Malware
Definition
Malware is an umbrella term for any type of hostile or intrusive software designed to damage, steal from, or gain unauthorised access to a computer system.
How Malware Gets In, Unpatched Software
Software is rarely perfect when released. It often contains bugs and security flaws:
- Hackers discover a flaw in an operating system or application
- They exploit it to deliver malware to the system
- The software developer releases a patch to fix the flaw
- If users do not apply the patch, they remain vulnerable
Key Principle
Keeping software up to date and enabling automatic updates is one of the most effective defences against malware.
The Five Malware Types (GCSE Exam)
1. Virus
- A piece of code that copies itself (self-replicates) and attaches to other files
- Typically causes damage: corrupts or destroys data
- Requires human interaction to spread (e.g., running an infected file)
- Can enter a system accidentally (e.g., infected USB drive) or through deliberate action
2. Trojan
- Appears to be harmless or useful software but contains malicious code
- Commonly distributed alongside games, free software or pirated content
- Once installed, creates a backdoor allowing a hacker to access the system remotely
- A backdoor can sit undetected for months or years, stealing passwords, monitoring activity
- Does not self-replicate
3. Worm
- Similar to a virus but can spread without any human interaction
- Self-replicates and automatically sends copies to contacts or vulnerable devices on the network
- Can cause massive damage very quickly by spreading exponentially
4. Ransomware
- Encrypts the victim’s files, making them inaccessible
- Demands a ransom payment (typically in Bitcoin, which is hard to trace) in exchange for the decryption key
- WannaCry (2017): Major ransomware attack affecting 300,000+ computers across 150 countries. The NHS in the UK was severely disrupted.
- If no backup exists, the victim may have no choice but to pay or lose their data permanently
5. Keylogger
- Secretly records every keystroke the user makes
- Often installed via a Trojan
- Captured data (passwords, credit card numbers, emails) is sent back to the attacker without the victim’s knowledge
Comparison Table
| Malware | Self-replicates? | Needs human action to spread? | Main harm |
|---|---|---|---|
| Virus | Yes | Yes | Corrupts/destroys files |
| Trojan | No | Yes (user installs it) | Creates backdoor |
| Worm | Yes | No | Spreads rapidly; network disruption |
| Ransomware | Varies | Varies | Locks files for ransom |
| Keylogger | No | No (installs via Trojan) | Steals credentials |
Defences Against Malware
| Defence | How It Helps |
|---|---|
| Anti-malware software | Detects and removes known malware |
| OS and software updates | Closes security vulnerabilities |
| Firewall | Blocks suspicious traffic and unauthorised connections |
| Encryption | Makes stolen data unusable without the key |
| Backups | Allows recovery without paying ransom |
| User awareness | Avoids downloading from untrusted sources |
Exam Questions
Q: What is ransomware and how does an attacker typically benefit?
Ransomware encrypts the victim’s files, making them inaccessible. The attacker then demands a payment (usually Bitcoin) in exchange for the decryption key. Bitcoin is used because it is difficult for authorities to trace.
Q: What is the difference between a virus and a worm?
A virus requires human interaction to spread (e.g., running an infected file). A worm can spread automatically without any human action, self-replicating across networks.
Q: How does a Trojan differ from a virus?
A Trojan disguises itself as legitimate software to trick the user into installing it. Once installed it creates a backdoor for the attacker. It does not self-replicate.
Q: Explain why keeping software up to date is important for security.
Software often contains bugs and security flaws that hackers can exploit. Developers release patches to fix these flaws. Updating closes vulnerabilities before they can be exploited.
Exam Tip
Know how each type spreads and what damage it causes, this is the most commonly examined aspect of malware. The WannaCry example is worth mentioning for ransomware (2017, NHS).