2 cissp ® Official Study Guide Eighth Edition

Malicious Code 
Malicious code
is any script or program that performs an unwanted, unauthorized, or 
unknown activity on a computer system. Malicious code can take many forms, including 
viruses, worms, Trojan horses, documents with destructive macros, and logic bombs. It is 
often called
malware
, short for malicious software, and less commonly
malcode 
, short for 
malicious code. Attackers are constantly writing and modifying malicious code for almost 
every type of computing device or internet-connected device. Chapter 21 covers malicious 
code in detail. 
Methods of distributing viruses continue to evolve. Years ago, the most popular method 
was via fl oppy disks, hand-carried from system to system. Later, the most popular 
method was via email as either an attachment or an embedded script, and this method is 
still popular today. Many professionals consider drive-by downloads to be one of the most 
popular methods. 
A
drive-by download
is code downloaded and installed on a user’s system without the 
user’s knowledge. Attackers modify the code on a web page and when the user visits, the 
code downloads and installs malware on the user’s system without the user’s knowledge or 
consent. Attackers sometimes compromise legitimate websites and add malicious code to 

---

754
Chapter 17 
■
Preventing and Responding to Incidents
include drive-by downloads. They also host their own malicious websites and use phishing 
or redirection methods to get users to the malicious website. Most drive-by downloads take 
advantage of vulnerabilities in unpatched systems, so keeping a system up-to-date protects 
them. 
Attackers have sometimes used “malvertising” to spread malware. They pose as legiti-
mate companies and pay to have their ads posted on legitimate websites. If users click the 
ad, they are redirected to a malicious site that typically attempts a drive-by download. 
Attackers frequently use a drive-by download to infect a single system, 
with the goal of gaining a foothold in a network. A common method is 
to send phishing emails with links to malicious sites along with a short 
phrase such as “You’ll like this” or “You have to check this out.” If users 
click the link, they are taken to a site that attempts to download malware. 
If successful, attackers use this infected computer as a pivot point to infect 
other computers in the network.
Another popular method of installing malware uses a pay-per-install approach. 
Criminals pay website operators to host their malware, which is often a fake anti-malware 
program (also called rogueware). The website operators are paid for every installation initi-
ated from their website. Payments vary, but in general, payments for successful installations 
on computers in the United States pay more. 
Although the majority of malware arrives from the internet, some is transmitted to 
systems via Universal Serial Bus (USB) fl ash drives. Many viruses can detect when a user 
inserts a USB fl ash drive into a system. It then infects the drive. When the user plugs it into 
another system, the malware infects the other system.