What if you type code, not a name?
A website asks for your name. You type "Sam". The site says "Hello Sam".
Now a different person types something strange. The site shows every name in its list.
The site made a mistake: it trusted what a stranger typed. Many attacks start in this way.
Key words
| Word | What it means | Example |
|---|---|---|
| Hacker | A person who gets into a system. A malicious hacker has no permission. | a criminal |
| Hacktivist | A hacker who attacks to support a cause. | a protest attack |
| Nation state | A country's government hackers. | spying on another country |
| Brute force | Trying every possible password until one works. | 0000, 0001, 0002 ... |
| Cross-site scripting | XSS. An attacker gets a page to run their code in other people's browsers. | a harmful comment |
| Database | A store of organised data that programs can ask questions. | a table of users |
| Query | A question that a program asks a database. | find the user called sam |
| SQL injection | Typed text that changes what a database query does. | a search box that shows secrets |
| Buffer overflow | Too much data is put in a small space. It spills into the next space. | 20 letters in a 10 letter box |
| Man-in-the-middle | An attacker secretly sits between two people and reads their messages. | a fake Wi-Fi hotspot |
| DNS | The internet's phone book. It turns a name like shop.com into an address. | shop.com becomes 203.0.113.5 |
| API | A way for one program to ask another program for data. | a weather app asking a weather service |
The cells students fill in are left blank in this preview.
Quick check: who attacks and why?
Have a go
Quick check: who attacks and why?
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Who attacks?
| Attacker | Wants | Example |
|---|---|---|
| Hacktivist | To make a point | Takes down a site of a company they dislike |
| Nation state | Secrets and power | Spies on another country's government |
| Organised crime | Money | Steals card numbers and sells them |
| Individual | Money, fun or revenge | A student who tries to change their own marks |
The cells students fill in are left blank in this preview.
Password cracking
A computer can try millions of passwords a second. Brute force tries all of them.
The more characters you use, the more combinations there are. Each new character multiplies the number.
See the table. A 4 digit PIN has 10 choices for each of 4 places.
Worked example: how many guesses?
| Password type | Choices per place | Places | Working | Combinations |
|---|---|---|---|---|
| 4 digit PIN | 10 | 4 | 10 x 10 x 10 x 10 | 10,000 |
| 6 digit PIN | 10 | 6 | 10 x 10 x 10 x 10 x 10 x 10 | 1,000,000 |
| 3 lowercase letters | 26 | 3 | 26 x 26 x 26 | 17,576 |
The cells students fill in are left blank in this preview.
Try it: count the combinations
# In Python, ** means "to the power of".
# 10 ** 4 means 10 x 10 x 10 x 10.
print(10 ** 4)
# A computer that tries 1000 guesses a second:
guesses_per_second = 1000
seconds = (10 ** 4) / guesses_per_second
print("A 4 digit PIN takes", seconds, "seconds")
# Change 10 ** 4 to 10 ** 6 in both places. How long now?
Extra: Going further: longer passwords
| Password type | Choices per place | Places | Combinations |
|---|---|---|---|
| 3 lowercase letters | 26 | 3 | 17,576 |
| 6 lowercase letters | 26 | 6 | 308,915,776 |
| 8 lowercase letters | 26 | 8 | 208,827,064,576 |
The cells students fill in are left blank in this preview.