Digital Cyber Threats & Malware

As computing systems become increasingly interconnected, individuals and organizations face a wide variety of malicious cyber threats. Understanding the operational mechanics of malware, social engineering, and network attacks is the first step toward effective computer security.

Learning Objectives

• Differentiate between various classes of Malware: Viruses, Worms, Trojan Horses, Ransomware, and Spyware.
• Compare and contrast social engineering and web redirection threats: Phishing vs Pharming.
• Explain how Brute-Force Attacks attempt to compromise authentication.
• Describe the architecture and impact of a Distributed Denial of Service (DDoS) attack using a botnet.

1. Malware (Malicious Software)

Malware is an umbrella term for any software written intentionally to damage, disrupt, exploit, or gain unauthorized access to computer systems:

+-------------------+
                               |      MALWARE      |
                               +-------------------+
                                         |
     +-----------------+-----------------+-----------------+-----------------+
     |                 |                 |                 |                 |
     v                 v                 v                 v                 v
 [ VIRUS ]         [ WORM ]          [ TROJAN ]      [ RANSOMWARE ]     [ SPYWARE ]
 Needs host file;  Standalone;       Disguised as     Encrypts files;   Secretly records
 replicates on     replicates over   legitimate app;  demands ransom    keystrokes and
 execution         networks          opens backdoor   payment           passwords

A. Computer Virus

• Mechanism: A piece of malicious code that attaches itself to a legitimate host program or executable file.
• Replication: Cannot replicate on its own; it replicates only when a human user executes the infected host program.
• Harm: Corrupts or deletes files, alters system settings, or formats disks.

B. Network Worm

• Mechanism: A standalone malicious program that does not require a host file or human intervention.
• Replication: Actively scans networks for unpatched software vulnerabilities and self-replicates automatically from computer to computer across network sockets.
• Harm: Saturates network bandwidth, consumes server CPU resources, and creates botnets.

C. Trojan Horse

• Mechanism: Malicious software disguised as a completely harmless, desirable program (e.g. a free game, cracked utility, or software update).
• Harm: Once installed by the deceived user, it releases an embedded payload that opens a hidden backdoor allowing cybercriminals to control the system remotely.

D. Ransomware

• Mechanism: Sneaks onto a computer (via phishing attachments or drive-by downloads) and silently executes high-grade symmetric/asymmetric encryption algorithms on all user files, photos, and databases.
• Harm: Demands an untraceable cryptocurrency ransom (e.g. Bitcoin) in exchange for the decryption key, threatening permanent deletion if not paid.

E. Spyware & Keyloggers

• Mechanism: Software that installs secretly and monitors user activities without consent.
• Keylogger: Intercepts hardware interrupts to record every single keystroke typed on the keyboard, capturing passwords, credit card numbers, and confidential messages, and secretly transmitting them to an external server.

2. Social Engineering: Phishing vs Pharming

Both phishing and pharming aim to steal confidential credentials (usernames, banking passwords, PINs), but they operate through completely different mechanisms:

3. Brute-Force Attacks

A brute-force attack is an automated trial-and-error method used to guess passwords or encryption keys:

• Specialized software attempts thousands or millions of password combinations per second (starting from aaaa up to complex character sets) until the correct key is found.
• Dictionary Attack: A variant that tries hundreds of thousands of common words and known breached passwords.
• Countermeasures: Enforcing complex passwords (mixed case, symbols, numbers), limiting consecutive failed login attempts (account lockout), and implementing Multi-Factor Authentication (MFA).

4. Distributed Denial of Service (DDoS) Attacks

A Denial of Service (DoS) attack aims to prevent legitimate users from accessing a web service or network resource by flooding it with overwhelming traffic.

When launched from thousands of independent computers simultaneously, it is called a Distributed Denial of Service (DDoS):

[ Cybercriminal (Botmaster) ]
                             |
         Command & Control Server Instructions
                             |
           +-----------------+-----------------+
           |                                   |
           v                                   v
   [ Zombie Bot 1 ]                     [ Zombie Bot 2 ] ... (Thousands of infected bots)
           |                                   |
           +-----------------+-----------------+
                             |
             Millions of HTTP/UDP Flood Packets
                             |
                             v
                 [ TARGET WEB SERVER CRASHES ]

The DDoS Lifecycle:

1. Building the Botnet: Attackers infect thousands of vulnerable computers, smart TVs, routers, and IoT devices worldwide with malware (forming a botnet of "zombie" computers).
2. Coordinated Strike: The botmaster sends a command instructing all zombie bots to simultaneously bombard the target web server with dummy connection requests and network packets.
3. Resource Exhaustion: The target server's network bandwidth, memory, and CPU are completely saturated processing the traffic flood.
4. Service Crash: The web server becomes totally unresponsive or crashes, denying access to legitimate visitors and causing severe commercial damage.

Adware, hacking and interception

Adware displays unwanted advertising and may track activity. Hacking is unauthorised access to a computer or data; weak credentials or unpatched vulnerabilities can enable it. Interception captures data during transmission, for example on an insecure network. Encryption makes captured content harder to read but does not prevent every attack on endpoints.

Distinguish malware by behaviour: a virus attaches to a host and spreads when it runs; a worm can spread between systems without attaching to a host file; a Trojan disguises harmful behaviour as legitimate software; ransomware prevents access or encrypts data for a demand; spyware secretly gathers information, including keylogging.

Worked comparison

An email asks a user to enter a password on a lookalike site: phishing. Malicious software changes where a correct address leads: pharming. A valid HTTPS certificate for a lookalike domain does not make that domain the intended site.

Written practice and self-review

Organizations must understand cyber threats to deploy effective defences.

1. Compare Phishing and Pharming in terms of:

• How the attacker deceives or redirects the user.
• One sign a user can look for to detect or avoid the attack.

1. Describe how a Distributed Denial of Service (DDoS) attack operates using a botnet, and explain its impact on a target web server.

Write an explanation before checking the theory. Check that each claim answers the question, uses the correct concept and explains why it applies. Discuss uncertain points with a teacher. The structured exercise below checks specific facts; it does not automatically mark this explanation.