Classifying malware by propagation and payload

Stop asking "is it a virus or a worm?"

Arguments about whether some specimen "is really a worm" are almost always arguments about the wrong question. Modern malware is classified on two axes at once, and the useful question is not which category it belongs to but which cell of the grid it occupies.

Axis 1 — propagation: how does it get onto the next machine? There are three mechanisms:

1. Infection of existing content. The malicious code attaches itself to something that is already there — an executable, a boot sector, a document with macros — and travels when that host travels. This is the virus mechanism.
2. Exploitation of a software vulnerability. The code reaches a remote machine by abusing a flaw in a network-facing service, or in the browser that just loaded a page. This is the worm and drive-by-download mechanism.
3. Social engineering. The code persuades a person to run it — an attachment, a "codec" download, a text message with a link. This is the Trojan and phishing mechanism.

Axis 2 — payload: what does it do once it is there? Four classes:

1. Corruption of system or data — destroying files, bricking a machine, or encrypting the disk for ransom.
2. Attack agent (theft of service) — the machine becomes a resource for the attacker: a bot in a botnet sending spam or flooding a target.
3. Information theft — keyloggers, spyware, exfiltration of documents.
4. Stealthing — the payload whose whole job is to keep the other payloads hidden: backdoors and rootkits.

Worked example — six specimens on the grid

The two choices are independent. Fix the propagation mechanism and any payload can ride it; fix the payload and several mechanisms can deliver it. Place six specimens and the independence becomes obvious:

• A macro virus that mails itself onward — infected content × attack agent.
• A virus that rewrites the motherboard firmware so the machine will not boot — infected content × corruption.
• Ransomware that arrives through an unpatched file-sharing service — vulnerability exploit × corruption.
• A worm that exploits a web server and then floods a government site — vulnerability exploit × attack agent.
• Spyware dropped by a poisoned advertisement on an ordinary news page — vulnerability exploit × information theft.
• A banking Trojan that the user installs from an e-mailed "invoice" — social engineering × information theft.

Notice the third and sixth entries: the same broad payload (taking something of value from the victim) arriving by two completely different routes, which is why a defence aimed at one route does nothing about the other. Notice too that real specimens spill across cells — a piece of malware that spreads by e-mail attachment and by an unpatched share occupies two propagation cells at once. That is what blended malware means, and it is why "which category is it?" is the wrong question.

The two older axes, and the vocabulary the paper uses

Exam papers in this subject are written in an older register, and you must be fluent in it:

• Needs a host program (parasitic) vs independent. A parasitic fragment cannot run by itself; it is embedded in a program and executes only when that program is executed. Viruses, logic bombs and backdoors are parasitic. An independent program is self-contained and can be scheduled and run by the operating system on its own: worms, bots, flooders.
• Replicating vs non-replicating. Viruses and worms make copies of themselves. Trojans and spam do not — a Trojan spreads because people pass it around, not because it copies itself.

And the terminology list, which is pure definition work and rewards flashcards. The ones that get confused most:

The flooder entry is the one to burn in. A bot is the compromised machine that takes remote orders; a flooder is the traffic-generating tool that a bot might run. Naming the platform when the question asks for the tool is the most common single mistake on this list.