Brute-force attack
A brute-force attack is when a criminal tries every possible password (or key) until one works. Software tries millions of guesses each second.
The aim is to get into an account or system, then steal data or cause harm.
Longer passwords with a mix of character types have far more possible combinations, so they take much longer to crack.
e.g.ExampleA 4-digit PIN: 10 choices per digit.
10 × 10 × 10 × 10 = 10,000 possible PINs.
An 8-character password using a–z, A–Z and 0–9: 62 choices per character.
62^8 = 218,340,105,584,896 possible passwords (about 218 million million).
?Why?Each extra character multiplies the number of guesses needed. That is why length matters more than anything else.
!Watch outDefences: long, complex passwords; locking the account after a few failed attempts; two-step verification.
Data interception
Data interception is when data is stolen while it is being sent, for example over Wi-Fi or across the internet.
A criminal can use a packet sniffer, a program that captures and examines data packets as they pass. On an unsecured public Wi-Fi network this is easy.
The aim is to read passwords, card numbers or private messages.
e.g.ExampleIn a café, someone on the same free Wi-Fi captures the packets from your laptop. If a website uses plain HTTP, they can read the password you typed.
!Watch outDefences: encryption (HTTPS/SSL so captured data cannot be read); avoid public Wi-Fi for banking, or use a VPN; use strong Wi-Fi encryption at home.
Distributed denial of service (DDoS)
A denial of service (DoS) attack floods a web server with so many requests that it cannot cope. Real users cannot reach the website.
In a distributed DoS (DDoS), the requests come from thousands of computers at once. These are often ordinary devices infected with malware and controlled by the criminal. This group is called a botnet.
The aim is to take a website offline, often to cause loss of sales or to demand money.
e.g.ExampleOn the morning concert tickets go on sale, a botnet of 50,000 infected computers and cameras sends requests to the ticket website. The server is overloaded and real fans see an error page.
?Why?Requests from so many different places are hard to block, because they look like normal visitors.
!Watch outDefences: a proxy server or firewall that filters out the flood of traffic; anti-malware on your own devices so they do not join a botnet.
Hacking
Hacking is gaining unauthorised access to a computer system. Unauthorised means without permission.
A hacker may steal, change or delete data, or install malware. This is illegal in most countries.
Ethical hacking is different: a company pays an expert to try to break in, so weaknesses can be found and fixed.
!Watch outDefences: firewalls, strong passwords and authentication, access levels, and keeping software updated so known weaknesses are fixed.
Malware: virus, worm and Trojan horse
Malware (malicious software) is any software written to cause harm. Cambridge lists six types. The first three spread or get in; the last three do specific damage.
e.g.ExampleA student downloads a free "game cheat" from an unknown site. It works, but it also installs spyware. That download was a Trojan horse.
!Watch outVirus versus worm: a virus needs a host file and a user to run it. A worm spreads by itself across a network.
Malware: spyware, adware and ransomware
These three types are named after what they do once they are on a device.
?Why?Regular backups are the best answer to ransomware. If the files are backed up elsewhere, the victim can restore them without paying.
!Watch outDefences for all malware: anti-malware software, automatic updates, not opening unknown attachments, downloading only from trusted sources.
Phishing and pharming
Phishing is sending a fake email or message that looks like it comes from a trusted organisation, such as a bank. It tries to make the user click a link to a fake website and type in their personal details.
Pharming is when malicious code is installed on the user's computer, or a DNS server is tampered with. It redirects the user to a fake website, even when they type the correct URL.
Both aim to steal login details, card numbers or other personal data.
e.g.ExamplePhishing: a text says "Your Correos parcel is held. Pay 1.99 euros here" with a link to a fake site.
Pharming: you type your bank's correct address, but malware on your PC sends you to a copy of the bank's site.
!Watch outLearn the difference: phishing tricks you into clicking; pharming redirects you without you knowing.
Social engineering
Social engineering is manipulating people, rather than computers, into breaking security. It uses trust, fear, curiosity or urgency.
Phishing is one kind. Another is a phone call from someone pretending to be the IT department.
