In 2020, hackers hijacked famous Twitter accounts. What did they hack?

People as the weak point

• Social engineering: manipulating people so they give up confidential information, or do something unsafe.
• Strong technical security fails if a person is persuaded to let the attacker in.
• Attackers pretend to be someone trusted and use urgency, fear or a wish to help.

Phishing

• Phishing: fake messages, often email or SMS, that pretend to come from a trusted organisation to get private information.
• The message usually links to a fake website that copies a real login page.
• Anything typed there (passwords, bank details) goes straight to the attacker.
• Purpose: steal login or payment details for fraud or to break into accounts.

Protecting against social engineering

• Training: users learn the warning signs.
• Check the real web address (URL) behind a link before clicking it.
• Verify requests through a contact you already know, not one in the message. Never share a password.

The fix was out by March. Why did WannaCry still hit the NHS in May?

Malware

• Malware (malicious software): an umbrella term for hostile or intrusive software.
• It can delete or encrypt files, steal data, record typing, or let an attacker take control.
• Ways in: email attachments, downloads, infected websites and software weaknesses.

Forms of malware

• Virus: attaches to a file or program; spreads when that file is run or shared.
• Worm: copies itself across a network on its own.
• Trojan: pretends to be useful software but carries hidden malware.
• Key logger: records every key pressed, capturing passwords.
• Ransomware: encrypts files and demands payment for the key.

Vulnerabilities and patches

• A vulnerability is a weakness in software that an attacker can exploit.
• The maker then releases a patch: an update that fixes it.
• Unpatched or outdated software still has the weakness. An operating system that no longer gets updates can't be fixed.
• Hacking: gaining unauthorised access to a computer system, often via a vulnerability, to steal, change or delete data.

Anti-malware software

• Anti-malware scans files, downloads and memory for malware.
• It compares code with a database of known malware and also flags suspicious behaviour.
• Malware it finds is quarantined (isolated) or deleted.
• It needs regular updates, or it can't recognise new malware.
• Out-of-date anti-malware is itself a vulnerability that hackers exploit.

Thieves reached a store's card tills via its air-con firm. How?

Access levels

• Access control set which users can read, change or delete each file, folder or system.
• Each person gets only the access their role needs: a pupil can't open exam papers.
• An administrator sets and reviews them.
• Physical security: locked server rooms, ID badges and CCTV stop people reaching the equipment.

Passwords and authentication

• Authentication checks that a user really is who they claim to be, e.g. with a username and password.
• A strong password is long, mixes character types, isn't a dictionary word and isn't reused.
• Systems should lock an account after a few wrong attempts, which defeats guessing.

Firewalls

• A firewall monitors incoming and outgoing network traffic and allows or blocks it using a set of security rules.
• Firewalls inside a network stop traffic from one part reaching a more sensitive part.

Encryption as a defence

• Encryption scrambles data using a key, so only someone with the right key can read it.
• Data intercepted or stolen while encrypted is useless to an attacker without the key.
• Encrypt data sent across network connections, wired or wireless (e.g. HTTPS websites, wireless networks), and stored data.

Testing your own defences

• Network security matters because a network links many devices holding valuable data, so one weakness can expose them all.
• Penetration testing: authorised testers try to break into a system to find weaknesses before criminals do.
• Ethical hacking: hacking with the owner's permission to find vulnerabilities.

Policies, backups and audit trails

• Acceptable use policy (AUP): rules users agree to, e.g. no USB sticks from home, never share passwords.
• Backup and recovery procedures: regular copies kept separately, so data can be restored after ransomware, failure or deletion.

You paid for an app. What exactly did your money buy?

Who owns software?

• Intellectual property (IP): creations of the mind, such as code, music, inventions, brands.
• Copyright protects a creator's work, including code, graphics and sound. It applies automatically and usually lasts the creator's life plus 70 years.
• It protects the work, not the idea.
• Copying or selling a work without permission is illegal.

