Malware · Phishing · Brute-Force · Denial of Service · Data Interception · SQL Injection
CSZoneOCR GCSE Computer Science J277
Learning Objectives
By the end of this video you will be able to...
Describe malware and identify the different types — virus, worm, trojan, ransomware and spyware — including how each works and what it does
Explain social engineering and describe how phishing works, including why people are considered the 'weak point' in security
Describe how a brute-force attack works and explain what makes it more or less effective
Explain how a denial of service (DoS) attack works and describe its impact on a system or business
Describe data interception and theft, and explain how SQL injection is used to attack databases
⚡ Topic 1.4.1 — for each attack type, you must know: what it is, how it is used, and its purpose.
Network Security
Why are computer systems at risk?
THE THREAT LANDSCAPE
Any computer system connected to a network is potentially at risk from attack. Attackers — sometimes called hackers or threat actors — may target individuals, companies, or governments for a range of purposes: financial gain, data theft, disruption, or espionage.
💰
FINANCIAL GAIN
Stealing bank details, ransomware payments, selling data
🗄️
DATA THEFT
Stealing personal data, passwords, intellectual property
⚡
DISRUPTION
Taking systems offline, damaging reputation
SIX ATTACK TYPES YOU NEED TO KNOW
MalwareSocial Engineering / PhishingBrute-ForceDenial of ServiceData Interception & TheftSQL Injection
⚡ For each attack type, you must know: what it is, how it is used, and its purpose/impact. These are the three things the spec says you need.
Attack Type
Malware — malicious software
DEFINITION
Malware is any software intentionally designed to disrupt, damage or gain unauthorised access to a computer system. It is installed without the user's knowledge or consent.
🦠
Virus
Attaches itself to legitimate files. Spreads when infected files are shared. Can corrupt or delete data, slow down systems, or cause unexpected behaviour.
🪱
Worm
Self-replicates and spreads across networks without needing to attach to a file or any user action. Can consume bandwidth, slow networks, and deliver payloads.
🐴
Trojan
Disguises itself as legitimate software. Once installed, it creates a backdoor giving attackers remote access to the system — without the user realising.
🔒
Ransomware
Encrypts the victim's files, making them inaccessible. Demands a ransom payment (usually cryptocurrency) in exchange for the decryption key.
🕵️
Spyware
Secretly monitors user activity and sends data back to the attacker — passwords, keystrokes, browsing habits. Often installed alongside free software.
⚡ Key distinction: a virus needs a host file; a worm spreads independently. A trojan looks legitimate but opens a backdoor. Ransomware encrypts and demands payment.
Attack Type
Social engineering & phishing
SOCIAL ENGINEERING — DEFINITION
Social engineering manipulates people into revealing confidential information or performing actions that compromise security. Rather than attacking technical systems directly, it exploits human psychology — trust, fear and urgency. People are the weakest point in any security system.
PHISHING — DEFINITION
Phishing is a social engineering attack where fraudulent emails or messages are sent that appear to come from trusted sources — banks, companies, or colleagues. The aim is to trick victims into clicking malicious links or revealing passwords and personal data.
HOW A PHISHING ATTACK WORKS
1
Attacker sends a fake email that looks like it's from a bank or trusted company ("Your account has been suspended")
2
Email contains a link to a fake website that looks identical to the real one
3
Victim enters their username and password on the fake site, believing it to be genuine
4
Attacker captures the credentials and uses them to access the victim's real account
⚡ Phishing works because it targets people, not systems. Technical security can be perfect, but a single employee clicking a link can bypass it all. This is why "people are the weak point" is a key spec phrase.
Attack Type
Brute-force attacks
DEFINITION
A brute-force attack systematically tries every possible combination of characters until the correct password or encryption key is found. It does not rely on any knowledge of the target — it simply tries everything.
How it works: automated software generates and tests thousands — or even millions — of password combinations per second. Short, simple passwords can be cracked in seconds; longer, complex passwords take far longer.
