In 2020, hackers hijacked famous Twitter accounts. What did they hack?

People as the weak point

• Social engineering: manipulating people so they give up confidential information, or do something unsafe.
• Strong technical security fails if a person is persuaded to let the attacker in.
• Attackers pretend to be someone trusted and use urgency, fear or a wish to help.

Phishing

• Phishing: fake messages, often email or SMS, that pretend to come from a trusted organisation to get private information.
• The message usually links to a fake website that copies a real login page.
• Anything typed there (passwords, bank details) goes straight to the attacker.
• Purpose: steal login or payment details for fraud or to break into accounts.

Protecting against social engineering

• Training: users learn the warning signs.
• Check the real web address (URL) behind a link before clicking it.
• Verify requests through a contact you already know, not one in the message. Never share a password.

The fix was out by March. Why did WannaCry still hit the NHS in May?

Malware

• Malware (malicious software): an umbrella term for hostile or intrusive software.
• It can delete or encrypt files, steal data, record typing, or let an attacker take control.
• Ways in: email attachments, downloads, infected websites and software weaknesses.

Vulnerabilities and patches

• A vulnerability is a weakness in software that an attacker can exploit.
• The maker then releases a patch: an update that fixes it.
• Unpatched or outdated software still has the weakness. An operating system that no longer gets updates can't be fixed.

Anti-malware software

• Anti-malware scans files, downloads and memory for malware.
• It compares code with a database of known malware and also flags suspicious behaviour.
• Malware it finds is quarantined (isolated) or deleted.
• It needs regular updates, or it can't recognise new malware.

Attacks on networks

• Brute-force attack: trying every possible password until one works. Aim: get into an account. Defence: long passwords, lock-outs.
• Denial of service (DoS): flooding a server with requests so real users can't get in. Aim: disruption or blackmail.
• Data interception and theft: capturing data as it travels across a network, e.g. by packet sniffing. Aim: steal data. Defence: encryption.

SQL injection

• SQL injection: typing SQL code into a data entry box, such as a login form, so the database runs it.
• It works when a program builds its query by joining user input straight into the SQL.
• Aim: get past a login, or reveal, change or delete data.
• Prevention: validate input and pass it to the database as data, never as part of the SQL command.

Thieves reached a store's card tills via its air-con firm. How?

Access levels

• User access levels set which users can read, change or delete each file, folder or system.
• Each person gets only the access their role needs: a pupil can't open exam papers.
• An administrator sets and reviews them.
• Physical security: locked server rooms, ID badges and CCTV stop people reaching the equipment.

Passwords and authentication

• Authentication checks that a user really is who they claim to be, e.g. with a username and password.
• A strong password is long, mixes character types, isn't a dictionary word and isn't reused.
• Systems should lock an account after a few wrong attempts, which defeats guessing.

Firewalls

• A firewall monitors incoming and outgoing network traffic and allows or blocks it using a set of security rules.
• Firewalls inside a network stop traffic from one part reaching a more sensitive part.

Encryption as a defence

• Encryption scrambles data using a key, so only someone with the right key can read it.
• Data intercepted or stolen while encrypted is useless to an attacker without the key.
• Encrypt data sent across network connections, wired or wireless (e.g. HTTPS websites, wireless networks), and stored data.

Testing your own defences

• Penetration testing: authorised testers try to break into a system to find weaknesses before criminals do.

Big ideas

• Social engineering manipulates people into giving away information or access: people are often the weakest point in a system.
• Phishing uses fake messages and fake websites to steal details; check links, verify through a known contact, never share passwords.
• Malware is hostile software; it gets in through attachments, downloads, websites and weaknesses in software.
• Patches fix vulnerabilities, but only once installed; anti-malware must be kept up to date to recognise new malware.
• Network attacks include brute force, denial of service and data interception; each has its own defence.
• Access levels give each user only what their role needs; authentication proves who a user is; firewalls allow or block traffic using rules.
• Encryption makes intercepted or stolen data unreadable without the key.
• Penetration testing finds weaknesses before attackers do.