeting operating systems (such as Windows Server, XP, 2000, etc.) and causing disruption/disruption of information. The “gimmiv.A” malware also uses stack buffer overflow as its attack vector/vulnerability, targeting operating systems (such as Windows Server) and causing disclosure of information. The “yamanner” malware uses social engineering/design flaws as its attack vector/vulnerability, targeting applications such as email servers/users and causing disclosure/disruption/disruption of information. The “zotob” malware uses stack buffer overflow as its attack vector/vulnerability, targeting the operating system/local system and causing distortion of information. The malware “samyXSS” uses the design flaw as a cyber-attack/vulnerability vector; the main target is the user, and the impact on information is disruption/interruption.

EXPLORATION OF THE DYNAMICS OF BLOCKING MALICIOUS ACTIONS BY DEFENSIVE MALWARE.

MIAD (Advanced Defensive Intelligent Malware) is an adaptive, cyber-resilient, self-controlling, autonomous, extremely stealthy, asymptomatic, AI-based cyber-weapon (with capabilities of machine learning, deep learning, deep convolutional neural networks, NL, expert systems, etc.) capable of communicating, if desired, with control centers to gain functions that it continuously discovers at several levels simultaneously malicious "targets" to block, that is, malicious attempts and actions/micro-actions that it blocks, disables, inactivates, neutralizes, etc. Defensive malware detects all types of malicious and dangerous actions in software, firmware, hardware, data, and human behavior (such as clicking on a malicious link/icon/button/cross, downloading or opening an infected attachment via spam, spearphishing, etc., opening a malicious QR code (leading to an infected website), charging a mobile phone/tablet/PC battery via USB, or even charging a vehicle in a compromised public place/bus, or using infected or compromised public Wi-Fi connections, etc.). Defensive malware blocks all malicious micro-actions at every level. For example, at the technical level, it blocks attempts to exploit Microsoft Office macro vulnerabilities, inject malicious scripts into the registry, execute registry values ​​using "rundll32.exe", execute registry values ​​encoded using Jscript.Encode, use Base64-encoded PowerShell scripts, verify registry keys and paths of executable files, and execute DLLs using PowerShell scripts. (Injection using dllhost.exe), any attempt to delete files after each operation, residing in “dllhost.exe”, sending user system information to the C&C server using subliminal and/or TCP communications, attempting to use social engineering techniques using email attachments, executing registry values ​​using Mshta.exe, code injection using PowerShell scripts, etc. According to Aon data, ransomware cyber incidents increased by 400% in 2020. According to Verizon's 2020 DBIR (Data Breach Investigations Report), 43% of data breaches are related to the application layer (development teams have focused more on functionality and productivity, neglecting cybersecurity. It is urgent to apply methodologies such as DevSecOps/Development-Security-Operations to the development of software, apps, APIs, etc., from the design stage).

FINAL CONSIDERATIONS

Advanced Adaptive Intelligent Malware Defense (DAIM/MIAD) consists of three things: (1) A defensive cyber weapon against all types of cyberattacks in general and offensive malware cyberattacks in particular. (2) A sophisticated cyber attack tool against all types of cyberattacks in general and offensive malware cyberattacks in particular. (3) A cyber threat neutralization tool against cyberattacks in general and offensive malware cyberattacks in particular. Offensive malware attacks everything, for example, vehicles (in the automotive world, malware can act on different buses such as CAN-bus, FlexRay, LIN, CAN-FS, etc.), on ECUs (Electronic Control Units that manage engine operation, can block steering, remote control of heating and air conditioning, can lock or unlock doors, create chaos in the switching on and off of warning lights, confuse the tire pressure (as if there were a puncture), block windows, activate airbags, produce forced acceleration and braking, modify navigation, block brakes, act on entertainment systems, manipulate the vehicle's diagnostic record (affecting the driver and workshops), maliciously download driving data (where the driver lives, works, GPS tracking, etc.), etc.), on systems such as ADAS (Advanced Driver Assistance Systems) with their sensors, taking advantage of vulnerabilities and contaminating sensor data so that they detect whatever the malware wants, for example, detecting obstacles that are not there or displaying what is under the vehicle. (a dummy person on the hood of the car to make it appear as if the driver has run them over), the OBD2 port (which allows programming, coding, and diagnosing all electronic devices incorporated into the vehicle; malware can cyberattack and control the vehicle (some insurance companies connect a device to this port to lower premiums, which can become infected, to learn the driver's habits), etc.). A forecast by the International Data Corporation estimates that there will be 41.6 billion connected IoT devices/objects generating 79.4 zettabytes of data by 2025. According to a Gartner report, the number of IoT devices (and all its derivatives: IoMT, IIoT, AIoT, etc.) connected across all technical domains will reach one trillion by 2025. This implies a cyber-malware threat of unimaginable proportions. Malware can cyberattack everything: virtualization, meaning that virtual instances and virtual machines can spy on and interact with each other, can distort reality, causing a vehicle to be lost due to a geolocation failure or making it appear as if the vehicle is traveling on a distant road; malware infiltrated into folders or files allows the geolocation of the person who opens them to be known, etc. A PUF (Potentially Unknown Function) is a function embedded in a physical object such as a chip or integrated circuit. When presented with a challenge z, the PUF generates a response w that depends on both the challenge z and the specific physical properties of the device and the unique material of the object containing the PUF (i.e., the unique internal structure of the PUF—its “cyber-DNA”)—which is caused by random manufacturing variations; these variations are not recreatable and are not under the control of the PUF manufacturer). PUFs are a good technique for detecting cloned, counterfeit, spoofed, duplicated, etc., hardware. In the case of preventing the spoofing of video cameras, CPUs, etc., PUF technology is hardware-based and therefore cannot be counterfeited, making the device on which it operates "unique." In contrast, NFT (Non-Fungible Token) entities/objects (files, videos, photos, etc.) are based on blockchain, which is software, and therefore has vulnerabilities. Consequently, the object or entity could be counterfeited, rendering it "unusual." According to Gartner, by 2025 malware will have the absolute capacity to act against all types of OT (Operational Technology) environments to cause injury, contamination, or even death. This is the case with malware cyberattacks on CPS, ICS, vehicles, factories, SCADA, PLCs, etc. A report by RiskRecon and Cyentia Institute shows that in companies with IoT devices without proper configuration and cybersecurity, the cyber risk of exposure of their critical assets is multiplied seventyfold; furthermore, 86% of cybersecurity problems in IoT devices are considered critical.