Purpose: to gain unauthorised access to an account, system, or encrypted file by discovering the password or key.
MORE EFFECTIVE AGAINST
Short passwords (fewer combinations). Simple passwords — only letters or numbers. Common passwords (e.g. "password123"). No account lockout after failed attempts.
LESS EFFECTIVE AGAINST
Long passwords (exponentially more combinations). Mixed characters — upper/lower case, numbers, symbols. Account lockout after a set number of failed attempts.
⚡ A brute-force attack is purely trial-and-error — no cleverness, just computation. The defence is making the number of combinations so large that it would take too long to try them all.
Attack Type
Denial of service (DoS) attacks
DEFINITION
A denial of service (DoS) attack floods a server or network with so many requests that it becomes overwhelmed and unable to respond to legitimate users — effectively taking the service offline.
How it works: the attacker sends an enormous volume of traffic or requests to a web server. The server spends all its resources trying to process this flood and cannot respond to real users. The website or service becomes unavailable.
DDoS — DISTRIBUTED DENIAL OF SERVICE
A DDoS attack is a DoS attack launched from many devices simultaneously — often thousands of compromised computers forming a botnet. This makes it far harder to block, as the traffic comes from many different sources.
IMPACT
💸 Financial loss — a business that cannot process online orders loses revenue for every minute the site is down
🎭 Distraction — DoS attacks are sometimes used to distract IT teams while another attack (e.g. data theft) is carried out
Attack Type
Data interception & theft
DEFINITION
Data interception involves capturing data as it travels across a network, without the knowledge of the sender or receiver. Data theft refers to stealing data directly from a device or system — physically or via software.
Packet sniffing: specialised software captures data packets as they travel across a network. If data is unencrypted — for example, sent over HTTP rather than HTTPS — the attacker can read usernames, passwords and other sensitive information directly.
Man-in-the-middle attack: an attacker secretly positions themselves between two communicating parties, intercepting and potentially modifying the data before passing it on — neither party is aware.
Physical data theft: stealing devices such as laptops, hard drives or USB drives containing sensitive data. Also includes copying data to removable media and physically removing it from a building.
Keyloggers: malware that records every keystroke typed — including passwords and card numbers — and sends the data back to the attacker.
⚡ Data interception is why encryption matters so much — especially on wireless networks. Encrypted data that is intercepted appears as meaningless gibberish without the decryption key.
Attack Type
SQL injection
DEFINITION
SQL injection is an attack where malicious SQL code is inserted into an input field — such as a login form or search box — on a website. If the website is vulnerable, the injected code is executed by the database, giving the attacker unauthorised access.
HOW IT WORKS
A login form expects a username and password. An attacker enters SQL code instead:
Username: admin' OR '1'='1 Password: anything
Because '1'='1' is always true, the database returns all user records — and the attacker is logged in without a valid password.
PURPOSE & IMPACT
📤 Read data — extract usernames, passwords, email addresses, payment details from the database
🔑 Bypass authentication — log in to accounts without knowing the password
✏️ Modify data — change or delete records stored in the database
💥 Destroy data — delete tables or entire databases, causing major disruption
⚡ SQL injection targets databases through unvalidated user input. The fix is input validation — checking and sanitising what users type before it reaches the database. This is covered in 1.4.2.
Exam Application
Identifying attacks in context
Scenario A
A user receives an email claiming their bank account has been suspended. The email contains a link asking them to log in and verify their details on a website that looks identical to their bank's real site.
ATTACK TYPE: PHISHING (Social Engineering)
The fake email creates urgency, the fake site harvests credentials. The attacker exploits trust rather than technical vulnerabilities — targeting the person, not the system.
Scenario B
An online retailer's website becomes completely unavailable for several hours. Server logs show millions of requests arriving every second from thousands of different IP addresses worldwide.
