Editing Malware (section)

==History==
{{main|History of computer viruses}}
{{For timeline|Timeline of computer viruses and worms}}

The notion of a self-reproducing computer program can be traced back to initial theories about the operation of complex automata.<ref>John von Neumann, "Theory of Self-Reproducing Automata", Part 1: Transcripts of lectures given at the University of Illinois, December 1949, Editor: A. W. Burks, University of Illinois, USA, 1966.</ref> [[John von Neumann]] showed that in theory a program could reproduce itself. This constituted a plausibility result in [[computability theory]]. [[Fred Cohen]] experimented with computer viruses and confirmed Neumann's postulate and investigated other properties of malware such as detectability and self-obfuscation using rudimentary encryption. His 1987 doctoral dissertation was on the subject of computer viruses.<ref>Fred Cohen, "Computer Viruses", PhD Thesis, University of Southern California, ASP Press, 1988.</ref> The combination of cryptographic technology as part of the payload of the virus, exploiting it for attack purposes was initialized and investigated from the mid-1990s, and includes initial ransomware and evasion ideas.<ref>{{cite book|last1=Young|first1=Adam|url=https://archive.org/details/maliciouscryptog00youn_705|title=Malicious cryptography - exposing cryptovirology|last2=Yung|first2=Moti|date=2004|publisher=Wiley|isbn=978-0-7645-4975-5|pages=[https://archive.org/details/maliciouscryptog00youn_705/page/n27 1]–392|url-access=limited}}</ref>

Before [[Internet]] access became widespread, viruses spread on personal computers by infecting executable programs or [[boot sector]]s of floppy disks. By inserting a copy of itself into the [[machine code]] instructions in these programs or [[boot sector]]s, a virus causes itself to be run whenever the program is run or the disk is booted. Early computer viruses were written for the [[Apple II]] and [[Mac (computer)|Mac]], but they became more widespread with the dominance of the [[IBM PC]] and [[MS-DOS]]. The first IBM PC virus in the wild was a [[boot sector]] virus dubbed [[Brain (computer virus)|(c)Brain]], created in 1986 by the Farooq Alvi brothers in Pakistan.<ref name="Avoine">{{cite book|last=Avoine|first=Gildas|title=Computer system security: basic concepts and solved exercises|author2=Pascal Junod|author3=Philippe Oechslin|publisher=EFPL Press|year=2007|isbn=978-1-4200-4620-5|pages=20|quote=The first PC virus is credited to two brothers, Basit Farooq Alvi and Amjad Farooq Alvi, from Pakistan}}</ref> Malware distributors would trick the user into booting or running from an infected device or medium. For example, a virus could make an infected computer add autorunnable code to any USB stick plugged into it. Anyone who then attached the stick to another computer set to autorun from USB would in turn become infected, and also pass on the infection in the same way.<ref name="dodusb">{{cite web|title=USB devices spreading viruses|url=http://www.cnet.com/uk/news/usb-devices-spreading-viruses/|access-date=18 February 2015|work=CNET|publisher=CBS Interactive|archive-date=24 September 2015|archive-url=https://web.archive.org/web/20150924055323/http://www.cnet.com/uk/news/usb-devices-spreading-viruses/|url-status=dead}}</ref>

Older email software would automatically open [[HTML email]] containing potentially malicious [[JavaScript]] code. Users may also execute disguised malicious email attachments. The ''2018 Data Breach Investigations Report'' by [[Verizon]], cited by [[CSO Online]], states that emails are the primary method of malware delivery, accounting for 96% of malware delivery around the world.<ref>{{cite report|title=2018 Data Breach Investigations Report|publisher=Verizon|date=2018|edition=11th|url=https://enterprise.verizon.com/resources/reports/DBIR_2018_Report.pdf|access-date=26 September 2022|page=18|archive-date=16 October 2021|archive-url=https://web.archive.org/web/20211016232230/https://enterprise.verizon.com/resources/reports/DBIR_2018_Report.pdf|url-status=dead}}</ref><ref name="Fruhlinger 2018">{{cite web|last=Fruhlinger|first=Josh|date=October 10, 2018|title=Top cybersecurity facts, figures and statistics for 2018|url=https://www.csoonline.com/article/3153707/top-cybersecurity-facts-figures-and-statistics.html|access-date=January 20, 2020|website=CSO Online|archive-date=2 June 2019|archive-url=https://web.archive.org/web/20190602063948/https://www.csoonline.com/article/3153707/top-cybersecurity-facts-figures-and-statistics.html|url-status=live}}</ref>

