CS33: Cyber Security Threats
Social engineering techniques, types of malware, and other common cyber security threats and how they can combine.
📋 Social Engineering
Definition: Social engineering is manipulating people into revealing confidential information or performing actions that compromise security. It exploits human psychology rather than technical vulnerabilities.
Social engineering attacks target the weakest link in any security system: people. No matter how strong the technical security, a person can be tricked into giving away their password or clicking a malicious link.
Blagging (Pretexting)
Definition: Blagging is inventing a false scenario (pretext) to trick someone into revealing information. The attacker creates a convincing story to gain the victim's trust.
- Attacker creates a fake identity or scenario
- Common pretext: pretending to be from a bank, IT support, or authority
- Aims to extract personal data, passwords, or financial details
- Often done by phone but can be in person or by email
Example
An attacker phones an employee claiming to be from the IT department: "We've detected unusual activity on your account. I need you to confirm your password so we can secure it." The employee, trusting the caller's authority, gives their password. The attacker now has access to the system.
Phishing
Definition: Phishing is sending fraudulent emails that appear to come from a trusted source, designed to trick recipients into revealing personal information, clicking malicious links, or downloading malware.
- Mass emails sent to many people (casting a wide "net")
- Emails look like they come from banks, companies, or authorities
- Often contain urgent or threatening language ("Your account will be closed!")
- Include links to fake websites that look like the real ones
- Spear phishing: targeted at a specific individual using personal details
Example
An email appears to be from PayPal: "We noticed suspicious activity on your account. Click here to verify your identity." The link goes to a fake PayPal website that captures the victim's username and password when they try to log in.
Shouldering (Shoulder Surfing)
Definition: Shouldering is directly observing someone's screen or keyboard to obtain personal information, such as passwords or PIN numbers, by looking over their shoulder.
- Attacker physically watches the victim type
- Common in public places: cafes, trains, airports
- Can capture passwords, PINs, confidential data on screen
- Low-tech but effective method
Example
Someone on a train looks over a business person's shoulder as they type their email password and read a confidential document on their laptop. The observer now has the password and has seen sensitive information.
🦠 Malware
Definition: Malware (malicious software) is any software deliberately designed to cause damage to a computer, server, client, or network. Different types of malware have different purposes and methods.
Viruses
- Attaches itself to a legitimate program or file
- Requires a host file to spread - cannot spread on its own
- Activated when the host file is opened or run
- Can replicate by attaching to other files
- May delete files, corrupt data, or display messages
- Spread through email attachments, infected USB drives, or downloads
Trojans
- Disguised as legitimate, useful software
- Does NOT replicate itself (unlike a virus)
- User intentionally downloads and installs it, thinking it's safe
- Once installed, it performs malicious actions in the background
- Can create backdoors for remote access, steal data, or install other malware
- Named after the Trojan Horse from Greek mythology
Example
A user downloads what appears to be a free game. When they install it, the game works normally, but a trojan hidden within it silently records their keystrokes and sends their passwords to the attacker.
Spyware
- Secretly monitors and collects user activity and data
- Can record keystrokes (keylogger), capture screenshots, or track web browsing
- Sends the collected data back to the attacker
- Often installed without the user's knowledge (bundled with other software)
- Used to steal passwords, credit card details, and personal information
Ransomware
- Encrypts the victim's files, making them inaccessible
- Displays a message demanding payment (ransom) for the decryption key
- Often demands payment in cryptocurrency (difficult to trace)
- Can spread across networks, affecting many computers
- Paying the ransom does NOT guarantee files will be decrypted
Example
The WannaCry ransomware attack in 2017 encrypted files on over 200,000 computers across 150 countries. Victims saw a message demanding Bitcoin payment to unlock their files. Many organisations, including the NHS, were severely affected.
| Malware Type | How It Spreads | Primary Purpose | Replicates? |
|---|---|---|---|
| Virus | Attached to host files | Damage, corruption | Yes (needs host) |
| Trojan | Disguised as legitimate software | Backdoor access, data theft | No |
| Spyware | Bundled with other software | Monitoring, data collection | No |
| Ransomware | Email attachments, exploits | Extortion (encrypt files for ransom) | Varies |
🌐 Other Cyber Security Threats
Pharming
Definition: Pharming redirects users to a fake website even when they type the correct URL. It manipulates the DNS (Domain Name System) so that the legitimate web address points to the attacker's server.
