WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:02.190 align:middle line:90%
If you are involved
in computers like I

3
00:02.190 --> 00:05.110 align:middle line:90%
was, growing up in the
'90s, in the early 2000s,

4
00:05.110 --> 00:09.690 align:middle line:90%
you no doubt have heard about
the terms of viruses, worms,

5
00:09.690 --> 00:11.235 align:middle line:84%
Trojans, and malware.

6
00:11.235 --> 00:13.860 align:middle line:90%
And in this Nugget, we're going
to be talking a little bit more

7
00:13.860 --> 00:16.650 align:middle line:90%
about what those things
are, what they do,

8
00:16.650 --> 00:18.240 align:middle line:84%
and what risks they pose.

9
00:18.240 --> 00:20.700 align:middle line:90%
Let's get going
talking about malware.

10
00:20.700 --> 00:23.310 align:middle line:90%
Viruses, worms,
Trojans, malware,

11
00:23.310 --> 00:25.980 align:middle line:90%
that's what we're talking
about in this video.

12
00:25.980 --> 00:29.310 align:middle line:90%
They all feel like they
fall into the same category.

13
00:29.310 --> 00:30.810 align:middle line:84%
And in many ways they do.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.310 --> 00:30.810 align:middle line:84%
And in many ways they do.

14
00:30.810 --> 00:33.450 align:middle line:90%
But there are some things
that differentiate them

15
00:33.450 --> 00:36.403 align:middle line:90%
from other applications
or from each other.

16
00:36.403 --> 00:38.570 align:middle line:90%
And that's what we got to
talk about in this Nugget.

17
00:38.570 --> 00:41.040 align:middle line:90%
So let's start off by
talking about a virus.

18
00:41.040 --> 00:42.360 align:middle line:84%
What is a virus?

19
00:42.360 --> 00:44.460 align:middle line:90%
How does it behave
and what does it do?

20
00:44.460 --> 00:48.900 align:middle line:90%
A virus is an application
that has to be run in order

21
00:48.900 --> 00:49.900 align:middle line:84%
to take effect.

22
00:49.900 --> 00:51.480 align:middle line:90%
It's no different
from how you have

23
00:51.480 --> 00:54.570 align:middle line:90%
to run an application
to type a document up,

24
00:54.570 --> 00:56.640 align:middle line:90%
except for in this
case, the virus is

25
00:56.640 --> 00:58.470 align:middle line:84%
a self-contained application.

26
00:58.470 --> 01:00.540 align:middle line:90%
Maybe you think it's
supposed to do one thing,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:58.470 --> 01:00.540 align:middle line:90%
Maybe you think it's
supposed to do one thing,

27
01:00.540 --> 01:03.100 align:middle line:90%
but in reality it's
doing something else.

28
01:03.100 --> 01:08.070 align:middle line:90%
So when you run a nuclear
virus.exe as administrator,

29
01:08.070 --> 01:10.030 align:middle line:90%
what is it really
doing under the hood?

30
01:10.030 --> 01:11.940 align:middle line:90%
Well, there's a bunch
of different things

31
01:11.940 --> 01:14.100 align:middle line:84%
that it could be doing.

32
01:14.100 --> 01:17.130 align:middle line:90%
Basically, if you can imagine
it, that's what a virus can do.

33
01:17.130 --> 01:19.380 align:middle line:90%
In lots of ways, a
virus can do things

34
01:19.380 --> 01:22.050 align:middle line:90%
like attack the
master boot record.

35
01:22.050 --> 01:24.300 align:middle line:90%
That way, on your hard
drive, the next time

36
01:24.300 --> 01:27.000 align:middle line:90%
you try to boot the device
up it simply won't boot up.

37
01:27.000 --> 01:28.470 align:middle line:84%
It's not capable of doing it.

38
01:28.470 --> 01:30.630 align:middle line:90%
The device is effectively
hosed the moment
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.470 --> 01:30.630 align:middle line:90%
The device is effectively
hosed the moment

39
01:30.630 --> 01:33.630 align:middle line:90%
you turn it off because it will
never come back online again.

40
01:33.630 --> 01:35.940 align:middle line:90%
Sometimes the virus
may want to access

41
01:35.940 --> 01:39.750 align:middle line:90%
some of your peripherals,
like a printer, or a webcam,

42
01:39.750 --> 01:40.920 align:middle line:84%
or a microphone.