The first worms, [[Computer network|network]]-borne infectious programs, originated not on personal computers, but on multitasking [[Unix]] systems. The first well-known worm was the [[Morris worm]] of 1988, which infected [[SunOS]] and [[VAX]] [[Berkeley Software Distribution|BSD]] systems. Unlike a virus, this worm did not insert itself into other programs. Instead, it exploited security holes ([[vulnerability (computing)|vulnerabilities]]) in network [[Server (computing)|server]] programs and started itself running as a separate [[process (computing)|process]].<ref>{{cite web|author=William A Hendric|date=4 September 2014|title=Computer Virus history|url=https://antivirus.comodo.com/blog/computer-safety/short-history-computer-viruses/|access-date=29 March 2015|work=The Register|archive-date=10 May 2018|archive-url=https://web.archive.org/web/20180510050522/https://antivirus.comodo.com/blog/computer-safety/short-history-computer-viruses/|url-status=live}}</ref> This same behavior is used by today's worms as well.<ref>{{Cite news|date=2018-05-02|title=Cryptomining Worm MassMiner Exploits Multiple Vulnerabilities - Security Boulevard|language=en-US|work=Security Boulevard|url=https://securityboulevard.com/2018/05/cryptomining-worm-massminer-exploits-multiple-vulnerabilities/|access-date=2018-05-09|archive-date=9 May 2018|archive-url=https://web.archive.org/web/20180509221215/https://securityboulevard.com/2018/05/cryptomining-worm-massminer-exploits-multiple-vulnerabilities/|url-status=live}}</ref>

With the rise of the [[Microsoft Windows]] platform in the 1990s, and the flexible [[macro (computer science)|macros]] of its applications, it became possible to write infectious code in the macro language of [[Microsoft Office Word|Microsoft Word]] and similar programs. These ''[[macro virus]]es'' infect documents and templates rather than applications ([[executable]]s), but rely on the fact that macros in a Word document are a form of [[executable]] code.<ref>{{Cite web|title=Beware of Word Document Viruses|url=https://us.norton.com/yoursecurityresource/detail.jsp?aid=feature_word|access-date=2017-09-25|website=us.norton.com|archive-date=26 September 2017|archive-url=https://web.archive.org/web/20170926001833/https://us.norton.com/yoursecurityresource/detail.jsp?aid=feature_word|url-status=live}}</ref>

Many early infectious programs, including the [[Morris worm|Morris Worm]], the first internet worm, were written as experiments or pranks.<ref>{{Cite book|last=Tipton|first=Harold F.|url=https://books.google.com/books?id=oR_UHxm7QBwC&q=history+of+malware+pranks&pg=PA982|title=Information Security Management Handbook|date=2002-12-26|publisher=CRC Press|isbn=978-1-4200-7241-9|language=en|access-date=16 November 2020|archive-date=27 February 2023|archive-url=https://web.archive.org/web/20230227060934/https://books.google.com/books?id=oR_UHxm7QBwC&q=history+of+malware+pranks&pg=PA982|url-status=live}}</ref> Today, malware is used by both [[black-hat hacking|black hat hackers]] and governments to steal personal, financial, or business information.<ref>{{cite web|title=Malware|url=http://www.consumer.ftc.gov/articles/0011-malware|access-date=27 March 2014|publisher=FEDERAL TRADE COMMISSION- CONSUMER INFORMATION|archive-date=20 March 2017|archive-url=https://web.archive.org/web/20170320191553/https://www.consumer.ftc.gov/articles/0011-malware|url-status=live}}</ref><ref>{{cite magazine|last=Hernandez|first=Pedro|title=Microsoft Vows to Combat Government Cyber-Spying|url=http://www.eweek.com/security/microsoft-vows-to-combat-government-cyber-spying.html|archive-url=https://archive.today/20140123094411/http://www.eweek.com/security/microsoft-vows-to-combat-government-cyber-spying.html|url-status=dead|archive-date=23 January 2014|magazine=eWeek|access-date=15 December 2013}}</ref> Today, any device that plugs into a USB port – even lights, fans, speakers, toys, or peripherals such as a digital microscope – can be used to spread malware. Devices can be infected during manufacturing or supply if quality control is inadequate.<ref name="dodusb" />