CAIE 9618 · Paper 3 · Topic 3.5.1

Security
Threats

Malware · Social Engineering · SQL Injection · XSS · Buffer Overflow · Countermeasures

CSZone Cambridge International AS & A Level Computer Science 9618

Malware Types

Malicious Software — Know Each Type

Type	How it Spreads	What it Does
Virus	Attaches to files; spreads when file opened/copied	Corrupts/deletes files; replicates itself into other programs
Worm	Self-replicates across networks — no host file needed	Consumes bandwidth; can deliver payload (ransomware)
Trojan	Disguised as legitimate software	Creates backdoor; doesn't self-replicate
Spyware	Bundled with software; social engineering	Records keystrokes, screens, passwords; sends to attacker
Adware	Bundled with free software	Displays unwanted ads; tracks browsing behaviour
Ransomware	Email attachments; malicious sites	Encrypts victim's files; demands payment for decryption key
Rootkit	Exploits OS vulnerabilities	Hides malware at OS level; very hard to detect or remove
Keylogger	Often component of spyware/Trojan	Records every keystroke — captures passwords and credit card numbers

Social Engineering

Exploiting People, Not Systems

Social engineering manipulates people into revealing confidential information or performing actions that compromise security. No technical hacking required — humans are the vulnerability.

TYPES

Phishing — fraudulent emails pretending to be from a trusted source (bank, HMRC) to steal login credentials

Spear phishing — targeted phishing using personal information about the victim to appear more convincing

Vishing — voice phishing over telephone

Pretexting — fabricated scenario to gain trust (e.g. impersonating IT support)

Baiting — leaving infected USB sticks in public places

Tailgating — following an authorised person through a secure door

COUNTERMEASURES

User education and security awareness training

Email filtering / spam detection

Multi-factor authentication (MFA)

Verify caller identity through official channels

Physical access controls (badges, entry systems)

SQL Injection

Malicious SQL in Web Forms

SQL injection inserts malicious SQL into input fields that are passed to a database query without sanitisation. The injected SQL changes the query's logic.

-- Intended query:
SELECT * FROM users
WHERE username = 'alice'
AND password = 'secret';

-- Attacker inputs: ' OR 1=1 --
SELECT * FROM users
WHERE username = '' OR 1=1 --
AND password = '...';
-- Returns ALL rows → bypass login

WHAT ATTACKERS CAN DO

Bypass authentication

Dump entire database (usernames, passwords, credit cards)

Modify or delete database records

Execute commands on the database server

PREVENTION

Parameterised queries / prepared statements — treat input as data, not code

Input validation and sanitisation

Least-privilege database accounts

Exam Practice

Cambridge-style questions

Question 1

A web application uses the following query to log in users: SELECT * FROM users WHERE username = 'input' AND password = 'input'. Explain how a SQL injection attack could allow an attacker to bypass authentication, and state one way to prevent this attack. [4]

1

The attacker enters a username such as ' OR 1=1 -- into the username field.

1

This changes the SQL query to always evaluate as true (1=1 is always true), so the WHERE clause is satisfied for every row in the table.

1

The comment symbol (--) causes the rest of the query (including the password check) to be ignored, so authentication is bypassed without knowing any valid password.

1

Prevention: use parameterised queries (prepared statements) — the SQL structure is defined first and user input is passed as a parameter, so it is always treated as data and can never alter the query structure.

Common Mistakes

Don't lose easy marks

1

Saying "a firewall prevents SQL injection" — firewalls filter network traffic at the IP/port level but cannot inspect SQL within HTTP requests. SQL injection is an application-layer vulnerability requiring input validation and parameterised queries to prevent.

2

Confusing virus and worm — a virus needs a host file to spread; a worm self-replicates over networks without needing a host file. Mark schemes specifically ask for the propagation method — "spreads through a network without a host file" = worm.

3

Saying phishing "hacks the website" — phishing does NOT attack the server. It deceives the user into voluntarily submitting their credentials. The victim's browser sends data to a fake site — no server is hacked in the attack itself.

Topic Summary — 3.5.1

What You Need to Know

MALWARE

Virus (host file), Worm (self-replicates via network), Trojan (disguised, no replication), Ransomware (encrypts files), Spyware (records activity), Rootkit (hides in OS), Keylogger.

SOCIAL ENGINEERING

Phishing, spear phishing, vishing, pretexting, baiting, tailgating. Counter: training, MFA, email filtering, access controls.

SQL INJECTION

Malicious SQL in input field alters query logic. ' OR 1=1 -- bypasses authentication. Prevention: parameterised queries (prepared statements) + input validation.

CSZone

Next Video

3.5.2

Encryption

Symmetric · Asymmetric · TLS/SSL · Digital Certificates

Head to CSZone.co.uk for the complete worksheet, quiz, and interactive tools