Virtually Undectecable Malware Infecting Students’ Computers

Hiding under student computer hardware is malware that steals personal data. It’s lurking somewhere deep, and most anti-virus software cannot find it. The malware then reports to a ring of cybercriminals who might be selling that information on the black market. This may sound like something out of a low-budget movie, but these viruses are real and are affecting students at the University of Tampa. Within two days of the freshmen arrival on campus this past August, over 100 instances of this malware were found, according to the Office of Information Security.

“There are a lot of infected systems in the dorms. Students are coming to campus with them, and they are getting infected before they even come here,” said Tammy Clark, chief information security officer at UT.

According to Clark, the most dangerous aspect of these new brands of viruses, typically called bots, is that the bots are virtually undetectable by the common user. One of the main targets for hackers are universities, which have networks with high value information and high volumes of users.

“When hacker groups put this encrypted malware on your computer, they start looking for Social Security numbers or credit cards,” said Tammy Clark, chief information security officer at UT. “The virus starts downloading it, putting keystroke loggers on it, collecting it…and they send it back to themselves to sell on the black market.”

Three of the leading causes of these infections come from corrupted web pages, emails with tainted links and software that “auto-installs” when you visit a particular site. If one person’s social media or email account is accessed, hackers can send these corrupted links to an entire network of friends to infect other computers.

“I think it is really scary,” said Sabrina Milroy, junior and economics major. “People can do things with technology that others do not even think of. I have seen warnings about this threat on Tumblr, and it is definitely real.”

The Office of Information Security at UT has taken measures to alert students to this malware by partnering with a new company called Damballa. Coming out of Georgia Tech, Damballa is a new program that monitors networks for these specific bots. UT is one of several campuses in the U.S. to have integrated it into their computer systems, including Vanderbilt University and Georgia State University. With this new system, screenings that used to take anywhere from four to six hours now take about five to 10 minutes. Not only can Damballa detect bots already installed on a computer, but it lists specific attacks that were unsuccessful and attributes them to the particular hacker group using that malware.

“We put this solution in this year, so now we are able to see that invisible malware that comes to students’ computers,” Clark said. “We can see that hackers downloaded it; we can see they’re communicating with computers every day, and we’re sending out notices to tell students, ‘you have one of those bots.’”

“When hacker groups put this encrypted malware on your computer, they start looking for Social Security numbers or credit cards,” said Tammy Clark, chief information security officer at UT. “The virus starts downloading it, putting keystroke loggers on it, collecting it…and they send it back to themselves to sell on the black market.”

Emails have been sent through the Office of Information Security, but Clark fears that many students are ignoring the warnings or think that the problem will fix itself. While Clark admits that the university does not provide services to remove the software, the office will sit down with students, explain the malware problem and walk students through the process of reformatting their personal computer or finding technicians to remove the problem.

Unfortunately, Clark warned, this brand of malware is so new that there is no known protection against them. Even completely reformatting the computer hard drive is no guarantee of removing these bots. Anti-virus companies are currently researching the gaps in security to stop these infections from getting through and possibly lessen the amount of cybercrime.

Students may be confusing bots with more common “scareware” viruses that ask to install fake anti-virus software in order to take control of a computer.

Victims of viruses on campus sometimes ask student lab assistants like Peter Patriarca, a junior studying management information systems, for help. Patriarca has encountered a few students who have had issues with “scareware” before, but he emphasizes that the threat of bots, a new type of virus, is much different.

“Bots are a lot trickier because they are very hard to detect,” Patriarca said. “They hide under the system, so restoring your computer will not get it out like other viruses. Damballa is a great program, and it is saving a lot of students from having passwords and personal information stolen.”

According to the Office of Information Security, once this malware has been detected on a computer, only a specialized technician can remove it. The Office of Information Security sends information on how to repair these issues if it has been detected on a student computer. If the product is still under warranty, manufacturers will service or replace the system for free. Without the warranty, a repair to remove the bot averages about $200 at stores like Best Buy. An extended three-year warranty for a laptop computer can average about the same price.

“These warranty programs are not going to ask you ‘Why did you get this?’ or ‘Is this your fault?’ They know it is not your fault, because it is nobody’s fault,” Clark said.

Doha Madani can be reached at doha.madani@spartans.ut.edu