Routers only use numbers. How does a typed web address find its site?

Reading a web address

• The internet is a worldwide collection of computer networks: the infrastructure.
• The world wide web is the collection of websites and web pages you reach using the internet.
• A URL (uniform resource locator) is the text address of a web page.
• Its parts: the protocol (https), the domain name (www.example.org) and the web page / file name (/physics/waves.html).

From name to number

• Every device on the internet is found by its IP address, e.g. 203.0.113.25. Names are easier to remember.
• The DNS (domain name server) matches domain names to IP addresses.
• The browser sends the domain name to a DNS server, which returns the IP address.
• If that server doesn't hold the name, it asks another DNS server. If none does, an error is returned.

Fetching the page

• A web server stores web pages and sends them to clients, such as your browser, that request them.
• The browser sends an HTTP request to the server's IP address. The server replies with the page's HTML, which the browser renders into the page you see.
• HTTPS is the secure version: data is encrypted, so intercepted data can't be read.

What a browser does

• A web browser's main job is to render HTML and display web pages.
• It also stores bookmarks, records history, allows multiple tabs, and provides navigation tools and an address bar.
• It stores cookies: small files a website saves on your device, used to save personal details, preferences, cart items and logins.
• Session cookies are deleted when the browser closes; persistent cookies stay until they expire or are deleted.

Digital currency and blockchain

• A digital currency exists only electronically, with no notes or coins.
• Blockchain tracks its transactions: a digital ledger of time-stamped records that cannot be altered.
• Each block stores transactions, a timestamp, its own hash and the previous block's hash. Many computers hold copies.
• Altering a block changes its hash, so the next block no longer links to it and the tampering is spotted.

In 2020, hackers hijacked famous Twitter accounts. What did they hack?

People as the weak point

• Social engineering: manipulating people so they give up confidential information, or do something unsafe.
• Strong technical security fails if a person is persuaded to let the attacker in.
• Attackers pretend to be someone trusted and use urgency, fear or a wish to help.

Phishing

• Phishing: fake messages, often email or SMS, that pretend to come from a trusted organisation to get private information.
• The message usually links to a fake website that copies a real login page.
• Anything typed there (passwords, bank details) goes straight to the attacker.
• Purpose: steal login or payment details for fraud or to break into accounts.

Pharming

• Pharming: redirecting a website's traffic to a fake website, so even a correctly typed address leads to the fake.
• Malicious code on the user's computer or a server changes where the address leads.
• For example, DNS records are altered to point to the attacker's server.
• Unlike phishing, there's no link to click.
• Protection: anti-malware; check the address bar and padlock (HTTPS) before logging in.

Protecting against social engineering

• Training: users learn the warning signs.
• Check the real web address (URL) behind a link before clicking it.
• Check spelling and tone: errors, generic greetings or urgent, threatening wording suggest a fake.
• Verify requests through a contact you already know, not one in the message. Never share a password.
• Set privacy settings so strangers can't see details to use in a scam.

The fix was out by March. Why did WannaCry still hit the NHS in May?

Malware

• Malware (malicious software): an umbrella term for hostile or intrusive software.
• It can delete or encrypt files, steal data, record typing, or let an attacker take control.
• Ways in: email attachments, downloads, infected websites and software weaknesses.

Forms of malware

• Virus: attaches to a file or program; spreads when that file is run or shared.
• Worm: copies itself across a network on its own.
• Trojan horse: pretends to be useful software but carries hidden malware.
• Spyware: secretly records what you do and reports it to the attacker.
• Ransomware: encrypts files and demands payment for the key.
• Adware: shows unwanted adverts.

Vulnerabilities and patches

• A vulnerability is a weakness in software that an attacker can exploit.
• The maker then releases a patch: an update that fixes it.
• Unpatched or outdated software still has the weakness. An operating system that no longer gets updates can't be fixed.
• Hacking: gaining unauthorised access to a computer system, often via a vulnerability, to steal, change or delete data.
• Automatic software updates install patches as soon as they're out.

Anti-malware software

• Anti-malware scans files, downloads and memory for malware.
• It compares code with a database of known malware and also flags suspicious behaviour.
• Malware it finds is quarantined (isolated) or deleted.
• It needs regular updates, or it can't recognise new malware.
• It includes anti-virus and anti-spyware.

Attacks on networks

• Brute-force attack: trying every possible password until one works. Aim: get into an account. Defence: long passwords, lock-outs.
• Distributed denial of service (DDoS): flooding a server with requests so real users can't get in. Aim: disruption or blackmail.
• "Distributed": many infected computers send requests at once.
• Data interception: capturing data as it travels across a network, e.g. by packet sniffing. Aim: steal data. Defence: encryption.

Thieves reached a store's card tills via its air-con firm. How?

Access levels

• Access levels set which users can read, change or delete each file, folder or system.
• Each person gets only the access their role needs: a pupil can't open exam papers.
• An administrator sets and reviews them.

Passwords and authentication

• Authentication checks that a user really is who they claim to be, e.g. with a username and password.
• A strong password is long, mixes character types, isn't a dictionary word and isn't reused.
• Systems should lock an account after a few wrong attempts, which defeats guessing.

Firewalls

• A firewall monitors incoming and outgoing network traffic and allows or blocks it using a set of security rules.
• Firewalls inside a network stop traffic from one part reaching a more sensitive part.
• A proxy server sits between users and the internet: it forwards requests, hides users' IP addresses and filters traffic.

Beyond passwords

• Biometrics: a fingerprint or face proves who you are. It can't be forgotten and is hard to copy.
• Two-step verification: a second piece of evidence is needed as well as the password, e.g. a code sent to your phone, or a bank card plus its PIN.

Encryption as a defence

• Encryption scrambles data using a key, so only someone with the right key can read it.
• Data intercepted or stolen while encrypted is useless to an attacker without the key.
• Encrypt data sent across network connections, wired or wireless (e.g. HTTPS websites, wireless networks), and stored data.

SSL

• Secure socket layer (SSL) is a security protocol that encrypts data sent between a web browser and a web server.
• The server proves who it is with an SSL certificate, issued by a trusted authority.
• The browser checks the certificate. If valid, an encrypted connection is set up for all the data.
• You see https and a padlock. Its newer version is called TLS.

Big ideas

• A URL holds a domain name; a DNS server converts it into the web server's IP address.
• The browser requests the page with HTTP or HTTPS (encrypted) and renders the HTML that comes back.
• Cookies store details on your device; blockchain is a tamper-evident ledger for digital currency.
• Social engineering manipulates people into giving away information or access: people are often the weakest point in a system.
• Phishing uses fake messages and fake websites to steal details; check links, verify through a known contact, never share passwords.
• Pharming sends you to a fake site even when you type the correct address.
• Malware is hostile software; it gets in through attachments, downloads, websites and weaknesses in software.
• Patches fix vulnerabilities, but only once installed; anti-malware must be kept up to date to recognise new malware.
• Network attacks include brute force, DDoS and data interception; each has its own defence.
• Access levels give each user only what their role needs; authentication proves who a user is; firewalls allow or block traffic using rules.
• Encryption makes intercepted or stolen data unreadable without the key.