In 2020, hackers hijacked famous Twitter accounts. What did they hack?

People as the weak point

• Social engineering: manipulating people so they give up confidential information, or do something unsafe.
• Strong technical security fails if a person is persuaded to let the attacker in.
• Attackers pretend to be someone trusted and use urgency, fear or a wish to help.

Phishing

• Phishing: fake messages, often email or SMS, that pretend to come from a trusted organisation to get private information.
• The message usually links to a fake website that copies a real login page.
• Anything typed there (passwords, bank details) goes straight to the attacker.
• Purpose: steal login or payment details for fraud or to break into accounts.

Protecting against social engineering

• Training: users learn the warning signs.
• Check the real web address (URL) behind a link before clicking it.
• Verify requests through a contact you already know, not one in the message. Never share a password.

The fix was out by March. Why did WannaCry still hit the NHS in May?

Malware

• Malware (malicious software): an umbrella term for hostile or intrusive software.
• It can delete or encrypt files, steal data, record typing, or let an attacker take control.
• Ways in: email attachments, downloads, infected websites and software weaknesses.

Vulnerabilities and patches

• A vulnerability is a weakness in software that an attacker can exploit.
• The maker then releases a patch: an update that fixes it.
• Unpatched or outdated software still has the weakness. An operating system that no longer gets updates can't be fixed.
• Context: patches aren't on the Eduqas specification's list, but they explain how malware gets in and how such weaknesses are closed.

Anti-malware software

• Anti-malware scans files, downloads and memory for malware.
• It compares code with a database of known malware and also flags suspicious behaviour.
• Malware it finds is quarantined (isolated) or deleted.
• It needs regular updates, or it can't recognise new malware.
• It includes anti-virus and anti-spyware.

Attacks on networks

• Brute-force attack: trying every possible password until one works. Aim: get into an account. Defence: long passwords, lock-outs.
• Denial of service (DoS): flooding a server with requests so real users can't get in. Aim: disruption or blackmail.
• Data interception and theft: capturing data as it travels across a network, e.g. by packet sniffing. Aim: steal data. Defence: encryption.

SQL injection

• SQL injection: typing SQL code into a data entry box, such as a login form, so the database runs it.
• It works when a program builds its query by joining user input straight into the SQL.
• Aim: get past a login, or reveal, change or delete data.
• Prevention: validate input and pass it to the database as data, never as part of the SQL command.

Thieves reached a store's card tills via its air-con firm. How?

Access levels

• User access levels set which users can read, change or delete each file, folder or system.
• Each person gets only the access their role needs: a pupil can't open exam papers.
• An administrator sets and reviews them.

Passwords and authentication

• Authentication checks that a user really is who they claim to be, e.g. with a username and password.
• A strong password is long, mixes character types, isn't a dictionary word and isn't reused.
• Systems should lock an account after a few wrong attempts, which defeats guessing.

Firewalls

• A firewall monitors incoming and outgoing network traffic and allows or blocks it using a set of security rules.
• Firewalls inside a network stop traffic from one part reaching a more sensitive part.

Beyond passwords

• Double authentication: a second piece of evidence is needed as well as the password, e.g. a code sent to your phone, or a bank card plus its PIN.

Encryption as a defence

• Encryption scrambles data using a key, so only someone with the right key can read it.
• Data intercepted or stolen while encrypted is useless to an attacker without the key.
• Encrypt data sent across network connections, wired or wireless (e.g. HTTPS websites, wireless networks), and stored data.

Testing your own defences

• Penetration testing: authorised testers try to break into a system to find weaknesses before criminals do.
• Network forensics: monitoring and analysing network traffic to detect intrusions.

How can you lock a message for someone you have never met?

Why encrypt?

• Data sent over a network can be intercepted by anyone tapping into the connection.
• Encryption uses an algorithm and a key to turn plaintext into ciphertext.
• Encryption does not stop interception. It makes intercepted data meaningless to anyone without the right key.
• Decryption uses a key to turn the ciphertext back into plaintext.

Symmetric encryption

• Symmetric encryption uses the same key to encrypt and to decrypt.
• So the sender must get a copy of the key to the receiver before any message can be read.
• If the key is intercepted while it is being shared, the attacker can decrypt every message sent with it.
• Sharing the key safely is the big weakness of symmetric encryption.

Asymmetric encryption

• Asymmetric encryption uses two different keys: a matching public key and private key.
• The public key can be given to anyone. It is used to encrypt messages for its owner.
• The private key is kept secret by its owner and never sent. Only it can decrypt what the matching public key encrypted.
• So no secret key ever has to travel across the network.

Big ideas

• Social engineering manipulates people into giving away information or access: people are often the weakest point in a system.
• Phishing uses fake messages and fake websites to steal details; check links, verify through a known contact, never share passwords.
• Malware is hostile software; it gets in through attachments, downloads, websites and weaknesses in software.
• Patches fix vulnerabilities, but only once installed; anti-malware must be kept up to date to recognise new malware.
• Network attacks include brute force, denial of service and data interception; each has its own defence.
• Access levels give each user only what their role needs; authentication proves who a user is; firewalls allow or block traffic using rules.
• Encryption makes intercepted or stolen data unreadable without the key.
• Penetration testing finds weaknesses before attackers do.
• Encryption doesn't stop interception; it makes intercepted data unreadable without the key.
• Symmetric: one shared key, which must be passed on safely. Asymmetric: encrypt with the receiver's public key, decrypt with their private key.