Which of the following best classifies the computer that controls the valve?

An embedded computer, often called an Internet of Things (IoT) device

A handheld computer, because it is small

A server, because it provides services to other computers

A personal computer, because one engineer uses it

Anti-malware finds no malicious files on a laptop, yet a check of its random access memory (RAM) shows malicious code running inside a legitimate built-in program. Which of the following best explains this?

Fileless malware running in memory

A logic bomb waiting for its trigger date

No malware, since no file was found

A virus waiting for a user to open it

A school laptop has no BIOS (basic input/output system) or UEFI (unified extensible firmware interface) password. Which of the following could an adversary with physical access most likely do?

Boot another operating system and change a password

Turn off the laptop's host-based firewall remotely

Read encrypted web traffic on the school network

Install updates that the school has not approved

Which setting allowed this infection?

Autorun for external drives was enabled

The screen lock was set to 5 minutes

Which pair of missing controls best explains why the device could neither filter the malicious data nor stop the malware?

A host-based firewall and anti-malware software

A password manager and a privacy screen

A screened subnet and a guest network

Full-disk encryption and a BIOS password

AP® Cybersecurity 4.1 Device Vulnerabilities and Attacks: Notes and Practice

1. Types of computing devices (4.1.A)

Type	What it is	Examples
Server 4.1.A.1	Provides one or more services to other computers, such as the domain name system (DNS), the dynamic host configuration protocol (DHCP) or the file transfer protocol (FTP). Any computer can be a server; enterprise servers usually have more power and storage.	A school’s file server
Personal computer 4.1.A.2	Designed for one person’s work or recreation	Desktop, laptop, notebook
Handheld computer 4.1.A.3	Smaller, battery powered; also called mobile computers or information appliances	Tablet, smartphone, smart watch
Embedded computer 4.1.A.4	Part of a machine, with specific instruction sets for the machine’s specialized components; usually slower, cheaper, little storage	The controller in a car’s brakes

Everyday devices with embedded computers are often called Internet of Things (IoT) devices. They run transportation, critical infrastructure such as substation breakers and water plant pumps, medical equipment such as insulin pumps, and home devices such as thermostats 4.1.A.5.

2. Malware (4.1.B)

Malware is malicious software that can damage or destroy a device or network, or give an adversary access to a device and its data 4.1.B.1. It is usually one tool in a bigger plan 4.1.B.2.

Malware	Its signature move
Virus	Activates only when a user runs or opens a file
Worm	Spreads from computer to computer with no human interaction
Trojan	Hides inside software that seems harmless, such as a free game that also installs hidden tools; a remote access trojan (RAT) gives remote access
Ransomware	Encrypts files, then demands payment for a decryption key within a deadline
Spyware	Tracks what the user does and reports back
Keylogger	Software or hardware that records keystrokes, revealing usernames and passwords
Logic bomb	Triggers only when set conditions are met: a date, an operating system version, a character set
Rootkit	Gets into the operating system, controls nearly everything, and can hide itself

Fileless malware is different: instead of files, it is code living in random access memory (RAM) that misuses legitimate programs already installed 4.1.B.3.

What the student saw at 08:14

YOUR FILES ARE ENCRYPTED
Documents, photos and projects on this computer can no longer be opened.
To receive the decryption key, pay within 72:00:00.
# ransomware: encrypts files, demands payment, sets a deadline [4.1.B.2]

3. How device weaknesses are exploited (4.1.C)

Weakness	What the adversary can do
Unpatched software 4.1.C.1	Use an exploit for a known vulnerability to crash the system, watch the user, switch on the webcam or microphone, or take full control
Weak authentication 4.1.C.2	Guess the password, or use social engineering to get it
No BIOS or UEFI password 4.1.C.3	Boot into a recovery mode with higher privileges, or load their own operating system from an external drive and change user profiles and passwords
Autorun enabled 4.1.C.4	Malware on an external drive runs as soon as the drive is plugged in
Open ports 4.1.C.5	Connect to the device
No firewall, or a misconfigured one 4.1.C.6	Send malicious data the device cannot filter out
No anti-malware software 4.1.C.7	Install malware more easily

4. Rating device risk (4.1.D)

Device risks come from unauthorized access or malware that let an adversary impersonate a user, control the device remotely, encrypt its drive for ransom, or wipe it. The level depends on how critical the device, its services and its data are 4.1.D.1.

Rating	When	Example (original)
High 4.1.D.2	Sensitive data or critical operations could be compromised	A water utility’s control computer, which opens and closes valves, accepts remote logins from the office network with no password.
Moderate 4.1.D.3	Weak authentication, or a vulnerability less likely to be exploited	A gym’s check-in kiosk, which holds no member data, unlocks with a 4-digit staff code that has never been changed.
Low 4.1.D.4	Exploitation would have little impact	A lobby display that only shows the bus timetable has an unused service enabled.

Rate by what could be compromised: if sensitive data or critical operations are at stake, the finding is high even when the weakness is weak authentication.

