Infection Files Slides Taxonomy of Malware
Digital Pathologists: Identifying the Threats
"To defend a system, you must first know what attacks it."
The Biological Parallel
Biological Virus
A biological organism that hitches a ride on a host cell, replicates, and spreads to other organisms to cause harm.
Computer Malware
A piece of malicious code that hitches a ride on a host program, replicates, and spreads to other files to cause harm.
What is Malware?
Malware = MALicious softWARE
Any software intentionally designed to cause damage to a computer, server, client, or computer network.
Viruses
Worms
Trojans
Spyware
The Computer Virus
Infectious
Requires a Host
Cannot exist on its own. Must attach to an executable file (.exe) or document.
Requires Human Action
Does not spread until someone opens the infected file or program.
Path of Infection
1 User downloads "CoolGame.exe"
2 User runs the program
3 Code attaches to other files on disk
4 Infection spreads when those files are shared
The Computer Worm
Self-Propagating
No Human Needed
Unlike a virus, a worm is a standalone software. It crawls through network connections to find other vulnerable computers.
Uses network vulnerabilities to spread rapidly.
Worm Characteristics:
• Exploits OS vulnerabilities
• Replicates across networks
• Can carry a "payload" (damage)
• Slows down network traffic
The Trojan Horse
"Beware of Geeks bearing gifts."
01
Disguised as Legitimate
Looks like a useful utility, game, or update. Users are tricked into installing it themselves.
02
Creates a Backdoor
Once inside, it opens a "backdoor" for hackers to control your system, steal data, or install more malware.
03
Doesn't Self-Replicate
Trojans do not spread themselves to other files or computers. They rely on social engineering.
The Hidden Watchers
Spyware
Software that secretly monitors your activity and collects information without your consent.
Keylogging (stealing passwords)
Remote camera/mic access
Browsing history tracking
Adware
Software that automatically displays or downloads advertising material when a user is online.
Unwanted pop-ups
Search hijacking
System slowdowns
Activity: Patient Zero
We are about to simulate a malware outbreak. You will receive a status card. Follow your teacher's instructions to interact with your classmates.
DO NOT reveal your status card until instructed!
Patient Zero Activity Sheet Patient Zero Tracker
Lesson 1: Taxonomy of Malware
Name:
Date:
Part 1: Interaction Log
In this simulation, you will interact with your classmates. Record who you "exchange data" with in the order they occur. When the teacher calls "SCAN," reveal your infection status.
Step Classmate Name Notes (How did you interact?) 1 2 3 4 5
Part 2: Malware Diagnosis
My Final Infection Status:
Healthy
Infected
Estimated Patient Zero:
How did the infection spread in our class? (Explain using malware terms like *replicate*, *vulnerability*, or *network*):
Part 3: Taxonomy Match-Up
Draw a line matching the malware type to its primary characteristic.
A. Computer Virus
B. Computer Worm
C. Trojan Horse
D. Spyware
Secretly monitors keystrokes and webcam.
Standalone code that spreads automatically across networks.
Disguised as useful software to trick the user.
Requires a host file and human action to spread.
Malware Lab Teacher Guide Malware Lab
Teacher Facilitation Guide
Lesson Objectives
Identify primary characteristics of viruses, worms, Trojans, and spyware.
Explain the role of human action vs. autonomous replication in malware spread.
Connect biological infection concepts to digital cybersecurity threats.
Required Materials
Status Cards (Envelopes)
Patient Zero Worksheets
Infection Files Slides
Activity Guide: Patient Zero
1. Setup (Pre-Class)
Prepare small slips of paper or envelopes for each student. All but one should say "CLEAN" or "HEALTHY." One (or two for larger classes) should say "INFECTED: WORM."
2. The Simulation (10-15 mins)
Step A: Give each student an envelope. Tell them NOT to look inside yet.
Step B: Students move around the room. To "exchange data," they must write the name of a classmate on their worksheet Interaction Log. They should aim for 5 interactions.
Step C: If a student is "INFECTED," any student they interact with also becomes "INFECTED" for future interactions. (Since it's a worm, it spreads automatically upon contact).
3. The Reveal & Trace
Instruct everyone to open their envelopes. Ask the original "Infected" student(s) to stand up. Then, ask anyone who interacted with them to stand up. Then, anyone who interacted with those students.
"Notice how quickly the whole room is standing. This is how a network worm operates—one vulnerability can compromise an entire system."
Discussion Prompts
The Human Factor
"If this were a Virus instead of a Worm, would everyone be infected? Why or why not?"
(Focus on: Viruses need someone to 'run' the file; Worms move themselves.)
Prevention
"What could we have done to stop the spread during our interaction game?"