- More sophisticated than phishing - no fake email needed
- Victim types the real URL but is taken to a fake site
- Achieved by modifying DNS entries or the host file on the victim's computer
- The fake website looks identical to the real one
- Used to capture login credentials and financial data
Weak and Default Passwords
- Many users choose simple, easily guessable passwords (123456, password)
- Default passwords on devices (routers, IoT devices) are often not changed
- Attackers can find default passwords online for any device model
- Brute force attacks try every possible password combination
- Dictionary attacks try common words and password lists
Misconfigured Access Rights
- Users given more access permissions than they need
- Former employees' accounts not deactivated when they leave
- Shared accounts where multiple people know the same credentials
- Admin access given to users who only need basic permissions
- Principle of least privilege: users should only have the minimum access needed
Removable Media
- USB drives can carry malware that auto-runs when plugged in
- Lost or stolen USB drives can expose sensitive data
- Attackers may leave infected USB drives in public places (baiting)
- Unauthorised copying of data onto removable media (data theft)
Unpatched and Outdated Software
- Software vulnerabilities are discovered regularly
- Patches and updates fix these security holes
- Unpatched software leaves known vulnerabilities open for attackers
- Attackers specifically target systems running outdated software
- Zero-day exploits attack vulnerabilities before a patch exists
🔗 How Threats Combine
Key Concept: Cyber security threats rarely work in isolation. Attackers often combine multiple techniques to increase their chances of success. A social engineering attack might deliver malware, which then exploits unpatched software.
Combined Attack Scenario
Step 1: A phishing email (social engineering) is sent to employees of a company, appearing to be from HR with an "urgent policy update" attachment.
Step 2: An employee clicks the attachment, which installs a Trojan on their computer.
Step 3: The Trojan exploits an unpatched vulnerability in the system to gain administrator access.
Step 4: Using the misconfigured access rights (the employee had more permissions than needed), the malware spreads across the network.
Step 5: The attacker installs ransomware that encrypts all company files and demands payment.
This single attack combined: phishing + Trojan + unpatched software + misconfigured access + ransomware.
⚠️ Common Mistakes to Avoid
| Mistake | Why It's Wrong | How to Fix It |
|---|---|---|
| Confusing virus and Trojan | Viruses replicate; Trojans don't | Virus = replicates via host file; Trojan = disguised software |
| Confusing phishing and pharming | Phishing tricks via email; pharming redirects URLs | Phishing = fake email; Pharming = fake website redirect |
| Saying "social engineering is a technical attack" | It targets people, not technology | Social engineering exploits human psychology |
| Forgetting to mention how threats combine | Real attacks often use multiple methods | Explain how phishing can lead to malware, etc. |
❓ Practice Questions
Q1: Explain the difference between phishing and pharming.
Q2: Describe four types of malware and how each one works.
Q3: What is social engineering? Describe blagging, phishing, and shouldering.
Q4: Why are weak and default passwords a security threat?
Q5: Explain how multiple cyber security threats could combine in a single attack.
✅ Answers
- Phishing sends fraudulent emails that appear to be from a trusted source, tricking users into clicking links to fake websites or revealing information. Pharming manipulates DNS so that even when the user types the correct URL, they are redirected to a fake website. Phishing requires the victim to click a link; pharming redirects automatically.
- Virus: attaches to a host file, replicates when the file is opened, can corrupt or delete data. Trojan: disguised as legitimate software, does not replicate, creates backdoors for attackers. Spyware: secretly monitors user activity, records keystrokes and sends data to attacker. Ransomware: encrypts files and demands payment for decryption.
- Social engineering manipulates people into revealing information or performing actions that compromise security. Blagging: inventing a false scenario to gain trust and extract information (e.g. pretending to be IT support). Phishing: sending fraudulent emails appearing to be from trusted sources. Shouldering: directly observing someone's screen or keyboard to capture passwords or data.
- Weak passwords (like 123456) can be easily guessed or cracked using brute force or dictionary attacks. Default passwords on devices are publicly known and can be found online, so any attacker can access a device if the default password hasn't been changed.
