Social Engineering and Malware

Social Engineering and Malware

Cyber security is the protection of computer systems, networks, and data from digital attacks. This note covers the most common social engineering techniques and malware types that appear in the AQA GCSE exam.

---

Social Engineering

Social engineering attacks exploit human behaviour rather than technical vulnerabilities. They trick people into revealing confidential information or performing actions that compromise security.

Phishing

• Fraudulent emails designed to look like they come from a trusted source (bank, employer, HMRC)
• Contain links to fake websites that steal login credentials or personal data
• Often create a sense of urgency ("Your account will be closed in 24 hours")
• May contain attachments with malware

How to spot phishing:

• Generic greetings ("Dear Customer" instead of your name)
• Spelling and grammar errors
• Suspicious sender email address (e.g. support@amaz0n-security.com)
• Hovering over links reveals a different URL than displayed
• Requests for personal information

Spear Phishing

• A targeted phishing attack aimed at a specific individual or organisation
• Uses personal information (name, job title, colleagues) to appear genuine
• Much harder to detect than generic phishing
• Often targets employees with access to sensitive systems

Pharming

• Redirects users from a legitimate website to a fraudulent copy without their knowledge
• Achieved by poisoning DNS records or modifying the hosts file on a device
• Users type the correct URL but end up on a fake site
• The fake site collects login details and financial information

Vishing (Voice Phishing)

• Social engineering conducted over the phone
• Caller impersonates a trusted organisation (bank, tech support, police)
• Pressures the victim into revealing account details or making payments

Smishing (SMS Phishing)

• Phishing via text messages
• Contains links to malicious websites or phone numbers to call
• Often claims to be from delivery companies, banks, or HMRC

Shoulder Surfing

• Watching someone enter sensitive information (PIN, password) by looking over their shoulder
• Can be done in person or using cameras/binoculars

Pretexting

• Creating a fabricated scenario to manipulate someone into providing information
• Example: pretending to be IT support and asking for login credentials to "fix an issue"

Tailgating (Piggybacking)

• Following an authorised person through a secure door without scanning your own badge
• Exploits politeness (people hold doors open)
• Physical security threat rather than digital

---

Malware

Malware (malicious software) is any software designed to damage, disrupt, or gain unauthorised access to a computer system.

Viruses

• Attach themselves to legitimate programs or files
• Activate when the infected file is opened or run
• Can replicate and spread to other files and systems
• May delete files, corrupt data, or slow down the system
• Require user action to spread (opening a file, running a program)

Worms

• Self-replicating malware that spreads without user action
• Exploit network vulnerabilities to move between connected devices
• Can spread extremely quickly across a network
• Consume bandwidth and system resources, slowing networks
• Unlike viruses, worms do not need a host file

Trojans

• Disguised as legitimate software (games, utilities, updates)
• Once installed, they perform hidden malicious actions
• May create a backdoor allowing remote access to the system
• Do not self-replicate — they rely on the user downloading and installing them
• Named after the Trojan Horse from Greek mythology

Spyware

• Secretly monitors user activity (keystrokes, browsing history, screenshots)
• Sends collected data back to the attacker
• Often installed without the user's knowledge (bundled with free software)
• Can capture passwords, banking details, and personal information

Ransomware

• Encrypts the victim's files, making them inaccessible
• Demands a ransom payment (usually in cryptocurrency) for the decryption key
• May threaten to publish stolen data if the ransom is not paid
• Notable examples: WannaCry (2017), which affected the NHS
• Paying does not guarantee the files will be restored

Adware

• Displays unwanted advertisements (pop-ups, banners, redirected searches)
• Often bundled with free software
• Can slow down the system and browser
• Some adware also tracks browsing habits (overlaps with spyware)

Rootkits

• Hidden deep within the operating system
• Give the attacker administrator-level access without detection
• Extremely difficult to detect and remove
• Can hide other malware from antivirus software
• Often require a complete reinstall of the OS to remove

---

Malware Comparison Table

Malware	Self-replicates?	Needs user action?	Main danger
Virus	Yes (to files)	Yes (open file)	Data corruption
Worm	Yes (across network)	No	Network overload
Trojan	No	Yes (install it)	Backdoor access
Spyware	No	Sometimes	Data theft
Ransomware	Sometimes	Yes (open file)	File encryption
Adware	No	Sometimes	Annoying ads, tracking
Rootkit	No	Sometimes	Hidden admin access

---

Exam Tips

• Know the difference between each social engineering method — the exam often describes a scenario and asks you to identify which attack it is
• Phishing = email, vishing = voice, smishing = SMS, pharming = DNS redirection
• Know the difference between viruses and worms: viruses need a host file and user action; worms self-replicate across networks
• Trojans are named because they look harmless but hide malicious code inside — a favourite exam fact
• When asked for prevention methods, link them to the specific attack (this connects to the next topic)
• Social engineering targets people, not technology — this distinction is important in exam answers