Malware

Viruses, worms, trojans, ransomware and spyware, and a signature scanner.

F11.2Cyber securityGCSE15 min

Malware is any software written to do harm: to damage a computer, steal data, or take control of it. It is one of the most common threats, and it comes in several kinds, each spreading and doing damage in its own way. This lesson names the main kinds and builds a simple malware scanner.

Kinds of malware

Kind	What it does
Virus	attaches itself to a file or program. It spreads when that file is opened and run by a person
Worm	spreads by itself across a network, with no need for anyone to open anything
Trojan	pretends to be something useful so you install it, then does harm once inside. It does not spread on its own
Ransomware	encrypts your files and demands money for the key to get them back
Spyware	hides and secretly watches what you do, such as recording what you type to steal passwords
Adware	floods you with adverts, and often tracks you

The difference to remember: a virus needs a person to run an infected file, a worm spreads on its own, and a trojan tricks you into installing it.

How malware gets in

an email attachment or a link that runs the malware when opened;
a download from an untrusted website, or a pirated program;
an infected USB stick plugged in;
a security hole in out-of-date software.

Signs of infection

A computer might be slow, crash often, show pop-ups, run out of disk space, send messages you did not write, or have files that are missing or renamed. On a robot, malware might make it ignore commands or send its data somewhere.

A signature scanner

Real anti-malware keeps a list of signatures: short patterns of code known to belong to malware. It scans each file for them. Here is the idea in miniature:

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

signatures = ["evil", "steal", "ransom"]
files = {"game.py": "print('play')", "helper.py": "steal_passwords()", "notes.txt": "buy milk"}
for name, contents in files.items():
    hits = [s for s in signatures if s in contents]
    if hits:
        print(name, "INFECTED:", hits)
    else:
        print(name, "clean")

Run this in the simulator

A signature scanner only catches malware it already knows. New malware needs other methods, such as watching for suspicious behaviour, which is lesson F11.8.

Task: a malware scanner

Complete the scanner. For each file in files, find every signature from signatures that appears in its contents. Print <name>: INFECTED (<signatures>) with the matches joined by ,, or <name>: clean. At the end print infected files: <n>.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

signatures = ["keylog", "ransom", "botnet", "backdoor"]
files = {
    "snake.py": "print('score', score)",
    "update.exe": "install backdoor and keylog",
    "photo.jpg": "holiday beach sunset",
    "free_robux.exe": "encrypt files then ransom the user",
}

Challenges

Make the scan ignore capital letters, so Ransom is caught too.
For each infected file, say which kind of malware its signature suggests.
Why can a signature scanner never catch brand-new malware?