Digital Security Basics Module 7

Digital Security Fundamentals

• Basic digital security relies on encryption and authentication for protection.
• Encryption hides information from unauthorized readers by transforming messages or files.
• The original unencrypted content is known as plaintext or cleartext, while the encrypted content is termed ciphertext.

Encryption and Decryption

• Encryption: The process of converting plaintext into ciphertext.
• Decryption: Reverses encryption, converting ciphertext back to plaintext.
• Data encryption utilizes a cryptographic algorithm paired with a cryptographic key for secure communication.

Cryptographic Key and Algorithms

• A cryptographic key is typically a word or number necessary for encryption/decryption.
• Cryptographic algorithms define the methods used for encryption and decryption.

Passwords and Security

• Passwords function as keys, playing a crucial role in data protection.
• Various data types can be encrypted, including personal data, email communications, and entire storage volumes.
• Password strength hinges on complexity; weak passwords (e.g., "passpass") are easily crackable.

Attack Methods

• Brute Force Attack: Attempts every possible password combination, often requiring substantial time and resources.
• Dictionary Attack: Uses common words and phrases to guess passwords, leveraging known weaknesses.

Security Measures

• Employing two-factor authentication enhances security by requiring two verification components.
• Password strength meters evaluate password security against brute force and dictionary attacks.

Malware and Cyber Threats

• Malware encompasses harmful programs designed to infiltrate devices, including viruses, worms, and trojans.
• A virus replicates by attaching itself to legitimate files; worms are standalone programs that spread autonomously.
• Trojan horses masquerade as legitimate software but lead to malicious activities upon installation.

Specific Types of Malware

• Ransomware encrypts user data until a ransom is paid for access.
• Rootkits hide malicious processes from detection, often modifying operating system components.
• Backdoors allow unauthorized remote access to victim systems, often utilized by RAT (Remote Access Trojans).

Intrusions and Defense Strategies

• Online intrusions often initiate through malware, which opens backdoors for hackers.
• Botnets consist of networks of compromised devices controlled by a hacker, often utilized for DDoS attacks.
• Firewalls block unauthorized access and can be software-based (personal firewalls) or hardware-based (network routers).

Protection and Reliability

• Antivirus software detects and eliminates malware but may not catch sophisticated threats like zero-day exploits.
• Manual scans help users check for infections if there are suspicions of malware incidents.

Exploiting Vulnerabilities

• Hackers conduct port scanning to identify open communication ports on devices.
• Spyware collects user data without consent, while adware monitors web activity to serve targeted ads.

Threat Prevention

• Systems utilizing Network Address Translation (NAT) enhance security against outside attacks, complementing personal firewalls by addressing internal threats.

Keyloggers

• Keyloggers are a type of spyware that record keystrokes and transmit the information to hackers.
• They are commonly used by identity thieves and industrial spies to obtain user passwords and access accounts.

Man-in-the-Middle Attacks

• A Man-in-the-Middle (MITM) attack involves a third party intercepting communication between two entities without their knowledge.
• Types of MITM attacks include Evil Twins, address spoofing, digital certificate hacks, and IMSI catchers.
• A third party can either passively monitor communications or actively modify data during transfer.

Evil Twin Exploit

• An Evil Twin is a fraudulent Wi-Fi hotspot that mimics a legitimate network to deceive users.
• Hackers set up unsecured Wi-Fi hotspots to capture data from users, including online banking details and social media passwords.

Address Spoofing

• Address spoofing involves altering the originating or destination address of data to redirect communication.
• Various types include email address spoofing, IP address spoofing, and DNS address spoofing.

Spoof Types

• Email address spoofing disguises the sender's address, often used in spam.
• IP address spoofing modifies source IP addresses in denial-of-service (DoS) attacks.
• DNS address spoofing changes the IP address associated with a URL, redirecting victims to fraudulent websites.

ARP Address Spoofing

• ARP spoofing alters the routing table on a local area network, redirecting traffic through a malicious device.

Address Spoofing Impact on Browsing

• Spoofing of Google’s IP address by authorities can redirect users to fake sites, which may block access to controversial content.

Vulnerability of Encryption

• Encryption of client-server communication relies on TLS (Transport Layer Security) and digital certificates to verify server identity.
• Public keys are used by clients to encrypt messages sent to servers.

Issues with TLS

• Digital certificates, which validate server identities, can be faked, creating security vulnerabilities.
• A valid certificate is signed by an official certificate authority, while a fake may appear legitimate but lacks a valid signature.

Digital Certificate Hacking

• Digital certificate hacks can involve DNS address spoofing, which routes all data from users through malicious servers, potentially enabling surveillance or censorship.