In 2020, hackers hijacked famous Twitter accounts. What did they hack?

People as the weak point

• Cyber security: the processes, practices and technologies that protect networks, computers, programs and data from attack, damage or unauthorised access.
• Social engineering: manipulating people so they give up confidential information, or do something unsafe.
• Strong technical security fails if a person is persuaded to let the attacker in.
• Attackers pretend to be someone trusted and use urgency, fear or a wish to help.

Phishing

• Phishing: fake messages, often email or SMS, that pretend to come from a trusted organisation to get private information.
• The message usually links to a fake website that copies a real login page.
• Anything typed there (passwords, bank details) goes straight to the attacker.
• Purpose: steal login or payment details for fraud or to break into accounts.

Blagging and shouldering

• Blagging (pretexting): inventing a scenario so a victim gives information or does something they normally wouldn't, e.g. "I'm from IT; read me your password."
• Shouldering (or shoulder surfing): watching someone's private information over their shoulder, e.g. a PIN at a cashpoint or a password typed on a train.
• Protection: shield the keypad and screen; never tell anyone your password.

Pharming

• Pharming: redirecting a website's traffic to a fake website, so even a correctly typed address leads to the fake.
• Malicious code on the user's computer or a server changes where the address leads.
• Unlike phishing, there's no link to click.
• Protection: anti-malware; check the address bar and padlock (HTTPS) before logging in.

Protecting against social engineering

• Training: users learn the warning signs.
• Check the real web address (URL) behind a link before clicking it.
• Verify requests through a contact you already know, not one in the message. Never share a password.

The fix was out by March. Why did WannaCry still hit the NHS in May?

Malware

• Malware (malicious software): an umbrella term for hostile or intrusive software.
• It can delete or encrypt files, steal data, record typing, or let an attacker take control.
• Ways in: email attachments, downloads, infected websites and software weaknesses.
• Removable media such as USB devices can carry malware past the network's defences.

Forms of malware

• Virus: attaches to a file or program; spreads when that file is run or shared.
• Trojan: pretends to be useful software but carries hidden malware.
• Spyware: secretly records what you do and reports it to the attacker.

Vulnerabilities and patches

• A vulnerability is a weakness in software that an attacker can exploit.
• The maker then releases a patch: an update that fixes it.
• Unpatched or outdated software still has the weakness. An operating system that no longer gets updates can't be fixed.
• Automatic software updates install patches as soon as they're out.

Anti-malware software

• Anti-malware scans files, downloads and memory for malware.
• It compares code with a database of known malware and also flags suspicious behaviour.
• Malware it finds is quarantined (isolated) or deleted.
• It needs regular updates, or it can't recognise new malware.

Thieves reached a store's card tills via its air-con firm. How?

Access levels

• Access rights set which users can read, change or delete each file, folder or system.
• Each person gets only the access their role needs: a pupil can't open exam papers.
• An administrator sets and reviews them.
• Misconfigured access rights are a threat: users, or an attacker with their login, reach data they shouldn't.

Passwords and authentication

• Authentication checks that a user really is who they claim to be, e.g. with a username and password.
• A strong password is long, mixes character types, isn't a dictionary word and isn't reused.
• Systems should lock an account after a few wrong attempts, which defeats guessing.
• Weak and default passwords are a threat: default passwords such as "admin" are published online, so attackers try them first.

Firewalls

• A firewall monitors incoming and outgoing network traffic and allows or blocks it using a set of security rules.
• Firewalls inside a network stop traffic from one part reaching a more sensitive part.
• MAC address filtering: only devices whose MAC address (the physical address in their network adapter) is on an approved list can join.

Beyond passwords

• Biometrics: a fingerprint or face proves who you are. It can't be forgotten and is hard to copy.
• Biometrics are used particularly to unlock mobile devices.
• CAPTCHA: a test humans pass but automated programs fail, so bots can't sign up or guess passwords in bulk.
• Email confirmation: clicking a link sent to your email proves it's you, e.g. when signing up.

Encryption as a defence

• Encryption scrambles data using a key, so only someone with the right key can read it.
• Data intercepted or stolen while encrypted is useless to an attacker without the key.
• Encrypt data sent across network connections, wired or wireless (e.g. HTTPS websites, wireless networks), and stored data.
• No single method stops everything: authentication, encryption, a firewall and MAC address filtering work together as layers.

Testing your own defences

• Network security matters because a network links many devices holding valuable data, so one weakness can expose them all.
• Penetration testing: authorised testers try to break into a system to find weaknesses before criminals do.
• Two types: testers given knowledge and basic logins (simulating a malicious insider), and testers given no credentials (simulating an external attack).

Big ideas

• Social engineering manipulates people into giving away information or access: people are often the weakest point in a system.
• Phishing uses fake messages and fake websites to steal details; check links, verify through a known contact, never share passwords.
• Pharming sends you to a fake site even when you type the correct address.
• Malware is hostile software; it gets in through attachments, downloads, websites and weaknesses in software.
• Patches fix vulnerabilities, but only once installed; anti-malware must be kept up to date to recognise new malware.
• Access levels give each user only what their role needs; authentication proves who a user is; firewalls allow or block traffic using rules.
• Encryption makes intercepted or stolen data unreadable without the key.
• Penetration testing finds weaknesses before attackers do.