Threats, Vulnerabilities, and Mitigations · Topic 6 of 9
Malware and Physical Attacks
Identify Security+ malware types such as worms, trojans, ransomware, rootkits and logic bombs, plus physical attacks like RFID cloning and power loss.
- 4 min
- A virus needs a host file and user action. A worm spreads by itself.
- A trojan pretends to be legitimate software.
- Ransomware encrypts data for payment. Offline backups are the key recovery control.
What it is
Malware is software built to harm a system, steal data or give an attacker control. Physical attacks use real world access or conditions, not code, to damage or enter a system.
The exam asks you to identify the type from a short description, so learn how each kind spreads and what it does.
How it works
Malware types
| Type | Key feature |
|---|---|
| Virus | Attaches to a file or program and needs user action to spread |
| Worm | Spreads on its own across networks without user action |
| Trojan | Looks like useful software but carries a hidden harmful function |
| Ransomware | Encrypts data or locks a system and demands payment |
| Spyware | Secretly watches activity and sends information away |
| Keylogger | Records keystrokes to capture passwords and messages |
| Rootkit | Hides deep in the operating system, firmware or kernel to keep access and avoid detection |
| Logic bomb | Stays dormant until a condition, such as a date or an event, triggers it |
| Bloatware | Unwanted software preinstalled on a device, which adds risk and clutter |
A virus needs a person to run an infected file. A worm needs no one, which is why worms can spread through a network very quickly.
Ransomware in more detail
Ransomware commonly encrypts files and shows a demand. Paying does not guarantee the data is returned. Offline or immutable backups are the most reliable way to recover without paying.
Rootkits and persistence
A rootkit tries to stay hidden and survive restarts. Because it controls parts of the system that reporting tools depend on, normal tools may not show it. Booting from trusted media or reinstalling is often the safe way to clean such a system.
Indicators of malware
| Sign | Possible cause |
|---|---|
| Files renamed or unreadable, a ransom note | Ransomware |
| Slow system, high processor use | Malware running in the background, such as a cryptominer |
| Unexpected network connections | Spyware or a remote access tool |
| Antivirus turned off | Malware disabling protection |
| Odd behavior at a set date | Logic bomb |
Physical attacks
| Attack | Description |
|---|---|
| Brute force | Forcing entry or damaging a barrier, such as breaking a lock or door |
| Radio frequency identification (RFID) cloning | Copying the data of an access card or badge so that a duplicate opens doors |
| Environmental | Disrupting systems through power loss, heat, water or fire |
An RFID badge can be read from a short distance without the owner noticing. Shielded badge holders and multifactor authentication for doors reduce the risk.
Environmental attacks and failures are reduced by uninterruptible power supplies (UPS), generators, temperature control, fire suppression and monitoring.
Defending against malware
Endpoint protection, patching, email filtering and application control block or limit most malware. Least privilege limits what a malicious program can do once it runs. Backups limit the damage of ransomware.
What to remember for the exam
- A virus needs a host file and user action. A worm spreads by itself.
- A trojan pretends to be legitimate software.
- Ransomware encrypts data for payment. Offline backups are the key recovery control.
- A rootkit hides itself and is difficult to detect from within the infected system.
- A logic bomb runs when a set condition is met.
- A keylogger captures what the user types.
- RFID cloning copies an access badge.
- Environmental attacks target power, cooling or the physical environment.
When the question says "no user interaction" and "spreads across the network", think worm. When it says "disguised as a useful tool", think trojan.
Common mistakes
Calling any malware a virus. Virus is one specific type. The question usually gives a spreading behavior to separate it from a worm or trojan.
Thinking a logic bomb only waits for a date. It can wait for any condition, such as an account being deleted or a file appearing.
Expecting antivirus to find rootkits easily. Rootkits hide from tools that run on the same compromised system.
Paying a ransom as a plan. Payment does not guarantee that data comes back, so backups should be part of the plan.
Forgetting physical threats. Power failure, heat and cloned badges can stop a business as effectively as malware.
Backups connected to the network can be encrypted by ransomware too. Keep at least one copy offline or immutable.
Check yourself
How does a worm differ from a virus?
A worm spreads by itself across a network, while a virus needs user action to run an infected file.
What is the best protection against losing data to ransomware?
Regular backups that are stored offline or cannot be changed, so they survive the attack.
What does RFID cloning do?
It copies the data from an access badge to a duplicate, which can then open doors.
Topic 6 of 9 in Threats, Vulnerabilities, and Mitigations
Test yourself on Threats, Vulnerabilities, and Mitigations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.