(Focus on: Checking sources, limits on sharing, staying in 'trusted' zones.)
Data Hostage Slides Data Hostage
Ransomware & The 3-2-1 Defense
"Your files have been encrypted. Pay to unlock."
What is Ransomware?
The Digital Kidnapper
Ransomware is a type of malware that prevents users from accessing their system or files until a ransom is paid.
[!] ALL YOUR FILES ARE LOCKED
Encryption
The malware uses complex math to scramble your data so it's unreadable without a secret key.
Extortion
Attackers threaten to delete the data forever or leak it publicly if payment isn't made.
Case File: WannaCry (2017)
Global outbreak affecting 200,000+ computers in 150 countries.
Hospital systems in the UK were paralyzed—surgeries cancelled, records gone.
Car manufacturers and shipping companies stopped production.
How did it happen?
It used a vulnerability in Windows that had a patch available. Organizations that didn't update were the first victims.
Damage: ~$4 Billion
The Dilemma: Should we pay?
The Arguments FOR
• Immediate need for critical data (hospitals).
• Often cheaper than rebuilding systems from scratch.
• Stops further disruption to business.
The Arguments AGAINST
• No guarantee they will give you the key.
• It funds future criminal activity.
• It paints a "target" on your back for next time.
The FBI recommends: NEVER PAY.
The Ultimate Defense: Backups
The 3-2-1 Rule
3
Copies
Keep three different copies of your data.
2
Media Types
Use two different storage devices (e.g., Hard Drive & Cloud).
1
Off-site
Keep one copy in a different physical location.
Backup Blueprint Activity Backup Blueprint
Disaster Recovery Strategy: v1.0
AGENT ID: ____________________
DATE: ____________________
Section 1: Critical Asset Audit
If your computer was encrypted by ransomware right now, what are the THREE most important things you would lose? Why are they valuable?
1
2
3
Section 2: Implementing the 3-2-1 Rule
3
COPIES
Where will you keep your three different versions?
2
MEDIA TYPES
What two DIFFERENT technologies will you use?
USB Flash Drive
External Hard Drive
Cloud (Google/iCloud)
Network Server
1
OFF-SITE
Describe your off-site location (not in your house/school):
Section 3: Crisis Simulation
SCENARIO: A "Tox-X" Ransomware attack has just encrypted your school laptop. You cannot open your science project that is due tomorrow.
Describe the exact steps you would take to recover your data without paying the ransom, based on your 3-2-1 plan above.
Ransomware Case Files Ransomware Case Files
CLASSIFIED // FOR STUDENT ANALYSIS
Case #01: The Energy Grid Shutdown
Colonial Pipeline (2021)
The Attack: Hackers from a group called DarkSide stole a single password to an old account. They entered the network and encrypted the billing systems of the largest fuel pipeline in the US.
The Impact: The company shut down the pipeline to stop the spread. Gas stations across the East Coast ran out of fuel. Prices skyrocketed. People panicked and filled bags with gasoline.
Key Statistics
Ransom Paid: $4.4 MillionRecovery: FBI later recovered $2.3M of the Bitcoin.Lesson: A single weak password can bring down an entire industry.
Case #02: The City Standoff
Baltimore City Government (2019)
The Attack: A strain of ransomware called RobbinHood hit the city's servers. It disabled email, house-buying systems, and water bill payments.
The Response: The Mayor refused to pay the $76,000 ransom. The city was offline for weeks while tech experts manually rebuilt the systems.
Key Statistics
Ransom Demanded: $76,000Total Loss: $18 Million (Recovery costs)Lesson: Not paying is ethical, but recovery can be much more expensive than the ransom itself.
Critical Analysis
Based on these two cases, do you think companies should be banned from paying ransoms? Support your answer with evidence from Case #1 or Case #2.
Detection Engine Slides Detection Engine
How Antivirus Software Thinks
"Spotting the malicious code before it strikes."
How do you spot a thief?
The Mugshot
You have a photo of a known criminal. You look at everyone's face and see if any match the photo exactly.
Signatures
Suspicious Behavior
You don't have a photo. But someone is wearing a mask, carrying a crowbar, and creeping around at 3 AM.
Heuristics
Signature-Based Detection
Digital Fingerprints
Security experts analyze malware and find a unique string of code (a "signature") that identifies it.
The Database
Your Antivirus has a massive list of these signatures. It scans every file you open against this list.
Scanner Logic:
10 For each file...
20 READ code_block
30 IF code_block == known_signature
40 THEN LOCK_FILE(alert="MALWARE!")
50 ELSE ALLOW_RUN()
Signature Detection: Analysis
The Strengths
Very fast processing.
