Cyber Threats and Malware Attacks: Types, Attack Vectors, and Worked Security Problems

Information Security questions in UGC NET CS, GATE, and university papers demand precision. You may have to distinguish a worm from a virus, map an attack to a CIA pillar, or solve a password, key-count, or cipher numerical. Build the concepts, then work the numbers.

The malware family, sorted the way examiners test it

Two properties separate the major malware classes: whether the malicious code needs a host program and whether it self-replicates.

A worm self-replicates without a host or user action; a virus needs both a host file and a trigger. A trojan looks legitimate but does not copy itself. These threats often ride services covered in application-layer network questions.

Threats, vulnerabilities, attacks, and the CIA triad

A vulnerability is a weakness. A threat is a potential danger that could exploit it. An exploit is the technique that uses it, while an attack is that exploit being carried out. In a simplified exam model, risk = threat × vulnerability × impact.

The CIA triad maps attacks to properties:

• Confidentiality restricts information to authorised parties. Sniffing and eavesdropping break it.

• Integrity keeps information accurate and unaltered. Data tampering and MITM alteration break it.

• Availability keeps services accessible to authorised users. DoS and DDoS break it.

Authentication establishes who you are. Authorization determines what you may do. Non-repudiation supplies evidence so a party cannot credibly deny an action.

Common attack vectors, precisely

Phishing uses forged trust to harvest credentials. In a Man-in-the-Middle attack, an attacker relays communication between two parties and may read or alter it. SQL injection places database syntax into unsafe input. Entering ' OR '1'='1 into a login field can make a vulnerable WHERE condition true.

Cross-Site Scripting, or XSS, injects content such as <script> into a page another user loads. DoS exhausts a service from one source, while DDoS coordinates many sources so legitimate requests time out.

Reflection magnifies a DDoS flood. If a spoofed 60-byte DNS query causes a 3,000-byte response to reach the victim, the amplification factor is 3,000 ÷ 60 = 50. Real factors depend on the protocol and response. The IP mechanics connect to IP addressing and subnetting problems.

Worked example: why an 8-character password is a real threat surface

Assume an offline attacker tests 1,000,000,000, or 10^9, guesses per second. This is a problem assumption, not a universal speed.

For Password A, each of eight positions can contain one of 26 lowercase letters or 10 digits, giving 36 symbols.

1. Keyspace = 36^8 = 2,821,109,907,456, about 2.82 × 10^12 possibilities.

2. Entropy = log2(36^8) = 8 × log2(36) = 8 × 5.170 = 41.4 bits.

3. Worst-case time = 2.821 × 10^12 ÷ 10^9 = 2,821 seconds.

4. In minutes, 2,821 ÷ 60 = 47.0 minutes. An average search checks half the keyspace, so it takes about 23.5 minutes.

For Password B, each of 12 positions uses a 94-symbol printable ASCII set.

1. Keyspace = 94^12 = 475,920,314,814,253,376,475,136, about 4.76 × 10^23 possibilities.

2. Entropy = 12 × log2(94) = 12 × 6.555 = 78.7 bits.

3. Worst-case time = 4.76 × 10^23 ÷ 10^9 = 4.76 × 10^14 seconds.

4. Using about 31.56 million seconds per year, (4.76 × 10^14) ÷ (3.156 × 10^7) = about 15.1 million years.

Four extra characters and a wider set moved entropy from 41.4 to 78.7 bits, and worst-case time from under an hour to roughly 15 million years. Length and charset size drive this result, not predictable substitutions. Credential theft can bypass brute force, so unique passwords and multi-factor authentication still matter.

Weak cryptography is itself a threat: a worked Caesar cipher

Encrypt ATTACK with a Caesar shift of +4, using A = 0 through Z = 25. Add 4 modulo 26 to every letter:

• A(0) becomes E(4).

• T(19) becomes X(23), so both T letters become X.

• A(0) becomes E(4).

• C(2) becomes G(6).

• K(10) becomes O(14).

The ciphertext is EXXEGO: A → E, T → X, T → X, A → E, C → G, K → O.

A Caesar cipher has only 25 non-trivial keys, so every useful shift can be tried instantly. Classical substitution also falls to frequency analysis. Modern symmetric systems such as AES use one shared secret key and are fast. Asymmetric systems such as RSA use a public-private key pair to help solve key distribution.

Traps and confusions that quietly cost marks

1. Virus versus worm: a virus needs a host and a user trigger. A worm is standalone and self-replicates across a network.

2. Symmetric versus asymmetric key count: for 10 users needing a separate shared secret for every pair, the symmetric scheme needs C(10,2) = 10 × 9 ÷ 2 = 45 keys. A public-key scheme counts one public and one private key per user, so it needs 2 × 10 = 20 keys.

3. Hashing versus encryption: hashing is one-way and has no decryption key. Encryption is reversible with the correct key. Password verifiers should store salted password hashes, not encrypted plaintext passwords.

4. IDS versus IPS: an intrusion detection system alerts. An intrusion prevention system sits inline and can block. Authentication asks who you are; authorization asks what you may do.

5. Threat versus vulnerability versus risk: the threat is the possible danger, the vulnerability is the weakness, and risk combines the chance of exploitation with its impact.

How the exam tests this, and the cyber-law pointer

Expect two question shapes. The first is rapid definition or matching: identify malware from one-line behaviour, or map attacks to CIA properties. The second is a small numerical on entropy, brute-force time, key counts, or cipher output.

In Indian CS papers, cyber law is anchored to the Information Technology Act, 2000 and its amendments. Study its broad structure around electronic records, digital signatures, offences, penalties, and cybercrime, but verify every section number, penalty amount, and offence definition against the official MeitY Information Technology Act collection. Do not rely on a remembered section or an old summary. The UGC NET Computer Science high-yield topics guide helps place Information Security and Cyber Law inside the wider preparation plan.

The short version and your next step

Classify malware by host dependence and self-replication. Map eavesdropping to confidentiality, tampering to integrity, and DDoS to availability. Under the stated assumption, 41.4 bits means 47 worst-case minutes while 78.7 bits means roughly 15 million years. Caesar ciphers break trivially, and cyber-law specifics belong to the official text.

For the complete Information Security and Cyber Law unit, continue with the NTA UGC NET Paper 2 course. For the underlying foundations, use the CS Fundamentals course. Then solve examples until the classification, CIA mapping, and arithmetic become automatic.