Macro_Virus_Presentation_with_Diagram.ppt

virus

1. Cryptography and Network Security

2. Definition
A macro virus is a type of virus composed of a
sequence of instructions written in a macro
language, which are interpreted by applications
like MS Word or Excel, rather than executed
directly by the operating system.

3. Working of a Macro Virus
1. Attaches itself to application templates (e.g.,
normal.dot).
2. Executes automatically when an infected file is
opened.
3. Spreads to other documents through
templates/macros.
4. May send infected files via email.

4. Characteristics
• Written in high-level macro languages.
• Cross-platform: can spread on Windows, Mac,
Linux.
• Executes automatically when the application
loads.
• Targets data files instead of executables.

5. Example: Melissa Virus
• Infected Word 97/98 documents.
• Triggered when an infected file was opened.
• Installed itself as the 'open' macro and copied to
Normal template.
• Invoked mail program and sent itself to address
book contacts.

6. Symptoms of Infection
• Strange or corrupted content in documents.
• Disabled menus or commands in Word/Excel.
• Slow system/application performance.
• Automatic emailing or file duplication.

7. Countermeasures
1. Disable macros unless necessary.
2. Enable macro security warnings in MS Office.
3. Use updated antivirus software.
4. Do not open attachments from untrusted
sources.
5. Apply regular patches to Office applications.

8. Macro Virus Infection Cycle
Infected
Document
Template
Infection
(normal.dot)
Spreads via
Email
New Victim
Infected

10. A worm is a self-replicating malicious program.
Unlike viruses, worms do not need a host file
to spread.
Spread across networks by exploiting
vulnerabilities or auto-sending copies.
Can cause network congestion and system
failures.

️→→️ →→️??????️ ??????️ ??????️

11. Morris Worm (1988)
First major Internet worm.
Target: Berkeley & Sun UNIX systems.
Spread by inserting instructions into running processes.
Within hours: thousands of systems unusable.
Required disconnection, rebooting, and patching to
recover.
Luckily: only self-replication (no data deletion).

12. Father Christmas Worm
Spread as an electronic Christmas card ??????.
Program displayed: Christmas tree with blinking
lights + “Merry Christmas”.
Then:
Checked recipient’s address book & past mails.
Sent itself to all addresses.
Overwhelmed IBM-based networks, forcing
shutdowns.
Written in high-level job control language (like
later macro worms).

14. Malicious Logic - Cryptography & Network
Security

15. Introduction
Rabbits (Wabbits) and Bacteria are forms of
malicious logic that consume system resources.
- Rabbits: Programs that replicate rapidly,
causing system overload.
- Bacteria: Programs designed to exhaust
resources (CPU, memory, disk).

16. Rabbits (Wabbits)
• Self-replicating programs.
• Create multiple copies of themselves.
• Main goal is to overwhelm CPU, memory, or
disk.
• Do not modify or destroy files directly.
• Example: Early mainframe wabbits creating
endless copies.
Rabbit Replication System Overload
→

17. Bacteria
• Similar to rabbits but focus on consuming all
resources.
• May open multiple processes or consume disk
space.
• Typically designed to crash the system.
• Can slow or stop normal operations completely.
Bacteria Resource Exhaustion System Crash
→ →

18. Comparison: Rabbits vs Bacteria
Rabbits (Wabbits):
- Focus on replication.
- Cause overload through sheer number of
copies.
Bacteria:
- Focus on resource exhaustion.
- Use processes, memory, or disk to crash
systems.

19. Cryptography & Network Security – Atul Kahate

20. Definition
• Some systems allow data to be interpreted as
instructions.
• Malicious logic exploits this to insert 'data' that
is actually code.
• Enables execution of unauthorized actions.

21. Techniques
• Code Injection – malicious input treated as
executable (e.g., SQL injection).
• Buffer Overflow – excess data overwrites
memory, forcing execution.
• Macros or Scripts – documents containing
hidden instructions.
• Embedded Code – formats like HTML,
JavaScript, PDF allow instructions.

22. Security Implications
• Blurs distinction between data and instructions.
• Allows execution of unauthorized or malicious
actions.
• May lead to system compromise or remote code
execution.

23. Countermeasures
• Input validation and sanitization.
• Separate code and data (prepared SQL
statements).
• Sandboxing untrusted programs.
• Use memory-safe programming languages.

24. Input Data Misinterpreted as Instructions Execution of Malicious Action
→ →