Malware and Attack Types

Context: Information Security and Cryptography · the threats the security stack defends against · attacker techniques + the virus/worm/trojan taxonomy

Quick Revision

• 🎯 Objective: classify the common attack + malware types ➔ recognise the mechanism (deceive a human, encrypt for ransom, enslave a device, exhaust a service, or self-replicate).
• ⚡ Key Constraint: “only careless people get malware” is false — malware spreads without user interaction (e.g. Angler exploit kit in ads on BBC/NYT, 2016), and anti-virus only catches known threats.

📝 Attack types

• Phishing ➔ fake login website + a lure (fake mail/SMS) → victim types credentials → attacker phishes them (banks, PayPal, enterprise access).
• Ransomware ➔ malware that encrypts all data (and IoT) and demands ransom (BitCoin) to restore access; increasingly also threatens to publish data. Advice: don’t panic, restore from backup, don’t pay (no guarantee + funds crime).
• Social engineering ➔ manipulate people rather than systems.
• Denial of Service (DoS/DDoS) ➔ prevent a service from working — from inside (virus/trojan) or outside via massive traffic from a botnet.

🤖 Bots & botnets

• Bot ➔ automated process on any compromised device; connects to a command-and-control centre; can gather info (camera, keystrokes), and run distributed attacks.
• Botnet ➔ many bots together → the engine behind DDoS (cf. Dyn).

🦠 Virus vs worm vs trojan

• Virus ➔ inserts itself into another program/document; spreads when the host runs; may pull in more malware/rootkits.
• Worm ➔ standalone program; exploits a weakness or tricks the user; then self-spreads via network/file transfer.
• Trojan ➔ malware hidden in legitimate-looking software; creates backdoors, manipulates banking, activates other malware.

⚠️ Common Mistakes

• 💡 Virus needs a host, a worm does not ➔ the defining line: a virus attaches to another program; a worm is self-contained and self-propagating.
• 💡 Anti-virus is not a cure-all ➔ it stops known malware, is a prime malware target, can’t detect new malware, and may increase the attack surface — layer it with updates/backups/awareness.

🧠 Active Recall

"I'm careful, so I won't get malware" — why is this reasoning unsafe?

Answer

• Short answer: malware can infect without any user interaction — e.g. malvertising via the Angler exploit kit served through ads on mainstream sites (BBC, NYT, 2016) infects simply by loading the page.
• Why: Drive-by compromise ➔ active content exploits browser/plugin vulnerabilities directly, so defence relies on security updates, backups, and scanning, not just careful behaviour.