Software licences

• A software licence is the copyright owner's legal permission to use their software, with rules attached.
• Buying software normally gets you a licence, not the copyright.
• A licence can set: how many devices or users; whether you may copy, change or pass it on; one-off or subscription.
• Why license? Creators earn money and control use; users get clear, legal permission.

Open source or proprietary?

• "Free" doesn't always mean open source: some free programs are proprietary and still hide their code.

Protecting inventions

• A patent protects an invention: a new, inventive way something works, such as a new fingerprint sensor. Others may not copy it without permission.
• You must apply. A UK patent lasts up to 20 years, with yearly fees.
• A trademark protects a brand name, logo or slogan. It is registered (®) and renewable every 10 years.
• Copyright is automatic; patents and trademarks are not.

A free app knows where you were all week. Who agreed to that?

Personal data and privacy

• Personal data identifies you: name, photos, location, browsing history, smartwatch health data.
• Privacy is your right to control who sees information about you.
• Apps collect it through permissions and by tracking what you do.
• Data is valuable for targeting adverts or selling on. "Free" apps are often paid for with your data.
• Ownership: who owns data about you: you, or the company that collected it?

Consent and misuse

• Consent means agreeing to your data being collected and used. Fair consent is informed, freely given and easy to withdraw.
• Tapping "Allow" or accepting the terms is usually treated as consent, read or not.
• Misuse: using data in ways people didn't agree to, such as selling or leaking it.
• Legal: UK data protection law (DPA 2018) requires a lawful reason, such as consent, and secure storage. Breaches bring fines.

Issues across new technologies

• Most technologies bring benefits and risks; exam answers should weigh both.

AI, machine learning and robotics

• Machine learning (ML): a program improves by finding patterns in example data, not by following rules a programmer wrote.

Your old phone is in a drawer. Why does that matter to the planet?

The life of a device

• Every device goes through four stages, and each affects the environment.

• Much of the impact happens before you even switch a device on.

Energy consumption

• Devices, routers and servers use electricity, much of it still generated from fossil fuels, releasing carbon dioxide.
• Data centres run nonstop and need cooling. In 2024 they used about 1.5% of the world's electricity (415 TWh), expected to more than double by 2030, partly due to AI.
• To cut it: efficient processors, sleep modes, renewable energy, cool-climate data centres, switching off instead of standby.

E-waste and disposal

• E-waste is thrown-away electrical and electronic equipment. It is growing faster than recycling.
• In landfill, toxic substances such as mercury and lead can leak into soil and water.
• Some is shipped to poorer countries and burned or stripped by hand, harming workers' health.
• Recycling recovers metals: 2022's e-waste held about US$91 billion worth.
• Best first: keep using, repair, reuse, then recycle.

Big ideas

• Social engineering manipulates people into giving away information or access: people are often the weakest point in a system.
• Phishing uses fake messages and fake websites to steal details; check links, verify through a known contact, never share passwords.
• Malware is hostile software; it gets in through attachments, downloads, websites and weaknesses in software.
• Patches fix vulnerabilities, but only once installed; anti-malware must be kept up to date to recognise new malware.
• Access levels give each user only what their role needs; authentication proves who a user is; firewalls allow or block traffic using rules.
• Encryption makes intercepted or stolen data unreadable without the key.
• Penetration testing finds weaknesses before attackers do.
• Copyright protects code, images and music automatically; copying, sharing or selling them without permission is illegal.
• When you buy software you buy a licence: permission to use it on set terms.
• Open source gives you the code to view and change, usually free; proprietary hides the code and is usually paid for, with company support.
• Patents protect inventions and must be applied for.
• Trademarks protect brand names and logos and must be registered.
• Personal data has value; collecting and using it fairly needs informed consent, and using it for anything else is misuse.
• New technologies bring benefits and risks: weigh both, including privacy, safety and who is responsible.
• AI and robotics raise questions of algorithmic bias, safety, accountability and legal liability.
• Devices harm the environment at every stage: manufacture, use (energy), the replacement cycle and disposal.
• E-waste is growing faster than recycling; keeping devices longer, repairing and recycling all help.
• Data centres and devices use a growing share of the world's electricity.