---
title: "Attacks from inside; malware, spyware"
subject: "Operating System"
chapter: 8
key: "semester_6/operating_system:attacks-from-inside-malware-spyware"
source: https://www.bctengineer.com/q/semester_6/operating_system/attacks-from-inside-malware-spyware
site: BCT Engineering
---

# Attacks from inside; malware, spyware

Operating System · Chapter 8: Security

- Asked in: 2068 Magh, 4+4 marks
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_6/operating_system/attacks-from-inside-malware-spyware
- Whole chapter: https://www.bctengineer.com/md/semester_6/operating_system/chapter-8

## Question

What are the attacks from inside? Explain about Malware and Spyware.

## Short answer

Inside attacks come from authorized users: logic bombs, trap doors, login spoofing, and data theft. Malware includes viruses, worms, Trojans, ransomware, and rootkits that damage systems or steal data. Spyware secretly collects browsing habits, keystrokes, and passwords, sending them to attackers. Defenses include separation of duties, code review, antivirus, anti-spyware, and firewalls.

## Answer

#### Attacks from inside
These are carried out by authorised users or programmers who already have access to the system.
- **Logic bomb:** code placed by a programmer that does nothing until a condition is met (e.g. his name missing from the payroll), then destroys data.
- **Trap door (back door):** hidden entry added during development that bypasses authentication.
- **Login spoofing:** a fake login screen collects other users' passwords.
- **Data theft/misuse:** authorised users copying or altering confidential data.

Defences: separation of duties, code review, audit logs, least privilege.

#### Malware
**Malware** is malicious software designed to damage the system, steal data or gain unauthorised control.

| Kind | Description |
|---|---|
| Virus | Attaches itself to a program or file and spreads when the host is run |
| Worm | Self-replicating program spreading across networks without a host (e.g. Morris worm) |
| Trojan horse | Looks useful but has hidden harmful code |
| Logic bomb | Triggered on a condition |
| Ransomware | Encrypts files and demands payment |
| Rootkit | Hides itself and gives privileged access |

Protection: antivirus, regular updates, not opening unknown attachments, and backups.

#### Spyware
**Spyware** is software that secretly installs itself and collects information about the user without consent, such as browsing habits, keystrokes (keyloggers), passwords and card numbers, and sends it to a remote attacker. It typically arrives with free software, plug-ins, or through infected web pages (drive-by download). It slows the system, changes the browser's home page and displays pop-ups.

Defence: anti-spyware tools, a firewall, downloading from trusted sources and keeping the browser updated.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. What is a logic bomb?
   A. A program that spreads across networks without host
   B. Code that does nothing until a condition is met, then destroys data
   C. A fake login screen
   D. A program that records keystrokes
   Answer: B. Example: triggered when a name disappears from payroll. (Key point: Logic bomb)

2. How does a worm differ from a virus?
   A. A worm needs a host; a virus does not
   B. A worm encrypts files for payment
   C. A worm self-replicates across networks without a host; a virus attaches to a host program
   D. A worm hides itself as a rootkit
   Answer: C. Viruses spread when the host is run; worms spread alone. (Key point: Virus vs worm)

3. What does spyware do?
   A. Encrypts files and demands payment
   B. Floods servers
   C. Adds a login backdoor
   D. Secretly collects user information such as keystrokes and passwords and sends it to an attacker
   Answer: D. It arrives with free software or drive-by downloads. (Key point: Spyware)

4. Which defences address inside attacks?
   A. Separation of duties, code review, audit logs, least privilege
   B. Larger passwords on the firewall
   C. Banning all programmers
   D. Disabling the network
   Answer: A. Insiders already have access, so controls limit and record actions. (Key point: Insider defences)