Malware, hackers, phishing and pharming: threats from the network

By the end of this lesson

By the end you can define malware, virus, spyware, hacker, phishing and pharming, and explain why networking a computer increases the threats it faces.

Why a network doubles the number of doors

A stand-alone PC can only be attacked by someone who can physically touch it. Connect it to a network and the number of possible attackers jumps.

More entry points. Every open port, service and shared folder is a door. A network of forty machines has forty doors plus the servers.
Remote access. An attacker can be in another country and still reach the machine.
Sharing spreads problems. One infected machine can reach file shares, email contacts and other machines automatically.
More people. Every user is a possible mistake — a clicked link, a reused password, an unencrypted USB stick.
Public networks are hostile. On the internet, traffic passes through equipment nobody in the organisation controls.

Most of the threats below therefore arrive through the network — but note that a stand-alone PC is not immune: a virus can arrive on a USB stick, and a phone call can trick a user into revealing a password.

Definition

Malware

Malware (malicious software) is software written to cause harm, to gain unauthorised access, or to gather information without the user's consent.

The 9618 syllabus names viruses and spyware specifically; worms, trojans and ransomware are related kinds you may meet in questions.

Viruses and spyware are different animals

A virus is malware that attaches itself to a host file or program and runs when that host is run. It then usually copies itself into other files or programs, so it spreads — by email attachment, download, shared drive or USB stick.

Its visible effects might be corrupted files, a slow machine or a program that will not start.

Spyware hides and watches. It collects information — keystrokes, browsing history, screenshots, passwords — and sends it to someone else.

It may slow the machine down, but its purpose is gathering data, not damaging files.

	Virus	Spyware
Needs a host file to run	Yes — it infects a program or document	No — it usually installs as its own program
Main purpose	Damage or disruption; spreading itself	Secretly collecting information
Typical sign	Files corrupted, programs failing, strange messages	Machine slow, browser settings changed, unexpected network traffic
How it spreads	Copies itself into other files and to other machines	Usually downloaded with something else, or installed by a trojan

Related malware in one line each: a worm spreads across a network by itself without needing a host file; a trojan pretends to be useful software so the user installs it voluntarily; ransomware encrypts the victim's files and demands payment for the key.

Definition

Hacker

A hacker is a person who gains unauthorised access to a computer system or network.

The word "unauthorised" is the whole definition. A security consultant who is paid to test a system, with written permission, is not committing this offence — that is penetration testing.

A hacker's motives vary: data to sell, money by extortion, protest, or simply curiosity and challenge.

Once inside, a hacker might steal data, alter records, install malware, create new accounts for later use, or use the machine to attack others.

Definition

Phishing

Phishing is a fraudulent message — usually an email, text or social-media message — that pretends to come from a trusted organisation in order to trick the recipient into revealing confidential data (passwords, card numbers) or into opening an attachment or link that installs malware.

Typical bait: urgency ("your account will be closed in 24 hours"), a familiar logo, a link whose visible text differs from the real address, and a form asking for details the real company would never request by email.

Definition

Pharming

Pharming redirects a user to a fake website without needing them to click anything. The user types the correct address, but the request is sent to the attacker's server instead.

There are two usual ways to do it:

Malware on the user's computer changes the local hosts file, so a familiar domain name points at the attacker's IP address.
DNS poisoning alters a DNS server's records, so many users are redirected at once. (DNS is the system that turns a name such as example.com into an IP address.)

Because the address bar still shows the correct name, the victim has no obvious warning. Checking the site's security certificate and keeping software patched helps, which is why the next lesson pairs threats with countermeasures.

Telling them apart in an exam

Question	Phishing	Pharming
How does the victim reach the fake site?	They click a link or open an attachment in a message	They type the correct address; the lookup is redirected
Does the victim have to make a mistake?	Yes — trusting the message	Not necessarily; the address bar looks right
What is attacked?	The person	The computer's hosts file or a DNS server
Typical clue	Sender address, spelling, urgent tone, mismatched link	Correct-looking URL with a wrong certificate or unexpected login page

Both end with the victim typing their credentials into a page the attacker controls. The difference is the route: a message that tricks a person, versus a name lookup that has been tampered with.

Related, but distinct: a phishing message may carry a trojan attachment; a pharming attack often needs malware to have reached the machine or server first. Real attacks borrow each other's methods, and an exam answer that says so accurately is fine.

Name that threat

Multiple choiceQuestion 1 · Recall

Multiple choiceQuestion 2 · Apply

Fill in the blanksQuestion 3 · Apply

Answer the 3 questions above to continue.