43
01:40.920 --> 01:44.580 align:middle line:90%
In a way, sometimes a virus
may want to actually access

44
01:44.580 --> 01:45.650 align:middle line:84%
your keyboard.

45
01:45.650 --> 01:48.750 align:middle line:90%
What it does is it logs
all of your keystrokes.

46
01:48.750 --> 01:51.150 align:middle line:90%
For instance, they
call this a key logger.

47
01:51.150 --> 01:53.820 align:middle line:90%
Maybe the virus is
designed to detect

48
01:53.820 --> 01:56.490 align:middle line:90%
a certain string of
characters, maybe something

49
01:56.490 --> 01:59.730 align:middle line:84%
like your bank.com website.

50
01:59.730 --> 02:02.280 align:middle line:90%
The moment it detects that
you're going to bank.com it's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
01:59.730 --> 02:02.280 align:middle line:90%
The moment it detects that
you're going to bank.com it's

51
02:02.280 --> 02:05.100 align:middle line:90%
starting to log all of your
keystrokes looking for what

52
02:05.100 --> 02:07.500 align:middle line:84%
may be a username and password.

53
02:07.500 --> 02:10.199 align:middle line:90%
Or maybe it's scanning through
your entire file system,

54
02:10.199 --> 02:12.630 align:middle line:90%
looking for important pictures
or documents, or things

55
02:12.630 --> 02:13.350 align:middle line:84%
like that.

56
02:13.350 --> 02:16.620 align:middle line:90%
The point is, once the virus
has the info it's looking for,

57
02:16.620 --> 02:19.290 align:middle line:90%
the next thing it does is
it exfiltrates that data

58
02:19.290 --> 02:21.420 align:middle line:84%
back to the viruses creator.

59
02:21.420 --> 02:23.580 align:middle line:90%
Another key thing
about a virus is

60
02:23.580 --> 02:25.470 align:middle line:90%
that it can replicate
itself, much

61
02:25.470 --> 02:27.420 align:middle line:84%
like an actual virus in nature.

62
02:27.420 --> 02:31.110 align:middle line:90%
And it may attempt to spread
through other channels or means
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:27.420 --> 02:31.110 align:middle line:90%
And it may attempt to spread
through other channels or means

63
02:31.110 --> 02:32.730 align:middle line:84%
of communication, like email.

64
02:32.730 --> 02:35.790 align:middle line:90%
So once it's infected you
and it's performed its tasks,

65
02:35.790 --> 02:37.950 align:middle line:90%
it will then try and
infect the next person

66
02:37.950 --> 02:40.050 align:middle line:90%
and spread naturally
around the world.

67
02:40.050 --> 02:42.390 align:middle line:84%
This is very similar to a worm.

68
02:42.390 --> 02:44.760 align:middle line:90%
A worm does many of
these things already,

69
02:44.760 --> 02:48.210 align:middle line:90%
but it doesn't require an end
user to launch an application.

70
02:48.210 --> 02:50.940 align:middle line:90%
It's just working on
its own naturally.

71
02:50.940 --> 02:54.030 align:middle line:90%
It routes through your file
system, and your operating

72
02:54.030 --> 02:56.280 align:middle line:90%
system, and your
registry and still

73
02:56.280 --> 02:58.350 align:middle line:90%
attempts to replicate
and produce itself,

74
02:58.350 --> 03:00.480 align:middle line:90%
spreading throughout the
world in natural ways.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
02:58.350 --> 03:00.480 align:middle line:90%
spreading throughout the
world in natural ways.

75
03:00.480 --> 03:03.330 align:middle line:90%
Now the Trojan horse
attack, or malware,

76
03:03.330 --> 03:05.430 align:middle line:90%
is one of the more
common ones that you see.

77
03:05.430 --> 03:09.030 align:middle line:90%
Because in this case, what a
Trojan horse really is, is it's

78
03:09.030 --> 03:12.270 align:middle line:90%
presenting itself as one
application, an application

79
03:12.270 --> 03:15.180 align:middle line:90%
that you may find desirable,
or something that you want,

80
03:15.180 --> 03:17.670 align:middle line:90%
when really under the
hood, it's executing

81
03:17.670 --> 03:20.460 align:middle line:90%
this virus-like or
malware-like code.

82
03:20.460 --> 03:22.350 align:middle line:90%
So much like the
ancient Greek story

83
03:22.350 --> 03:26.580 align:middle line:90%
of how the Trojan horse was used
to infiltrate a base, and then

84
03:26.580 --> 03:28.598 align:middle line:90%
everybody jumped
out at nighttime.

