What writing my own malware taught me about the horrible security of Windows

NOTE: This post is also available on Medium. Please like on Medium (if you can).

A little while back, I decided I was going to have a little fun with some C# I learned and a copy of Visual Studio I had. The result was an incredibly annoying application that plays Nyan Cat through a hidden window (that only shows up when you hit ALT+TAB), disguised process name, and Alt+F4 Blocking. And the entire thing took me about half an hour to put together.

The Nyan Cat malware, as seen in Task Manager running under the name “Win32Firewall”

The Nyan Cat malware is not really that harmful, but it is annoying. Quite simply, it’s a window that has the YouTube version of Nyan Cat playing. Then, the window is hidden, blocked, and disguised using a huge variety of methods. It’s very annoying, almost impossible to shut down for the novice computer user, and even if you quit the process, it starts up again automatically when you log in.

It’s incredibly easy to install. Simply open the application, and click through the ‘this program may not have installed correctly’ message. Now there’s a hidden file in your shell:startup folder called Win32Firewall that will drive you crazy every time you log in.

It looks like Microsoft is putting all their energy into patching vulnerabilities and entry points. But, once you get in, it is very easy to control the system. You could easily modify this program to create a fake ransomware, bitcoin mining, or some other nasty program.

The problem with guarding all your entry points is that more can easily be found. New vulnerabilities are discovered all the time, and many people (especially major organisations and agencies) are not willing to update or are running an older version of Windows to update. Take the WannaCry malware for example. The vulnerability used had been patched several months earlier, but some people, including the British health system, were running outdated versions and were attacked.

Plus, even if Microsoft magically prevents all vulnerabilities in their software (which is very unrealistic), there are still many ways of attacking using less dangerous methods like phishing emails or Trojan horses.

What’s worse is that I made this with code available from the internet. All I had to do was a google search for ‘Block ALT + F4 c#” and I have access to thousands of scripts that do exactly that. I also found ways through visual studio to hide the application from the ‘applications’ list of Windows. To hide it from the processes list, I named it ‘Win32Firewall’ to make it blend in as a system component.

What Microsoft should do to prevent all this is to not assume that you’ve patched every vulnerability there is. You should not have to install an antivirus program to simply protect yourself. Microsoft Security Essentials should be a part of the original install process, to make things simple and easy. It’s how we can keep people safe and not drive them crazy. Because sometimes security is even more annoying than my nyan cat bomb.

Leave a comment

Your email address will not be published. Required fields are marked *