Worksheet

F11.2 Malware

Cyber security · GCSE · OCR J277 1.4.1, AQA 8525 3.6.2, Edexcel 1CP2 5.3.1 · about 15 min

What this lesson is about

Viruses, worms, trojans, ransomware and spyware, and a signature scanner.

• Kinds of malware
• How malware gets in
• Signs of infection
• A signature scanner

Questions 6 marks in all

1. [1 mark]How does a worm spread?

   1. ABy itself across a network
   2. BOnly when a user opens an infected file
   3. CBy pretending to be a useful program
   4. DIt cannot spread

2. [1 mark]What does ransomware do?

   1. AEncrypts your files and demands payment for the key
   2. BShows adverts
   3. CRecords what you type
   4. DSpeeds up your computer

3. [1 mark]What is a trojan?

   1. AMalware disguised as something useful so you install it
   2. BMalware that spreads by itself
   3. CSoftware that removes viruses
   4. DA kind of firewall

4. [1 mark]What does spyware do?

   1. ASecretly watches what you do, such as recording keystrokes
   2. BEncrypts your files
   3. CFloods a network
   4. DBlocks adverts

5. [1 mark]Why can a signature scanner miss new malware?

   1. AIt only knows patterns it has seen before
   2. BIt scans too slowly
   3. CIt needs the internet
   4. DIt only scans images

6. [1 mark]What does this program print?

   sigs = ["evil", "steal"]
   text = "steal_data()"
   print([s for s in sigs if s in text])

The task: a malware scanner

Complete the scanner. For each file in files, find every signature from signatures that appears in its contents. Print <name>: INFECTED (<signatures>) with the matches joined by , , or <name>: clean. At the end print infected files: <n>.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

signatures = ["keylog", "ransom", "botnet", "backdoor"]
files = {
    "snake.py": "print('score', score)",
    "update.exe": "install backdoor and keylog",
    "photo.jpg": "holiday beach sunset",
    "free_robux.exe": "encrypt files then ransom the user",
}

Plan your program here, then type it in and press Run.

Do it on the robot
www.bugbotlab.com/learn/f11-2-malware/
The simulator checks it and tells you when it passes. Nothing to install, no account.

Challenges

1. Make the scan ignore capital letters, so Ransom is caught too.
2. For each infected file, say which kind of malware its signature suggests.
3. Why can a signature scanner never catch brand-new malware?