Exercises: Viruses and malicious software

Explain in your own words what a malicious program is and the difference between a virus, which needs to infect other files to spread, and a worm, which copies itself and travels across the network independently.

Match each situation with the most likely type of malicious software and justify your choice: (a) after installing a game downloaded from an unknown website, the computer continuously shows pop-up adverts; (b) a file named 'trip photos' asked to install a 'viewer' and, since then, saved passwords have disappeared; (c) an application secretly records everything typed and sends it off the device.

The diagram classifies the most common malicious software, as shown in the figure.

One of the types is covered by a question mark: it is a program that appears useful but, when installed, secretly carries out harmful actions. State which type is missing and describe with an example how it comes to be installed on a device.

Explain in your own words what spyware is, what kind of information it looks for on a device, and why it tries to remain unnoticed for as long as possible.

You find a lost USB flash drive in the school playground with a label saying 'party photos'. Explain the risk of plugging it into your computer to see what it contains and what would be the correct thing to do with it.

When downloading a pirated game, the installer asks you to disable your antivirus 'so that it works properly'. Explain why this request is almost certainly a trap and why the program wants you to turn off your defences.

Comment on this statement: 'if my computer had a malicious program, I would notice right away'. Explain why many malicious programs try to remain unnoticed and name three subtle signs that could give them away.

Rank these application download sources from lowest to highest risk and justify your order: a 'free' software portal full of adverts, the official system store, the official developer website.

Explain two common ways a malicious program can enter a computer or mobile phone (for example, email attachments or apps from unofficial stores) and describe a specific precaution to block each of them.

A classmate claims: 'my phone can't have a virus because it's not a computer'. Explain why this statement is false and give an example of a real threat that affects mobile phones.

A family laptop has been running very slowly since a free browser 'toolbar' was installed, and advert tabs open automatically. Explain what might have happened, what type of threat it appears to be, and what steps you would take to clean the device.

A teacher receives an email with the file 'invoice.doc' and, upon opening it, the program asks to 'enable macros to view content'. Explain what macros are, why they can be dangerous in a document received from an unknown sender, and what the teacher should do.

Explain what a security vulnerability is, how malicious programs exploit it to gain entry without needing to trick anyone, and why devices with old, unupdated systems are their main target.

A friend's computer has become a 'zombie': it is part of a network of infected devices attacking websites without them noticing. Explain how this could have happened, what signs they might observe on their device, and what they should do to clean it.

After installing a cheat for a game downloaded from a forum, all the photos on the mobile phone appear encrypted, and a ransom is demanded. Explain what type of attack has occurred, why game cheats and currency generators are such effective bait, and what prior measure would have prevented the disaster.

Draw up a comparative table for a virus, a worm, and a Trojan with these three rows: needs to infect other files, spreads on its own over the network, tricks the user into installing it. Complete the nine cells and write a conclusion stating which type requires the most user cooperation.

A secondary school's server suffers a ransomware attack: all student data and academic records are encrypted, and 10.000 € in cryptocurrencies is demanded to recover them. The school had a daily backup on an external hard drive that was permanently connected via USB to the server, which has also been completely encrypted.

1. a) Explain the technical cause why the school's backup system failed against this attack.
2. b) Justify two reasons why the school management must not pay the ransom under any circumstances.
3. c) Design a backup strategy based on the 3-2-1 rule that guarantees that, in the event of an identical attack in the future, the data can be restored without paying.

In the school library computers, continuous malware infections originating from students' USB flash drives are being detected. The management team proposes two extreme alternatives: A) "Block the USB ports with glue so no one can use them" or B) "Trust in individual responsibility and not apply any restrictions."

Design an intermediate and viable technical proposal that solves the problem without preventing students from using the computers to study. To do this, define three technical operating system configuration measures (account and privilege management, system freezing, or device scanning) and two organizational rules of use, justifying the exact risk that each one neutralizes.

Analyze the permissions requested by two supposedly free applications available in a mobile app store:

• "LuzFlash" App: Access to camera/flash and vibration control.

• "SuperClean & Flash" App: Access to camera/flash, SMS reading, contacts list, precise location, and permission to "display over other apps".

1. a) Technically justify why the permissions list of the second app is an obvious indicator of malicious software (trojan or spyware).
2. b) Explain what attack vector or financial gain an attacker can achieve specifically by combining SMS reading with the permission to "display over other apps" against mobile banking alerts.
3. c) Point out two technical checks that you should perform before downloading any app to verify that it is legitimate.

A company employee receives an email that pretends to be an urgent invoice from a supplier inside a compressed file. Upon decompressing it and opening the document (whose real name is "factura_abril.pdf.exe"), a trojan runs in the background. Hours later, cybercriminals transfer funds from the company's online banking.

1. a) Explain which two combined tricks (one of social engineering and another of file extension settings in the operating system) deceived the user at the first link of the chain.
2. b) Select two moments in the attack chain where it would have been most effective to stop the threat and determine which specific technological measure (for example, executable execution policies, outbound firewalls, or two-factor authentication 2FA) would have neutralized it in each case.

In the Technology classroom, several computers have been infected because students download software for projects (video editors, 3D printer drivers) from untrusted links. Design a three-phase technical protocol ("Before downloading", "During installation", and "After the first run") that any student must mandatorily apply.

For each phase, describe an accurate technical check (such as verifying the source and digital signature or hash checksum, detecting bundled installers, or reviewing active system processes) and explain what type of malware or risk it prevents.

While installing a free audio editing program, a user clicked "Next" repeatedly without reviewing the intermediate panels. After restarting, the browser's home page has changed, pop-up ads appear, and the antivirus detects several programs classified as PUPs (Potentially Unwanted Programs).

1. a) Distinguish the concept of a PUP from that of a traditional virus or worm: why are many of these applications not formally considered illegal despite being harmful?
2. b) Explain how developers use "dark patterns" in the visual design of installers to induce users to authorize the installation of unwanted software.
3. c) Describe the technical procedure that should be followed to completely uninstall these programs and restore browsers without formatting the computer.

A classmate claims: "I don't care if my computer gets infected: I don't use online banking, I have no money in my accounts, and nobody cares about my files, so no cybercriminal gains anything by attacking me."

Refute their stance by demonstrating three real and lucrative uses that attackers make of an infected computer belonging to a user with no apparent valuable data (using technical concepts such as zombie networks or botnets for denial-of-service attacks, hidden cryptocurrency mining, and identity spoofing to spread phishing). Justify why keeping an unprotected computer is a risk for the rest of the digital community.

While browsing a file download website, a student gets a pop-up window in their browser imitating the Windows Defender interface, featuring a warning siren and the message: "CRITICAL ALERT! Your computer has 37 trojan viruses that are destroying drive C:. Download this cleaner within 60 seconds to avoid losing your data".

1. a) Demonstrate, based on browser process isolation (sandbox) and operating system architecture, why it is technically impossible for a web page to know the actual state of the files on the hard drive.
2. b) Identify which deception category this message falls into (scareware) and predict what will happen to the system if the user clicks and opens the file offered to "disinfect" it.
3. c) Explain what two correct actions the user should take to close that warning without interacting with the malicious window's buttons.