Baiting leaves a USB stick labelled "Salaries" in the car park, hoping someone plugs it in. Scareware is a fake pop-up saying "Your PC is infected, call now".
The aim is to get passwords, access to a building or system, or to get malware installed.
e.g.ExampleA caller says: "Hi, it's Sam from IT. Your account is locked. Tell me your password and I'll fix it now." The caller is not from IT.
?Why?People are often the weakest link. The best technical security fails if someone gives away a password.
!Watch outDefence: training staff to be suspicious, never sharing passwords, checking who is really asking.
Solutions: access levels, anti-malware and authentication
Access levels give each user only the rights they need. A student can read the school timetable but cannot change it. This limits the damage if an account is hacked.
Anti-malware software includes anti-virus and anti-spyware. It scans files and compares them with a database of known malware. It quarantines or deletes anything harmful and checks downloads as they arrive.
Authentication proves a user is who they say they are.
?Why?Anti-malware needs to update its database often, because new malware appears every day.
Solutions: updates, checking messages and links
Automating software updates means the OS and apps download and install fixes by themselves. Updates close security holes that hackers and malware use.
Checking the spelling and tone of communications helps spot phishing. Warning signs are spelling mistakes, a general greeting such as "Dear customer", and an urgent or threatening tone.
Checking URLs in links before clicking: hover over the link to see where it really goes. Look for misspellings such as `paypa1.com` or extra words such as `bbva-secure-login.net`.
e.g.ExampleEmail: "URGENT!! Dear costumer, your acount will be close in 24 hours. Click here."
Red flags: spelling errors (costumer, acount), generic greeting, urgent threat.
The link shows http://santander.verify-acc.ru when you hover.
The domain is not the bank's real domain.
Solutions: firewalls and privacy settings
A firewall sits between a computer (or network) and the internet. It can be hardware, software or both.
It examines all traffic coming in and going out. It checks each packet against a set of rules, such as allowed IP addresses or ports. Traffic that breaks the rules is blocked.
It can also log traffic and warn the user when a program tries to connect to the internet.
Privacy settings control who can see your information, for example on social media. Setting a profile to "friends only" stops strangers seeing your location and photos, which social engineers use.
!Watch outA firewall does not remove malware that is already on a computer. That is the job of anti-malware.
Solutions: proxy servers
A proxy server is a server that sits between the user's computer and the web server. Requests go to the proxy first, and the proxy fetches the page on the user's behalf.
It can filter requests, blocking access to certain websites. Schools use this to block unsuitable sites.
It hides the user's IP address, because the web server only sees the proxy's address. This protects the user's identity.
It can cache (store copies of) popular pages, so they load faster the next time.
In front of a web server, it can absorb and filter heavy traffic, helping to protect against DDoS attacks.
?Why?Putting a middle step between the user and the internet means harmful traffic can be stopped before it reaches either side.
Solutions: SSL
SSL (Secure Sockets Layer) is a security protocol that encrypts data sent between a browser and a web server. Its modern version is called TLS, but the exam uses the name SSL.
It is what turns HTTP into HTTPS. It uses an SSL certificate: a digital document that proves the website is who it claims to be.
e.g.ExampleHow an SSL connection starts:
1. The browser asks the web server to identify itself.
2. The server sends a copy of its SSL certificate.
3. The browser checks the certificate is real and trusted.
4. If it is, the browser sends a message back to the server.
5. The server replies with a digitally signed acknowledgement to start the session.
6. All data sent from now on is encrypted.
?Why?Even if the data is intercepted, it cannot be read. The certificate also helps the user know they are on the real website.
!Watch outSSL protects data in transit (while it travels). It does not stop malware on your own computer or protect data stored on the server.
Matching threats to defences
Exam questions often give a scenario and ask you to name the threat and the best defence. Try the threats toy: read each scenario, name the threat, then pick the defence.
Always explain how the defence stops that threat. "Install a firewall" is a weak answer. "A firewall blocks incoming traffic that does not meet its rules" is stronger.
There is something to try for this step in the IGCSE library.