The right address, the wrong bank
Aisha types her bank's address correctly. The page looks perfect. She logs in. A week later, her money is gone.
She never clicked a bad link. The attack happened on the road between her phone and the bank.
Today you study four attacks that work on the way. They are a changed address book, a person in the middle, an open Wi-Fi hotspot and a data door with no lock.
Key words
| Word | What it means | Example |
|---|---|---|
| Network | Computers and devices joined together to share data. | The college Wi-Fi |
| Router | A device that joins networks and sends data the right way. | A home router |
| DNS | Domain name system. It turns a name such as example.com into an IP address. | Like an address book for the internet |
| IP address | A number that names a device on a network. | 203.0.113.5 |
| Man-in-the-middle | An attacker sits between two sides and reads or changes what they send. | A fake Wi-Fi hotspot |
| Encryption | Scrambling data so that only the right people can read it. | HTTPS |
| HTTPS | Web traffic that is encrypted. The address starts with https and a padlock shows. | A bank site |
| API | A door that lets one program ask another for data. | A weather app asking a server |
| API key | A secret code that proves who is asking an API. | A long string of letters |
| Impact | The bad thing that happens after an attack. | stolen money |
| VPN | Virtual private network. A private encrypted tunnel across the internet. | Used on public Wi-Fi |
The cells students fill in are left blank in this preview.
Quick check: on the way
Have a go
Quick check: on the way
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
DNS attacks: a changed address book
Your phone asks DNS: "What is the number for mybank.com?" DNS answers with a number.
In a DNS attack, the attacker changes the answer, so the number points to a fake site. The traffic is sent to the wrong place (redirected). The fake page looks the same and steals your password.
Impact: stolen logins and money. Fixes: use a trusted DNS service, check for the padlock, and keep your router updated.
Try it: an address book that is changed
address_book = {"mybank.com": "203.0.113.5", "news.com": "203.0.113.9"}
print("Before:", address_book["mybank.com"])
# The attacker changes one line. Now the name leads to a fake site.
address_book["mybank.com"] = "198.51.100.66"
print("After:", address_book["mybank.com"])
# Same name, different place. The user sees no difference.
Man-in-the-middle
In a man-in-the-middle attack, the attacker sits between you and the bank. You think you talk to the bank. The bank thinks it talks to you. The attacker reads, and may change, every message.
Impact: stolen passwords, changed payments. Fixes: use HTTPS, so the messages are scrambled. Do not click past a warning. Use a VPN on a network you do not trust.
Put the attack in order
Have a go
Put the attack in order
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.