Network Security

Types of Attack

Cyber attacks come in many forms. Some target the software on your computer, some exploit human behaviour, and some overwhelm entire servers. Understanding each type of attack is essential for knowing how to defend against it. There are six main categories you need to know for GCSE Computer Science.

1. Malware

Malware (short for “malicious software”) is any software that is intentionally designed to cause damage, steal data, or gain unauthorised access to a system. Malware is an umbrella term that covers several specific types:

Viruses

A virus is a type of malware that attaches itself to a legitimate file or program. It cannot run on its own — it needs a “host” file. When the infected file is opened or executed, the virus activates and can replicate itself by attaching copies to other files on the same computer or files shared across a network. Viruses can corrupt or delete data, slow down systems, and spread to other computers via email attachments, USB drives, or file downloads.

Worms

A worm is similar to a virus but with one crucial difference: it does not need a host file. A worm is a standalone program that can self-replicate and spread across networks automatically, without any human interaction. It exploits vulnerabilities in operating systems or software to move from computer to computer. Worms can consume bandwidth, overload networks, and deliver harmful payloads. Because they spread without needing someone to open a file, worms can infect thousands of machines very rapidly.

Trojans

A Trojan (named after the Trojan Horse from Greek mythology) is malware that is disguised as legitimate, useful software. The user willingly downloads and installs it, thinking it is a game, a utility, or a helpful tool. Once installed, the Trojan performs its hidden malicious purpose — this might include opening a “backdoor” for hackers to access the system, stealing data, or installing additional malware. Unlike viruses and worms, Trojans do not replicate themselves — they rely on tricking the user into installing them.

Ransomware

Ransomware is one of the most devastating types of malware. Once it infects a computer, it encrypts the user’s files (documents, photos, databases — everything), making them completely inaccessible. The attacker then demands a ransom payment (usually in cryptocurrency like Bitcoin, to remain anonymous) in exchange for the decryption key. If the victim does not pay, they may lose their data permanently. Even if they do pay, there is no guarantee the attacker will provide the key.

Spyware

Spyware is malware that secretly monitors the user’s activity and steals data without their knowledge. It can record keystrokes (a “keylogger”), capture screenshots, track browsing history, and harvest login credentials, credit card numbers, and personal information. Spyware often runs silently in the background, making it difficult for the user to know they are being watched.

2. Social Engineering

Social engineering attacks exploit human behaviour rather than technical vulnerabilities. Instead of hacking into a system with code, the attacker manipulates people into giving away confidential information or performing actions that compromise security. Social engineering is extremely effective because humans are often the weakest link in any security system.

Phishing

Phishing is the most common form of social engineering. The attacker sends fake emails or creates fake websites that closely mimic legitimate organisations (banks, social media platforms, online retailers, HMRC). The messages typically create a sense of urgency: “Your account has been compromised — click here to verify your identity.” When the victim clicks the link and enters their login credentials or personal information, that data goes directly to the attacker.

Pretexting

Pretexting involves the attacker creating a false scenario (a “pretext”) to trick the victim into revealing information or granting access. For example, an attacker might phone an employee pretending to be from the IT department: “We are performing a security audit and need your password to verify your account.” The attacker builds trust through a convincing story and exploits the victim’s willingness to be helpful.

Baiting

Baiting exploits human curiosity. The attacker leaves an infected USB drive (or other storage device) in a public place — a car park, a reception area, a coffee shop. The drive might be labelled “Confidential” or “Salary Information” to make it irresistible. When a curious person picks it up and plugs it into their computer, malware is automatically installed.

Shoulder Surfing

Shoulder surfing is one of the simplest attacks: the attacker physically watches someone as they type a password, enter a PIN at a cash machine, or log into a system. This can be done in person (standing behind someone at an ATM) or remotely using cameras or binoculars. No technical skill is required — just the ability to look over someone’s shoulder.

3. DDoS (Distributed Denial of Service)

A DDoS attack does not aim to steal data. Instead, its goal is to make a service unavailable by overwhelming a server with an enormous volume of traffic. The attacker uses a botnet — a network of thousands or even millions of compromised computers (often infected with malware without their owners’ knowledge) — to flood the target server with requests simultaneously.

The target server becomes so overwhelmed trying to process the flood of fake requests that it cannot respond to legitimate users. Websites go offline, online services become unusable, and businesses lose revenue for every minute of downtime. Major companies including Amazon, GitHub, and the BBC have all been targets of DDoS attacks.

DDoS attacks are particularly difficult to defend against because the traffic comes from multiple distributed sources (the botnet), making it hard to distinguish malicious requests from legitimate ones and impossible to block a single attacker’s IP address.

4. SQL Injection

SQL injection is an attack that targets websites and web applications that use databases. The attacker enters specially crafted SQL code into web forms (login boxes, search fields, registration forms) instead of normal input. If the website is poorly coded and does not properly validate or sanitise user input, the SQL code is passed directly to the database server and executed.

This can allow the attacker to:

• Bypass login authentication (gaining access without a valid password)
• Read sensitive data from the database (usernames, passwords, credit card numbers)
• Modify or delete data in the database
• Execute administrative operations on the database server

  Normal login:
    Username: john_smith
    Password: mypassword123

  SQL injection attack:
    Username: ' OR '1'='1' --
    Password: anything

  The injected SQL tricks the database into thinking the
  login is valid, because '1'='1' is always true. The --
  comments out the rest of the original query.
        

SQL injection exploits poorly written websites that do not validate user input. Well-coded websites use techniques like parameterised queries (also called prepared statements) to ensure user input is treated as data, not as executable SQL code.

5. Brute Force Attack

A brute force attack is a method of cracking passwords by systematically trying every possible combination of characters until the correct password is found. The attacker uses automated software that can test thousands or millions of combinations per second.

For example, if a password is a 4-digit PIN (0000 to 9999), there are only 10,000 possible combinations — a computer can try all of them in seconds. However, a long, complex password with uppercase letters, lowercase letters, numbers, and symbols has so many possible combinations that a brute force attack could take years or even centuries to succeed.

Variations of brute force include dictionary attacks, where the software tries common words and known passwords first (e.g., “password123”, “qwerty”, “letmein”), and credential stuffing, where stolen username-password pairs from one data breach are tried on other websites (exploiting people who reuse passwords).

6. Man-in-the-Middle (MITM) Attack

In a man-in-the-middle attack, the attacker secretly intercepts communication between two parties who believe they are communicating directly with each other. The attacker positions themselves between the sender and receiver, eavesdropping on the conversation and potentially altering the messages being exchanged.

For example, if you connect to an unsecured public Wi-Fi network in a coffee shop, an attacker on the same network could intercept the data passing between your laptop and the Wi-Fi router. They could capture your login credentials, read your emails, or even modify the web pages you see (for example, redirecting you to a fake banking website). The victim has no idea that their communication is being intercepted because everything appears to work normally.

Test Your Knowledge

Try these interactive exercises to check your understanding of network security. Read each scenario carefully and think before you answer.