Cambridge O Level Computer Science · Syllabus 2210 · The Internet and its Uses
Malware
What is Malware?
Malware is software written to damage, disrupt or gain improper access to a computer system or its data; the six types named in the syllabus are viruses, worms, Trojan horses, spyware, adware and ransomware.
This definition is part of the The Internet and its Uses chapter in Cambridge O Level Computer Science.
Malware in context
Malware is software written to damage, disrupt or gain improper access to a computer system or its data. The syllabus names six types, and they are separated by three questions: does it replicate itself?, does it need a host file or program? and is it disguised as something legitimate? A virus attaches to a host and replicates when the host runs. A worm replicates and spreads by itself, typically across a network, without needing a host. A Trojan horse is disguised as something useful and does not replicate. Spyware secretly monitors and reports. Adware displays unwanted advertising and may track behaviour. Ransomware encrypts or locks data and demands payment.
The syllabus prints ten bullet points of protection, and the authentication bullet names three separate methods, so there are twelve solutions to be able to explain: access levels; anti-malware (including anti-virus and anti-spyware); authentication by username and password, biometrics and two-step verification; automating software updates; checking the spelling and tone of communications; checking the URL attached to a link; firewalls; privacy settings; proxy servers; and the secure socket layer (SSL) security protocol. Each one reduces particular risks and leaves others untouched, which is why a good answer states which threat a measure addresses — and why the strongest answers combine several. That principle is called defence in depth.
Common mistakes with Malware
- M8 — "HTTPS means the website is honest, safe, or free of malware." Why it is wrong HTTPS encrypts the connection and lets the browser check the server's certificate for that domain. It makes no assessment of the content, the seller or any files offered for download. A criminal can obtain a valid certificate for a domain they control and run a fake shop over HTTPS. Say instead "HTTPS protects the data in transit and authenticates the server; it does not verify that the website itself can be trusted."
- M10 — "Cookies are programs, or viruses, and they infect your computer." Why it is wrong A cookie is a small piece of data stored by the browser and returned to the site that set it. It cannot execute, replicate or damage anything. The genuine concern is privacy: a persistent identifier can be used to build a picture of browsing behaviour. Say instead "Cookies are data, not programs, so they are not malware — but persistent cookies can be used to track a user across visits."
- M18 — "One measure is enough: a firewall removes all malware, antivirus gives complete protection, two-step verification means two passwords, and a proxy makes you anonymous." Why it is wrong Four separate overclaims. A firewall filters traffic against rules and cannot clean an infected machine. Anti-malware reduces risk; no product detects everything. Two-step verification requires a second step of a different kind — two passwords would both be things you know, so one theft would yield both. A proxy hides the client address from the destination only; the proxy itself sees and may log the traffic. Say instead "Each measure addresses particular risks and leaves others open, so several complementary layers are used together — defence in depth."
Questions students ask about Malware
What is the difference between a virus, a worm and a Trojan horse?
A virus attaches to a host file or program and replicates when the host is run, opened or shared, so it usually needs a user to do something. A worm needs no host and no user action; it replicates and spreads across a network by itself. A Trojan horse is disguised as legitimate software, does not self-replicate, and relies on the user installing it before it performs its hidden malicious action. All three are types of malware, but they are separated by whether they replicate and whether they need a host.