Malware

Malware — short for malicious software — is any software intentionally designed to cause damage, disruption or unauthorised access to a computer system. This lesson covers the main types of malware that appear on the GCSE Computer Science specification: viruses, worms, trojans, ransomware and spyware.

---

How Malware Spreads

Malware can reach a computer through many routes:

• Email attachments — an infected file disguised as a document or invoice
• Malicious websites — visiting a compromised or fake website triggers a download
• Infected USB drives — plugging in a device that carries malware
• Software downloads — downloading pirated or unofficial software
• Network vulnerabilities — exploiting unpatched flaws to spread automatically

---

Viruses

A computer virus is a type of malware that attaches itself to a legitimate file or program. It only activates and spreads when the host file is opened or executed by the user.

Key Characteristics of Viruses

• Require user action — the virus does not spread until someone opens the infected file
• Self-replicating — once activated, the virus copies itself to other files on the system
• Payload — the virus carries a "payload" that determines its effect (e.g. deleting files, corrupting data, displaying messages)

How Viruses Work — Step by Step

1. The attacker creates malware and attaches it to a legitimate file (e.g. a Word document)
2. The infected file is distributed (via email, USB, download)
3. The victim opens the file, activating the virus
4. The virus copies itself to other files and programs on the computer
5. The payload executes — this might delete data, slow the system or open a backdoor

---

Worms

A worm is similar to a virus in that it self-replicates, but with one critical difference: worms spread automatically across networks without any user action.

Key Characteristics of Worms

• No user action required — worms exploit network vulnerabilities to spread
• Self-replicating — they copy themselves from computer to computer
• Network impact — worms consume bandwidth and can slow entire networks
• No host file needed — worms are standalone programs

Real-World Example: WannaCry (2017)

The WannaCry attack combined ransomware with worm-like behaviour. It exploited a vulnerability in Windows (called EternalBlue) to spread automatically across networks. Over 200,000 computers in 150 countries were affected, including many NHS hospitals in the UK. Patient records became inaccessible, forcing hospitals to cancel appointments and divert ambulances.

---

Trojans

A trojan (named after the Trojan Horse from Greek mythology) disguises itself as legitimate, useful software. Once installed, it performs malicious actions in the background without the user's knowledge.

Key Characteristics of Trojans

• Disguised as legitimate software — e.g. a free game, media player or system utility
• Do NOT self-replicate — trojans rely on the user to download and install them
• Backdoor access — many trojans create a "backdoor" that allows the attacker to control the victim's computer remotely
• Data theft — trojans can steal passwords, screenshots and files

How a Trojan Works

1. The attacker creates malware and packages it inside a legitimate-looking application
2. The victim downloads and installs the application (e.g. from a fake download site)
3. The trojan runs silently in the background
4. The attacker can now remotely control the victim's computer, steal data or install additional malware

---

Ransomware

Ransomware encrypts the victim's files and demands a payment (ransom) — usually in cryptocurrency — in exchange for the decryption key.

Key Characteristics of Ransomware

• Encrypts files — documents, photos, databases and other files become inaccessible
• Demands payment — a ransom note appears on screen with payment instructions
• Time pressure — attackers often set a deadline after which the ransom increases or the data is deleted
• No guarantee — paying the ransom does not guarantee the attacker will provide the key

Why You Should Not Pay the Ransom

Reason	Explanation
No guarantee of recovery	The attacker may not provide a working decryption key
Funds criminal activity	Payment encourages further attacks
May be targeted again	Paying shows the victim is willing to pay, making them a target for future attacks
Legal issues	In some jurisdictions, paying a ransom to certain groups may breach sanctions laws

Defences Against Ransomware

• Regular backups stored offline or in the cloud — if files are encrypted, they can be restored from a clean backup
• Up-to-date anti-malware software to detect and block ransomware
• Patching and updating software to close vulnerabilities
• User training to avoid phishing emails that deliver ransomware

---

Spyware

Spyware is malware that secretly monitors the victim's activity and sends the collected data to the attacker. It runs in the background without the user's knowledge.

What Spyware Can Collect

• Keystrokes (using a keylogger) — capturing everything the user types, including passwords
• Screenshots — periodic captures of the user's screen
• Browsing history — websites visited, searches performed
• Personal files — documents, photos, emails
• Webcam and microphone — some spyware can activate these without the user's knowledge

---

Adware

Adware displays unwanted advertisements on the user's computer. While not always classified as malware (some adware is bundled with free software and disclosed in the terms of service), malicious adware:

• Displays intrusive pop-up adverts
• Redirects the browser to advertising websites
• Slows down the computer
• May track browsing habits and sell the data

---

Comparison Table

Feature	Virus	Worm	Trojan	Ransomware	Spyware
Self-replicates	Yes	Yes	No	No	No
Needs user action	Yes	No	Yes (installation)	Varies	Varies
Attaches to files	Yes	No	No (standalone disguise)	No	No
Main purpose	Damage/disrupt	Spread/consume resources	Backdoor/theft	Extort money	Monitor/steal data
Spreads over network	Only via shared files	Automatically	No	Via email/exploits	Via downloads/email

---

Defending Against Malware

Defence	How It Helps
Anti-malware software	Detects and removes known malware using signatures and heuristics
Keeping software updated	Patches close vulnerabilities that malware exploits
Firewall	Blocks unauthorised network traffic, limiting worm spread
Email filtering	Blocks malicious attachments before they reach users
User education	Teaches staff to avoid suspicious downloads and links
Regular backups	Allows recovery from ransomware without paying
Least privilege access	Limits the damage malware can do if it infects one account

---

Key Terms Summary