- A phishing email (social engineering) tricks a user into opening an attachment that installs a Trojan. The Trojan exploits unpatched software to gain elevated access. Because of misconfigured access rights, the malware spreads across the network. The attacker then installs ransomware to encrypt files and demand payment. This combines social engineering + malware + unpatched software + misconfigured access + ransomware.
🎯 Exam Tips
- Know each social engineering technique with specific examples
- Distinguish clearly between virus, Trojan, spyware, and ransomware
- Phishing = email; Pharming = URL redirect (know the difference)
- Always explain that social engineering targets PEOPLE, not technology
- Be prepared to explain how multiple threats combine in an attack
- Use specific, realistic examples rather than vague descriptions
⚠️ Common Errors
✗ Thinking phishing only happens via email ✓ Phishing can occur via email, text messages (smishing), phone calls (vishing), or fake websites. Any method of tricking users into revealing personal information is phishing.
✗ Confusing viruses and worms ✓ A virus attaches to a file and needs user action to spread. A worm is self-replicating and spreads automatically across networks without user intervention.
✗ Believing social engineering is a technical attack ✓ Social engineering manipulates people, not systems. It exploits human psychology (trust, urgency, authority) to gain information or access — no software vulnerability is needed.
✗ Thinking strong passwords alone prevent all unauthorised access ✓ Strong passwords are essential but don't prevent keylogging, phishing, brute force (given enough time), or credential reuse attacks. Multi-factor authentication adds critical additional protection.
✍️ Model Answer
Full-Mark Response
Describe three different types of cyber security threat, explaining how each works and one way to protect against it. [6 marks]
1. Phishing: An attacker sends a fraudulent message (email/text) pretending to be from a trusted source (e.g. a bank) to trick the victim into revealing personal information or clicking a malicious link. Protection: Never click links in unsolicited emails; verify the sender's address; look for HTTPS and check for suspicious URLs. 2. Malware (virus/worm/trojan): Malicious software that infects a device to steal data, damage systems, or gain unauthorised access. Viruses attach to files; worms spread automatically; trojans disguise as legitimate software. Protection: Install and regularly update antivirus software; do not download files from untrusted sources. 3. Brute force attack: An attacker systematically tries every possible password combination until the correct one is found, using automated software. Protection: Use strong, long passwords (12+ characters); implement account lockout after failed attempts; use multi-factor authentication.
📊 AO Deep Dive
Assessment Objective Analysis
AO1 (Computational Thinking — 40%): Demonstrate knowledge and understanding of the principles and concepts of computer science, including cyber security threats: malware, phishing and social engineering for AQA 8525, OCR J277 & Edexcel 1CP2.
AO2 (Application — 40%): Apply knowledge and understanding of computer science, including cyber security threats: malware, phishing and social engineering to analyse problems in computational terms and to design, write and evaluate solutions.
AO3 (Evaluation — 20%): Evaluate the effectiveness, correctness and efficiency of computational solutions, including cyber security threats: malware, phishing and social engineering, and make reasoned judgements about trade-offs.
📝 Exam Technique
GCSE Computer Science Exam Tips:
Threat types: malware (virus, worm, trojan, ransomware, spyware, keylogger), phishing, social engineering, brute force, DDoS, SQL injection. For each: describe HOW it works, its IMPACT, and a COUNTERMEASURE. Social engineering targets people, not technology. Viruses need user action, worms spread automatically. Ransomware encrypts files for payment. Always give specific examples.
Threat types: malware (virus, worm, trojan, ransomware, spyware, keylogger), phishing, social engineering, brute force, DDoS, SQL injection. For each: describe HOW it works, its IMPACT, and a COUNTERMEASURE. Social engineering targets people, not technology. Viruses need user action, worms spread automatically. Ransomware encrypts files for payment. Always give specific examples.
📝 Exam Questions by Topic
- AQA Past Papers - Topic Questions -- AQA
- Edexcel Past Papers - Topic Questions -- Edexcel
- OCR Past Papers - Topic Questions -- OCR
- Eduqas Past Papers - Topic Questions -- Eduqas
🎬 Video Resources
Ready to ace your GCSE Computer Science exams?
Get the best revision books and guides to boost your grades.