IGCSE Computer Science 0478: Trojan Horse vs Worm in a Malware Case Study

An employee at a graphic design studio downloads what looks like a free, well-reviewed font-management application from a website and runs the installer. The application appears to work normally, but it also secretly opens a hidden connection that lets an attacker access the employee's computer remotely.

Weeks later, and completely separately, a different piece of malicious software spreads by itself from this computer to every other computer on the studio's network overnight. No member of staff opens a file or runs a program at any point; the software exploits a weakness in the network software to copy itself onto each connected computer in turn.

(a) State the type of malware responsible for the font-management application incident, and identify the detail in the scenario that supports your answer. [2]

(b) State the type of malware responsible for the overnight spread across the network, and explain how it is able to spread without any member of staff opening a file or running a program. [3]

(c) Identify one way in which this second type of malware's method of spreading is different from a computer virus's method of spreading. [1]

Part (a): Identifying the malware in the font-management incident

The application was presented as something desirable and legitimate, a well-reviewed font-management tool, and the employee chose to download and run it voluntarily. It was only after being run that it secretly opened remote access for an attacker. Software that disguises itself as a legitimate, useful program to trick a user into installing and running it is a trojan horse. The supporting detail is that the malware relied entirely on the employee being deceived into running a program that looked genuine; it did not attach itself to any other file or replicate on its own.

Part (b): Identifying the malware in the overnight network spread

This second incident describes malicious software copying itself onto every other computer on the network overnight, with no member of staff opening a file or running a program, by exploiting a weakness in the network software. This is the defining behaviour of a worm: it is a standalone, self-replicating program that does not need to attach itself to a host file, and it does not need a user to run or open anything. Instead, it actively finds and exploits a vulnerability in the network software itself to copy itself directly from one connected computer to the next, which is why it can spread automatically overnight without any human action.

Part (c): Worm vs computer virus

A computer virus needs a host: it attaches itself to another file or program, and it can only spread when a user runs that infected file, causing the virus to copy itself into further files at that point. A worm, by contrast, does not need a host file or any user action at all. It is a complete, standalone program that actively exploits a weakness in network software to copy itself from computer to computer on its own. This is why the overnight spread in this scenario, which required no file to be opened, matches a worm rather than a virus.

Final answers

(a) Trojan horse. Disguised as a legitimate font-management application that the employee was tricked into downloading and running.
(b) Worm, self-replicates automatically across the network by exploiting a network software weakness, without needing a host file or any user action.
(c) A worm spreads standalone, across a network, without needing a host file or user action; a virus attaches to a host file and only spreads when that file is run.