Author: Prof. Dr. Javier Areitio Bertolín. Director of the Networks and Systems Research Group

REFERENCES.

- Areitio, J. “Information Security: Networks, Computing and Information Systems”. Cengage Learning-Paraninfo. 2020. - Areitio, J. “Controlling the growing empowerment of malware: identification and exploration of key aspects of malware”. Conectrónica Magazine. No. 240. February 2021. - Areitio, J. “Danger of ignorance regarding the existence of malware contamination leading to very serious global cyber-epidemiological situations”. Conectrónica Magazine. No. 241. March-April 2021. - Areitio, J. “Clarifications on malware, cyber-pandemics and critical cyber-epidemiological scenarios. Protection against malware: proactive defense”. Conectrónica Magazine. No. 242. May-June 2021. - Areitio, J. “Confluences between malware, vulnerabilities and exploits: infiltration indicators, infection vector surface and malware danger”. Conectrónica Magazine. No. 243. July 2021. - Areitio, J. “Adaptation to the variability of undetected malware infection events in all types of current scenarios, environments, and ecosystems.” Conectrónica Magazine. No. 244. September 2021. - Areitio, J. “Duality of advanced intelligent malware (offensive and defensive), points of action, and transparent expansion operations.” Conectrónica Magazine. No. 245. October 2021. - Areitio, J. “Elements and approaches for the design and synthesis of advanced defensive intelligent malware.” Conectrónica Magazine. No. 246. November 2021. - Areitio, J. “Development of advanced defensive intelligent malware.” Neutralization of offensive malware actions." Conectrónica Magazine. No. 247. February 2022. - Areitio, J. "Automatic actions of advanced defensive intelligent malware." Conectrónica Magazine. No. 248. March 2022. - DiMaggio, J. "The Art of Cyberwarfare: An Investigator's Guide to Espionage, Ransomware, and Organized Cybercrime." No Starch Press. 2021. - Ryan. M. “Ransomware Revolution: The Rise of a Prodigious Cyber ​​Threat”. - Wardle, P. “The Art of Mac Malware: The Guide to Analyzing Malicious Software”. Press. 2021. - Yehoshua, N. and Kosayev, U. “Antivirus Bypass Techniques: Learn Practical Techniques and Tactics to Combat, Bypass, and Evade Antivirus Software.” Packt Publishing. 2021. - Calder, A. “The Ransomware Threat Landscape: Prepare for, recognize and survive ransomware attacks.” IT Governance Publishing. 2021. - Barker, D. “Malware Analysis Techniques: Tricks for the Triage of Adversarial Software”. Packt Publishing. 2021. - Ahmed, A. “Privilege Escalation Techniques: Learn the Art of Exploiting Windows and Linux Systems”. Packt Publishing. 2021. - Boutwell, M. “The Ransomware Handbook: How to Prepare for, Prevent, and Recover from Ransomware Attacks.” Mike Bouwell. 2021. - Sarwar, FA “Python Ethical Hacking from Scratch: Think like an Ethical Hacker, Avoid Detection, and Successfully Develop, Deploy, Detect, and Avoid Malware." Packt Publishing. 2021. - Liska, A. “Ransomware: Understand. Prevent. Recover". ActualTech Media. 2021. - Di Pietro, R., Raponi, S., Caprolu, M. and Cresci, S. "New Dimensions of Information Warfare (Advances in Information Security)". Springer. 2021.