100% accurate for known threats.
Low "False Positive" rate.
The Weaknesses
Useless against NEW malware.
Easy to bypass by changing one line of code.
Requires constant database updates.
Heuristic Analysis
Behavior Watcher
Heuristics look for characteristics and behaviors common to malware, even if the file is unknown.
"This file is trying to encrypt the whole hard drive and disable the antivirus. That looks suspicious!"
Catches "Zero-Day" Attacks
Uses more CPU/Power
Higher "False Positive" rate
AV Scanner Simulation AV Scanner Simulation
Mission: Pattern Matching & Behavioral Analysis
ENGINE v3.4
Threat Database: Known Signatures
Sig #001 (Ransomware: Hydra)
0x48 0x65 0x6C 0x6C 0x6F 0x5F 0x57 0x6F
Sig #002 (Worm: Crawler)
0x73 0x65 0x6E 0x64 0x5F 0x61 0x6C 0x6C
Sig #003 (Spyware: SilentEye)
0x67 0x65 0x74 0x5F 0x6B 0x65 0x79 0x73
Sig #004 (Adware: PopUpPlus)
0x61 0x64 0x5F 0x73 0x65 0x72 0x76 0x65
Task 1: Signature Scan
Scan the files below. If the code string matches a signature from the database, label it as MALICIOUS and name the threat. If not, label it CLEAN.
File Name File Code (Content) Status & Threat Name Update.exe 0x73 0x65 0x6E 0x64 0x5F 0x61 0x6C 0x6C Photo.jpg 0x46 0x4A 0x33 0x31 0x30 0x32 0x38 0x39 Note.txt 0x67 0x65 0x74 0x5F 0x6B 0x65 0x79 0x73
Task 2: Heuristic Behavioral Scan
These files did not match any signatures. However, our heuristics engine is monitoring their behavior. Decide if the file is SUSPICIOUS or TRUSTED based on its actions.
A
Program: "SystemOptimizer_v2"
• Requests permission to modify all files on the C: drive.
• Tries to disable the computer's firewall.
• Connects to a strange IP address in a foreign country.
SUSPICIOUS
TRUSTED
B
Program: "Calcul8-it"
• Performs complex mathematical calculations.
• Displays results on the screen.
• Does not request internet access.
SUSPICIOUS
TRUSTED
Scanner Key Answer Sheet Detection Engine Key
Teacher Resource: Simulation Answers
Task 1: Signature Scan Answers
File Name Status Threat Name / Reasoning Update.exe MALICIOUS Sig #002: Worm (Crawler) Photo.jpg CLEAN No match found in database. Note.txt MALICIOUS Sig #003: Spyware (SilentEye)
Task 2: Heuristic Analysis Answers
Program A: SystemOptimizer_v2 -- SUSPICIOUS
Why: Modifying all files (Ransomware behavior), disabling security (Antivirus evasion), and unknown network connection (Command & Control communication).
Program B: Calcul8-it -- TRUSTED
Why: Performs the specific task it claims to do. Does not request unneeded permissions (like internet or disk modification).
Discussion Bridge
1. "Why was Update.exe so dangerous?" (It was a worm, meaning if one student 'ran' it, it would have tried to spread to everyone else's computer automatically.)
2. "What if Note.txt was a brand new spyware that wasn't in our database yet?" (Signature scanning would miss it. We would have to rely on Heuristics to see it was trying to 'get_keys'.)
3. "Is it possible for a 'Trusted' program to be flagged as 'Suspicious'?" (Yes, this is a False Positive. For example, a backup program might be flagged because it tries to access many files at once.)
Race to Patch Slides Race to Patch
Zero-Days & The Power of Updates
"A vulnerability is only a threat if you don't fix it."
The Vulnerability Metaphor
The Software
A house with many windows and doors. Some are built with locks that don't quite work.
The Patch
A repair crew that comes and installs a better lock once the flaw is discovered.
Vulnerable
Patched
Zero-Day Vulnerabilities
A security flaw that is discovered by hackers before the software creator knows about it.
0 DAYS TO FIX
1. Discovery
Hacker finds a bug in Windows/Android.
2. Exploit
Hacker creates a tool to use that bug.
3. Secret Use
Hacker attacks targets silently before a fix exists.
The Patch Cycle
Disclosure
The software company announces the flaw and releases an update (the patch).
The Danger Zone
The time between the patch release and when you actually install it. Hackers know the flaw now—they are racing you!
Fun Fact: "Patch Tuesday"
Microsoft releases security updates on the second Tuesday of every month. Cybersecurity experts call the following day "Exploit Wednesday" because hackers spend the whole day trying to break into computers that haven't updated yet.