Now audit a real device report.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

Virus vs wormA virus needs a click; a worm crawls on its own.
Logic bombA logic bomb waits for its trigger: a date, a system version, a condition.
Device typesServe, person, pocket, part: server, personal, handheld, embedded.

Common misconceptions

"A virus and a worm are the same thing."
Not quite. A virus needs a user to run or open a file. A worm spreads from computer to computer with no human interaction.
"If no malicious file is on the disk, the device is clean."
Not quite. Fileless malware lives in RAM and uses legitimate programs already installed, so there may be no malicious file to find.
"Embedded devices are too simple to attack."
Not quite. Embedded computers run cars, medical equipment and the pumps and breakers of critical infrastructure. They are often slower, cheaper and harder to protect, which makes them targets.

Exam traps

Ransomware encrypts files and demands payment; spyware watches and reports; a keylogger records keystrokes. Match the behavior described, not the scariest name.
A rootkit hides inside the operating system and can make itself invisible. A RAT gives remote access. Both keep access, but a rootkit is the one described as controlling nearly every part of the system.
Risk depends on the device's criticality: the same weakness is high risk on a server with sensitive data and low risk where exploitation would have little impact.

By the numbers

Say each list out loud, then tap to check.

4 device types Say them, then tap

server
personal computer
handheld computer
embedded computer (IoT)

8 malware types + 1 Say them, then tap

plus fileless malware

7 device weaknesses Say them, then tap

unpatched software
weak authentication
no BIOS or UEFI password
autorun
open ports
no or misconfigured firewall
no anti-malware

3 risk levels Say them, then tap

high

sensitive data or critical operations

moderate

weak authentication or less likely exploits

low

little impact if exploited

In 30 seconds

Devices: servers provide services; personal computers serve one user; handhelds run on battery; embedded computers are part of a machine, often called IoT devices.
Malware types: virus (needs a user), worm (spreads alone), trojan and RAT, ransomware, spyware, keylogger, logic bomb, rootkit, and fileless malware in RAM.
Weaknesses: unpatched software, weak passwords, no BIOS or UEFI password, autorun, open ports, no firewall, no anti-malware.
Risk level depends on how critical the device, its services and its data are.

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Finding	Observation
F1	A hallway display that shows the lunch menu runs an unused service
F2	The billing server that stores families' card payment details has no anti-malware and accepts file uploads from the internet
F3	Classroom projectors can be managed with a shared four-digit code
F4	A spare laptop in a locked cupboard has an old web browser

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

Malwaretap to flip

Software designed to harm a device or its user, such as by stealing data, spying or giving an adversary control.
Example and CED codes
Rootkittap to flip

Sophisticated malware that gets into a computer's operating system, controls nearly every part of it, and can hide itself from detection.
Example and CED codes
Virustap to flip

Malware that activates only when a user runs or opens a file.
Example and CED codes
Wormtap to flip

Malware that spreads from one computer to another without human interaction.
Example and CED codes
Trojantap to flip

Malware hidden inside software that seems harmless; a remote access trojan (RAT) gives remote access.
Example and CED codes
Ransomwaretap to flip

Malware that encrypts a device's files and demands payment for a decryption key within a deadline.
Example and CED codes
Spywaretap to flip

Malware that tracks a user's actions and sends the information back to an adversary.
Example and CED codes
Keyloggertap to flip

A device or program that records every key a user types, which can capture passwords and messages.
Example and CED codes
Logic bombtap to flip

Malware that triggers its effect only when set conditions are met, such as a date or a system version.
Example and CED codes
Remote access trojan (RAT) and rootkittap to flip

Malware that keeps an adversary's access to a device; a RAT gives remote control, a rootkit hides deep in the system.
Example and CED codes
Fileless malwaretap to flip

Malicious code that lives in random access memory (RAM) and uses legitimate programs already installed, instead of being stored as a file.
Example and CED codes
Embedded computertap to flip

A computer that is part of a machine, with instructions for its specialized parts; usually slower, cheaper and with little storage.
Example and CED codes
Internet of Things (IoT)tap to flip

Everyday and industrial devices with embedded computers that connect to networks, from thermostats to water plant pumps.
Example and CED codes
BIOS or UEFI passwordtap to flip

A password on the basic input output system (BIOS) or unified extensible firmware interface (UEFI) that stops adversaries booting another operating system or a privileged mode.
Example and CED codes
Autoruntap to flip

A setting that runs content from an inserted external drive automatically; adversaries use it to launch malware.
Example and CED codes
Patchtap to flip

A small software update from a vendor that fixes a known vulnerability.
Example and CED codes

Questions students ask

What is the difference between a virus, a worm and a trojan?

A virus activates when a user runs or opens a file. A worm spreads between computers without human interaction. A trojan hides inside software that seems harmless; a remote access trojan (RAT) gives the adversary remote access.

What is fileless malware?

Malicious code that lives in RAM and uses legitimate programs already installed on a device, instead of being stored as a file.

Why is a missing BIOS or UEFI password a risk?

Without it, an adversary can boot into a recovery mode with higher privileges, or load their own operating system from an external drive and change user profiles and passwords.

4.1 Device Vulnerabilities and Attacks