ATTACK TYPE: DDoS (Distributed Denial of Service)
Millions of requests from thousands of IPs = distributed (from many sources) + denial of service (server overwhelmed). A botnet is almost certainly being used. Impact: lost sales and damaged reputation.
Putting It Together
Threats to computer systems — the big picture
MALWARE
Virus (attaches to files) · Worm (self-replicates on network) · Trojan (disguised, creates backdoor) · Ransomware (encrypts, demands payment) · Spyware (steals data secretly)
SOCIAL ENGINEERING / PHISHING
Exploits people, not systems. Fake emails/sites trick users into revealing credentials. People are the weakest point.
BRUTE-FORCE
Tries every possible password combination automatically. More effective against short/simple passwords. Defeated by long, complex passwords and account lockout.
DENIAL OF SERVICE (DoS / DDoS)
Floods server with traffic until it is unavailable. DDoS uses a botnet (many machines). Causes financial loss and disruption.
DATA INTERCEPTION & THEFT
Packet sniffing, man-in-the-middle, keyloggers, physical theft. Targets unencrypted data. Encryption is the key defence.
SQL INJECTION
Malicious SQL entered in input fields. Executed by database — reads, modifies or deletes data; bypasses authentication. Fixed by input validation.
Exam-Style Questions
Threats to Computer Systems
Question 1
Describe what is meant by a phishing attack.
2 marks
1
A phishing attack involves sending fraudulent emails or messages that appear to come from a trusted source (e.g. a bank or company). (1 mark)
1
The aim is to trick the recipient into clicking a link to a fake website and entering personal details (e.g. passwords, card numbers), which the attacker then captures. (1 mark)
Question 2
Explain how a brute-force attack works.
2 marks
1
A brute-force attack systematically tries every possible combination of characters to find a password or encryption key. (1 mark)
1
It is carried out by automated software that can test many thousands of combinations per second until the correct one is found. (1 mark)
Question 3
A company's website becomes unavailable for several hours after being targeted by a distributed denial of service (DDoS) attack. Describe how the attack works and explain one way it could damage the company.
3 marks
Common Mistakes
Four mistakes that cost marks in the exam
1
Confusing a DoS attack with malware. A denial of service attack does not install software on the victim's system — it simply floods it with traffic. It is a network-level attack, not a software infection. Don't say a DoS attack "installs a virus" or "hacks the server."
2
Describing phishing as "hacking." Phishing is social engineering — it exploits human trust and psychology, not technical vulnerabilities. The attacker does not break into any system; they trick the victim into voluntarily handing over their credentials. Make this distinction explicit in answers.
3
Confusing a virus with a worm. A virus attaches to a file and requires that file to be shared or executed to spread. A worm self-replicates and spreads independently across a network without any user action or host file. They spread in different ways — this is a common exam distinction.
4
Describing SQL injection as password guessing. SQL injection is not guessing — it inserts malicious SQL commands into an input field. The database executes those commands directly, bypassing authentication entirely. Password guessing is brute force; SQL injection exploits poor input validation.
Summary
1.4.1 — Threats to Computer Systems
MALWARE
Virus (host file, spreads via sharing) · Worm (self-replicates on network) · Trojan (fake legit software, backdoor) · Ransomware (encrypts, demands payment) · Spyware (steals data secretly)
SOCIAL ENGINEERING / PHISHING
Exploits people (the "weak point"), not systems. Fake emails/sites trick users into revealing credentials.
BRUTE-FORCE
Systematically tries all password combinations. Automated. Defeated by long/complex passwords and account lockout.
DoS / DDoS
Floods server with requests until it goes offline. DDoS = from many devices (botnet). Causes downtime and financial loss.
EXAM TIP
For every attack: state what it is, how it works, and its purpose/impact. In scenario questions, identify the attack type and justify your answer using evidence from the scenario.
1.4.1 Complete
That's 1.4.1 done!
Next up: 1.4.2 — Identifying and Preventing Vulnerabilities