85
03:28.598 --> 03:31.140 align:middle line:90%
And then they took over the city
and the base, and everything
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:28.598 --> 03:31.140 align:middle line:90%
And then they took over the city
and the base, and everything

86
03:31.140 --> 03:31.900 align:middle line:84%
like that.

87
03:31.900 --> 03:33.870 align:middle line:84%
That's what this is doing here.

88
03:33.870 --> 03:35.460 align:middle line:90%
You may think that
you're downloading

89
03:35.460 --> 03:38.940 align:middle line:90%
a legitimate antivirus
program when in reality, it's

90
03:38.940 --> 03:40.170 align:middle line:84%
doing the exact opposite.

91
03:40.170 --> 03:42.240 align:middle line:90%
You download it, you
install it, and you run it.

92
03:42.240 --> 03:44.370 align:middle line:90%
And then under the
hood, it performed

93
03:44.370 --> 03:46.500 align:middle line:90%
all of these actions
working against you.

94
03:46.500 --> 03:48.060 align:middle line:84%
And what's the real threat here?

95
03:48.060 --> 03:50.580 align:middle line:90%
Where do these viruses
really originate from,

96
03:50.580 --> 03:52.620 align:middle line:90%
and all this malware
really originate from?

97
03:52.620 --> 03:55.980 align:middle line:90%
Again, it falls back to people
and people's willingness

98
03:55.980 --> 03:58.710 align:middle line:90%
to help or people's willingness
to click on links that they

99
03:58.710 --> 03:59.370 align:middle line:84%
shouldn't.

100
03:59.370 --> 04:00.680 align:middle line:84%
And maybe they do that at home.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:59.370 --> 04:00.680 align:middle line:84%
And maybe they do that at home.

101
04:00.680 --> 04:02.370 align:middle line:90%
But chances are, if they
do that at home, they're

102
04:02.370 --> 04:04.620 align:middle line:90%
also going to do it on
their work computer too.

103
04:04.620 --> 04:06.420 align:middle line:90%
And once they do it
on the work computer,

104
04:06.420 --> 04:08.940 align:middle line:90%
hackers and attackers
have now gained access

105
04:08.940 --> 04:10.823 align:middle line:84%
to your corporate systems.

106
04:10.823 --> 04:12.240 align:middle line:90%
So rather than
looking at people's

107
04:12.240 --> 04:15.720 align:middle line:90%
individual personal documents
or their photos, now

108
04:15.720 --> 04:17.640 align:middle line:90%
they've got access
to their file share.

109
04:17.640 --> 04:21.329 align:middle line:90%
Luckily for us, antiviruses
and malware solutions

110
04:21.329 --> 04:24.100 align:middle line:90%
have gotten a lot better
and faster over time,

111
04:24.100 --> 04:26.910 align:middle line:90%
especially after the late
'90s and early 2000s, where

112
04:26.910 --> 04:29.490 align:middle line:90%
peer-to-peer file
sharing really caused

113
04:29.490 --> 04:31.710 align:middle line:84%
these attacks to be prolific.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:29.490 --> 04:31.710 align:middle line:84%
these attacks to be prolific.

114
04:31.710 --> 04:34.680 align:middle line:90%
With off the shelf antivirus
solutions, Windows Defender

115
04:34.680 --> 04:38.310 align:middle line:90%
or even Cisco's AMP product,
which is Advanced Malware

116
04:38.310 --> 04:40.560 align:middle line:90%
Protection, our systems
are much quicker

117
04:40.560 --> 04:43.470 align:middle line:90%
now to evolve to new
and emerging threats.

118
04:43.470 --> 04:45.360 align:middle line:90%
And these definitions
are sent down

119
04:45.360 --> 04:47.160 align:middle line:90%
automatically to
all the devices that

120
04:47.160 --> 04:48.480 align:middle line:84%
are running these softwares.

121
04:48.480 --> 04:51.150 align:middle line:90%
So that's been introducing
what viruses, worms, Trojans,

122
04:51.150 --> 04:52.832 align:middle line:90%
and malware can really
do to our system.

123
04:52.832 --> 04:54.540 align:middle line:90%
I hope this has been
informative for you.

124
04:54.540 --> 04:57.200 align:middle line:90%
And I'd like to thank
you for viewing.