In 2020, hackers hijacked famous Twitter accounts. What did they hack?

People as the weak point

• Social engineering: manipulating people so they give up confidential information, or do something unsafe.
• Strong technical security fails if a person is persuaded to let the attacker in.
• Attackers pretend to be someone trusted and use urgency, fear or a wish to help.

Phishing

• Phishing: fake messages, often email or SMS, that pretend to come from a trusted organisation to get private information.
• The message usually links to a fake website that copies a real login page.
• Anything typed there (passwords, bank details) goes straight to the attacker.
• Purpose: steal login or payment details for fraud or to break into accounts.

Blagging and shouldering

• Shoulder surfing: watching someone's private information over their shoulder, e.g. a PIN at a cashpoint or a password typed on a train.
• Protection: shield the keypad and screen; never tell anyone your password.

Pharming

• Pharming: redirecting a website's traffic to a fake website, so even a correctly typed address leads to the fake.
• Malicious code on the user's computer or a server changes where the address leads.
• For example, DNS records are altered to point to the attacker's server.
• Unlike phishing, there's no link to click.
• Protection: anti-malware; check the address bar and padlock (HTTPS) before logging in.

Protecting against social engineering

• Training: users learn the warning signs.
• Check the real web address (URL) behind a link before clicking it.
• Verify requests through a contact you already know, not one in the message. Never share a password.

The fix was out by March. Why did WannaCry still hit the NHS in May?

Malware

• Malware (malicious software): an umbrella term for hostile or intrusive software.
• It can delete or encrypt files, steal data, record typing, or let an attacker take control.
• Ways in: email attachments, downloads, infected websites and software weaknesses.
• Removable media such as USB devices can carry malware past the network's defences.
• Any unsecured digital device on a network (phone, smart camera) is another way in.

Vulnerabilities and patches

• A vulnerability is a weakness in software that an attacker can exploit.
• The maker then releases a patch: an update that fixes it.
• Unpatched or outdated software still has the weakness. An operating system that no longer gets updates can't be fixed.

Anti-malware software

• Anti-malware scans files, downloads and memory for malware.
• It compares code with a database of known malware and also flags suspicious behaviour.
• Malware it finds is quarantined (isolated) or deleted.
• It needs regular updates, or it can't recognise new malware.
• It includes anti-virus and anti-spyware.

Attacks on networks

• Eavesdropping: capturing data as it travels across a network, e.g. by packet sniffing. Aim: steal data. Defence: encryption.

Thieves reached a store's card tills via its air-con firm. How?

Access levels

• Access control set which users can read, change or delete each file, folder or system.
• Each person gets only the access their role needs: a pupil can't open exam papers.
• An administrator sets and reviews them.
• Physical security: locked server rooms, ID badges and CCTV stop people reaching the equipment.

Passwords and authentication

• Authentication checks that a user really is who they claim to be, e.g. with a username and password.
• A strong password is long, mixes character types, isn't a dictionary word and isn't reused.
• Systems should lock an account after a few wrong attempts, which defeats guessing.

Firewalls

• A firewall monitors incoming and outgoing network traffic and allows or blocks it using a set of security rules.
• Firewalls inside a network stop traffic from one part reaching a more sensitive part.

Testing your own defences

• Network security matters because a network links many devices holding valuable data, so one weakness can expose them all.
• Penetration testing: authorised testers try to break into a system to find weaknesses before criminals do.
• Ethical hacking: hacking with the owner's permission to find vulnerabilities.
• Commercial analysis tools scan for known weaknesses; reviews of network and user policies check the rules.

Policies, backups and audit trails

• Audit trails: logs of who accessed or changed what, and when, to spot and investigate misuse.
• Code reviews: other programmers check code for vulnerabilities and bad practice before release.

Secure by design

• Plan security at the design stage, not as an add-on.
• Secure coding: validate all input and avoid bad programming practices; modular testing checks each part early.
• Secure the operating system: install updates, remove unused accounts and services.
• The cloud: your data sits on another company's servers, so you rely on their security, and anyone with your login can reach it. Use strong authentication and encryption.

Big ideas

• Social engineering manipulates people into giving away information or access: people are often the weakest point in a system.
• Phishing uses fake messages and fake websites to steal details; check links, verify through a known contact, never share passwords.
• Pharming sends you to a fake site even when you type the correct address.
• Malware is hostile software; it gets in through attachments, downloads, websites and weaknesses in software.
• Patches fix vulnerabilities, but only once installed; anti-malware must be kept up to date to recognise new malware.
• Network attacks include eavesdropping on data in transit; each has its own defence.
• Access levels give each user only what their role needs; authentication proves who a user is; firewalls allow or block traffic using rules.
• Penetration testing finds weaknesses before attackers do.