Why do people delay?
Inconvenience
"I'm in the middle of a game/homework! I'll do it later."
Broken Features
"Last time I updated, my favorite app stopped working."
Performance
"Updates make my phone feel slower and kill the battery."
Are these excuses worth a total system hack?
Zero Day Timeline Handout Zero-Day Timeline
The WannaCry Exploit Analysis
FILE: WC-2017-TIMELINE
ENCRYPTION: NONE
In 2017, a global ransomware attack called WannaCry infected over 200,000 computers. What makes this attack famous is that it was entirely preventable. Follow the timeline below to see how the "Patch Window" failed.
March 14, 2017
Microsoft releases security update (MS17-010) to fix a flaw in Windows.
April 14, 2017
Hackers leak the "EternalBlue" exploit online, showing exactly how to use the flaw.
May 12, 2017
WannaCry attack begins. Paralyzes hospitals and businesses worldwide.
May 13, 2017
A security researcher finds a "Kill Switch" to stop the attack.
Calculating the Window
How many days passed between Microsoft releasing the patch (March 14) and the attack starting (May 12)?
Why is this number significant?
The Victims
If the patch was already available for 59 days, why were 200,000 computers still vulnerable?
The "Force Update" Debate
Some people think operating systems (like Windows or iOS) should FORCE updates to happen automatically, even if it interrupts the user. Others think users should have the RIGHT to choose when to update. Where do you stand? Why?
Update Debate Discussion Guide Update Debate
Socratic Discussion Guide
Objective
To facilitate a debate on the ethical and practical tension between Individual Choice and Collective Security in software patching.
Round 1: The Psychology of Delay
Question A
"Why do you think major companies (like Equifax or the NHS) fail to patch their systems for months, even when they know a vulnerability exists?"
Look for: Cost of downtime, fear of breaking legacy apps, lack of IT staff.
Question B
"Does a company have a moral responsibility to patch, or is it just a business decision?"
Look for: Data privacy duties, impact on customers, secondary effects of a breach.
Round 2: Forced vs. Manual
"If your computer doesn't update, it becomes a weapon that can be used to attack others (like a Botnet). Therefore, you should be forced to update."
Support this claim
Public safety outweighs private convenience. Like requiring vaccines or seatbelts.
Oppose this claim
Forced updates can delete files or break tools people need for their livelihoods. It is an overreach of power.
Final Synthesis
"What is the 'Goldilocks' solution for software updates?"
No Updates
The Ideal Balance
Forced Installs
Clean Tech Slides Clean Tech
Habits for a Healthy Digital Life
"Cybersecurity is not a product, it's a process."
Digital Hygiene
Just like washing your hands prevents biological sickness, Digital Hygiene prevents malware from taking root on your devices.
The Goal:
Making your device a Hard Target so that hackers move on to someone easier.
Protection
Cleanliness
Maintenance
Privacy
The "Big Four" Habits
01
Auto-Updates
Enable automatic updates for your OS (Windows/Mac/iOS) and all your apps.
02
Firewalls
Ensure your built-in firewall is ON to block unauthorized network traffic.
03
Bloatware
Uninstall apps and browser extensions you don't use. Each one is a potential backdoor.
04
MFA
Use Multi-Factor Authentication. A password alone is no longer enough.
Privacy = Security
Location Services
Turn off location tracking for apps that don't need it. Why does a calculator need to know where you are?
Sharing Permissions
Limit what info apps can share with advertisers. Use "Ask App Not to Track" on iOS.
The Hygiene Audit
Next, you will perform a security checkup on a fictional student's laptop. You are the digital doctor!
Hygiene Audit Worksheet Hygiene Audit
System Health Check // v2.1
PATHOLOGIST: ____________________
DATE: ____________________
Part 1: The Defense Checklist
Based on today's lesson, define the "Healthy State" for each setting below.
Operating System Updates
Target Setting (e.g., Automatic)
System Firewall
Target Setting (e.g., On / Active)
Browser Extensions
Target Action (e.g., Remove unused)
Account Security
Target Action (e.g., Enable MFA)
Patient Case: Alex's Laptop
Status Report
• 14 Uninstalled browser toolbars.
• OS Update: "Last checked 18 months ago."
• Firewall: "Disabled for gaming performance."
• Password: "P@ssword123" (used for all accounts).
Symptoms
"My laptop is so slow, and I keep getting pop-ups even when I'm not online."
Doctor's Orders (The Cure)
List four specific actions Alex must take immediately to secure this device.
1
2
3
4
Defense Shield Exit Ticket Defense Shield
My Digital Hygiene Pledge
I, , promise to protect my digital world by committing to these three habits:
1
2
3
Signature
