AQA 7517 · Paper 2 · 4.9.4a

Malware &
Social Engineering

Cyber threats: malware types · phishing · DoS · social engineering

WHAT YOU'LL LEARN

Viruses · trojans · ransomware · spyware · phishing · DoS/DDoS

AQA SPEC LINK

4.9.4 — Threats: malware, social engineering, DoS, brute force, SQL injection

Malware

Types of Malware

Virus — malicious code that attaches itself to legitimate files and spreads when those files are executed; requires user action to spread

Worm — self-replicating malware that spreads across networks without user interaction

Trojan — disguised as legitimate software; creates backdoors or downloads other malware; does not self-replicate

Ransomware — encrypts user's files; demands payment (ransom) for decryption key

Spyware — secretly monitors user activity, keystrokes, and sends data to attacker

Adware — displays unwanted ads; often bundled with free software

Phishing

Phishing Attacks

Phishing — fraudulent emails/messages designed to trick users into revealing credentials or installing malware. Impersonates trusted organisations (banks, HMRC, tech companies).

Spear phishing — targeted attack on a specific individual, using personalised information

Smishing — phishing via SMS text message

Vishing — phishing via voice call (phone scam)

Defence: check sender email, hover over links, never enter credentials via email links, 2FA

Social Engineering

Manipulating people (not systems) into divulging information or performing actions that compromise security. Exploits human psychology rather than technical vulnerabilities.

Pretexting — inventing a scenario (e.g. pretending to be IT support) to extract information

Baiting — leaving infected USB drives in car parks for curious employees to plug in

Tailgating — following an authorised person through a secure door

Defence: security training, never share passwords, verify identity

DoS & DDoS

Denial of Service Attacks

DoS — Denial of Service

Floods a server with requests from ONE machine until it is overwhelmed and cannot respond to legitimate users.

DDoS — Distributed Denial of Service

Same idea but uses a botnet (thousands of compromised machines) to send requests simultaneously. Much harder to block — traffic comes from many IP addresses.

Other Threats

Brute Force & SQL Injection

Brute Force Attack

Systematically trying every possible password or key until the correct one is found. Mitigated by: account lockout policies, strong passwords, multi-factor authentication (MFA).

SQL Injection

Inserting malicious SQL code into an input field to manipulate the database. Example: entering '; DROP TABLE Users; -- into a login form. Fixed by: parameterised queries, input validation.

Man in the Middle

Man-in-the-Middle (MitM) Attacks

Attacker secretly intercepts and possibly alters communications between two parties who each believe they are communicating directly with the other.

ARP spoofing on a LAN — attacker sends fake ARP replies to associate their MAC with the router IP

Evil twin WiFi (as covered in 4.9.2b)

Defence: HTTPS/TLS encrypts data so even if intercepted, content cannot be read; certificate validation detects fake servers

Defences

Defences Against Malware & Attacks

Antivirus/anti-malware — scans files using signature database and heuristic detection

Software updates/patches — closes known vulnerabilities exploited by malware

Multi-factor authentication (MFA) — password alone is insufficient for access

User training — recognise phishing, social engineering; not clicking suspicious links

Regular backups — recover from ransomware without paying the ransom

Principle of least privilege — users only have access to what they need

AQA Exam Style

Practice Question

AQA 7517 — Paper 2 Style

(a) Describe the difference between a virus and a worm. [2]
(b) A user receives an email appearing to be from their bank asking them to confirm their password. Name this type of attack and explain how it works. [3]
(c) Explain what a DDoS attack is and why it is more difficult to defend against than a DoS attack. [3]

[8 marks]

2 marks

(a) A virus attaches to files and requires user action (e.g. running a file) to spread [1]; a worm spreads automatically across networks without user interaction [1]

3 marks

(b) Phishing [1]; the attacker impersonates a trusted organisation (bank) via a fraudulent email [1]; the email contains a link to a fake website where the victim unknowingly enters their credentials which the attacker then captures [1]

3 marks

(c) DDoS uses a botnet (many compromised machines) to simultaneously flood a server with requests until it is overwhelmed [1 for basic description]; unlike DoS (one machine), DDoS traffic comes from thousands of different IP addresses [1]; blocking by IP is ineffective because the volume of source IPs is too high / legitimate traffic cannot be easily distinguished [1]

Summary

Key Points to Remember

Malware types: virus (spreads via files), worm (self-replicates over network), trojan (disguised), ransomware (encrypts + ransom), spyware

Phishing — fake emails to steal credentials; spear phishing = targeted

Social engineering — exploits humans: pretexting, baiting, tailgating

DoS — flood from one machine; DDoS — botnet (many machines), harder to block

Defences: antivirus, patches, MFA, training, backups, least privilege

🎉 Lesson complete — move to the quiz!