Malware Families

On October 31, 2005, Mark Russinovich, a Windows expert who co-wrote free tools for looking inside Windows, posted what one of them had found on his own computer. There were files, a running program, and settings that Windows itself wouldn't show. Each one's name began with the same five characters, a dollar sign, the letters sys, and another dollar sign, and something deep in the operating system was hiding every name that began that way. Working backward, he traced them to a music CD he had bought and played on the computer, an album by the Van Zant brothers released by Sony BMG.

Sony BMG had put copy-protection software called XCP, made by a British company, First 4 Internet, on 52 of its albums. When the disc went into a Windows computer, a license screen appeared, and accepting it installed XCP, which limited how many copies could be made of the songs. The license didn't say that XCP would hide itself, and neither the disc nor the maker offered a way to uninstall it. Removing it by hand could leave the computer's CD drive unable to work.

Security tools and reports sort malware into types by how it spreads and what it does on a device. Read the table below and pick the type, or types, XCP belongs to.

XCP is a rootkit. It worked inside Windows, at the level that decides what every other program is shown, and it used that position to hide itself from the user, from Windows' own tools, and from most security software. Its route onto computers also fits the trojan description: it came bundled with the player software on a music CD that seemed harmless, and the license never said what it would do. It was not a worm, since it never spread from one computer to another on its own. It is not usually called a virus either. A user's click did start it, which matches the table's line, but the name virus is kept for malware that also copies itself into other files, and XCP never did.

XCP wasn't written to steal anything, but it hid any file whose name began with those five characters, no matter who had put it there. By November 10, ten days after Russinovich's post, antivirus companies were reporting malware that named its own files that way, so that on any computer where XCP was running, they disappeared too.

XCP, for all its hiding, lived in files on the disk, and Russinovich found them. Some malware leaves no such files.

The downtown hotel also has one computer that isn't on the IT manager's list, because it runs on the guest network, not the hotel's own. It sits in a small room off the lobby. Guests use it to print boarding passes, check email, and sign in to their banks. Nobody on staff watches it, and anyone with a room key can sit down at it. Which types of malware would an adversary choose for this computer, given what passes through it?

Guests type passwords on it all day and leave nothing of value stored on it, so the payoff is the typing: a keylogger, or spyware that records the pages visited. Ransomware would gain little, since nothing on the computer is worth paying to get back. The U.S. Secret Service and the Department of Homeland Security warned hotel companies in July 2014 that people had checked in as guests, in some cases with stolen credit cards, at hotels in the Dallas-Fort Worth area, signed in to the business-center computers, and installed keyloggers. The keyloggers emailed what other guests typed back to them, including passwords to bank and email accounts. The warning noted that the attacks needed little technical skill.

Sony BMG stopped making XCP discs on November 11, 2005, and four days later announced a recall, offering to swap each disc for one without the software. On November 21, Texas sued the company, the first case brought under the state's new anti-spyware law. A class-action suit by buyers was settled in May 2006. In December 2006 Sony BMG settled with Texas and California for 1.5 million dollars, and then with 39 more states and the District of Columbia. In January 2007 it settled with the Federal Trade Commission, agreeing to repay customers up to 150 dollars each to fix computers damaged trying to remove the software, and to install no such software again without the customer's consent.

Sony BMG's first removal tool, released in November 2005, had opened a security hole of its own: people who ran it to get rid of the rootkit were left with a new weakness in its place.