5.3.1 - Malware, vulnerabilities and social engineering
Cyberattacks often succeed by combining harmful software, a weakness in technology and a decision made by a person. This lesson will help you distinguish malware types, explain how technical vulnerabilities are exploited, identify social-engineering techniques and follow their effects through a complete attack chain.
Three routes into a cyberattack
Cyberattack
A cyberattack is a deliberate attempt to gain unauthorised access to a digital system or to steal, change, destroy or disrupt its data and services.
An attacker needs a way into the target system. In this lesson, that route can involve harmful software, a weakness in technology, manipulation of a person, or a combination of all three.
| Route | Precise meaning | The useful question to ask |
|---|---|---|
| Malware | Software intentionally designed to carry out harmful or unauthorised actions. The word is shortened from malicious software. | What harmful code runs? |
| Technical vulnerability | A weakness or flaw in a digital system that could be used to make it behave in an unintended or unauthorised way. | What weakness can be exploited? |
| Social engineering | Deception used to persuade a person to reveal information or take an action that helps an attack. | What was the person manipulated into doing? |
To exploit a vulnerability means to use the weakness to produce an unintended effect. The vulnerability is the weakness; the exploit is the method or action that uses it. A weakness can exist before anyone attacks it.
Consider three short incidents:
- A hidden program records everything typed on a laptop. The immediate route is malware because harmful software is running.
- A flaw in a website lets a specially formed request bypass its login check. The route is exploitation of a technical vulnerability.
- A caller pretends to be a support technician and persuades a user to reveal a login code. The route is social engineering because the attacker manipulates a person.
These labels are not rivals. A socially engineered message can deliver malware, and that malware can exploit a technical vulnerability.
Do not call the weakness, the attack method and the harmful software the same thing: a vulnerability is exploited, while malware is installed or run and social engineering manipulates a person.
In a longer incident, classify each stage by its defining feature rather than choosing one label for the whole incident.
Viruses and worms
Viruses and worms are both self-replicating malware, but they do not depend on the same thing to spread.
| Feature | Virus | Worm |
|---|---|---|
| Form | Malicious code attached to or inserted into a host file or program | A standalone, self-contained malicious program |
| How replication starts | The infected host is run, activating the virus | The worm can run and replicate independently |
| How it spreads | Copies itself into other files or programs; infected files may then be shared | Copies itself to other computers, commonly by using network connections |
| Need for activation | The infected host must run; this often happens when a user opens or launches it | It can propagate without a host file being run for each new copy |
| Possible harm | Corrupting, changing or deleting files; running another harmful action | Consuming processing/network resources, disrupting services or carrying another harmful action rapidly across a network |
Worked classification: A modified game contains code that copies itself into other executable files only after the game is launched. This is a virus: it is attached to a host program, and running that host activates it. On the same network, a separate program scans for other vulnerable computers and copies itself to them without each user opening a file. This is a worm: it is standalone and self-propagating.
The misconception to avoid is that every program which spreads is a virus. The discriminating feature is whether the malware needs a host file or program.
Trojans, ransomware and key loggers
Some malware is classified by how it deceives a user; other malware is classified by the harmful action it performs. This means that more than one label can sometimes describe different parts of the same malicious program.
| Type | Defining characteristic | How it threatens a digital system |
|---|---|---|
| Trojan | Appears to be legitimate or useful software but contains a hidden malicious function. It is often installed or run because a user is persuaded by the disguise, and it is not defined by self-replication. | It may steal data, create unauthorised remote access or install other malware. |
| Ransomware | Prevents access to a device or data, often by locking the device or encrypting files, and demands payment. | It disrupts use of the system and supports extortion. Paying does not guarantee that access or data will be restored. |
| Key logger | Records the keys pressed on a keyboard. | A malicious key logger can capture typed usernames, passwords, payment details or messages and pass them to an attacker. |
Worked classifications:
- A free image converter performs the advertised conversion but also secretly creates remote access for an attacker. It is a Trojan because useful-looking software hides malicious behaviour.
- A program encrypts a studio's photographs and displays a demand for payment to restore access. It is ransomware because it denies access and demands a ransom.
- A hidden program records a user's keystrokes and sends typed credentials to an attacker. It is a malicious key logger because recording keystrokes is the defining action.
A fake planner could be a Trojan because of its disguise and could install a key logger as its hidden payload. The two names identify different features; neither turns it into a virus unless it also attaches to host files and replicates in the way a virus does.
Technical vulnerabilities
Technical vulnerability
A technical vulnerability is a weakness or flaw in a digital system's technology that an attacker could exploit.
Continue this lesson.
You’re previewing NovaLearn without an account. Create a free account to read the rest.
Create free account