Digital Security Basics Module 7

Podcast Beta

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Are hackers able to exploit communication ports?

True

How do hackers exploit communication ports?

Hackers use a technique called port scanning to discover which ports are open on a device.

What is a port scan?

A port scan pings a packet of data to the port. If a reply is received, the port is open.

What is a firewall?

A firewall is a device or software that is designed to block unauthorized access while allowing authorized communications. Signup and view all the answers

What is a personal firewall?

A personal firewall is a software-based deterrent against unauthorized port access. Signup and view all the answers

Only one software-based firewall should be active, because firewalls have a tendency to conflict with each other.

True Signup and view all the answers

A router acts as a firewall to block connections that are not initiated inside a local network.

True Signup and view all the answers

Do I need NAT in addition to a personal firewall?

Yes, NAT is the best line of defense against attacks that originate from the Internet. Signup and view all the answers

What types of interception exploits are threats?

Spyware, Adware, Keyloggers, and Man-in-the-Middle. Signup and view all the answers

What is spyware?

Any software that secretly gathers personal information without the victim's knowledge is classified as spyware. Signup and view all the answers

What is adware?

Adware monitors web browsing activity to supply ad-serving sites with data for targeted ads. Signup and view all the answers

What are keyloggers?

Keyloggers record keystrokes and send them to a hacker. Signup and view all the answers

What is Man-in-the-Middle?

An eavesdropping exploit where a third party intercepts communications. Signup and view all the answers

How do man-in-the-middle attacks work?

A third party intercepts communications between two entities without their knowledge. Signup and view all the answers

What is an Evil Twin?

An Evil Twin is a LAN server designed to look like a legitimate Wi-Fi hotspot. Signup and view all the answers

How does the Evil Twin exploit work?

Hackers set up a Wi-Fi hotspot to capture unsecured data from users. Signup and view all the answers

What is address spoofing?

Address spoofing changes an originating or destination address to redirect data flow. Signup and view all the answers

What is an email address spoof?

It changes the sender's address to mask the source of spam. Signup and view all the answers

What is IP address spoof?

It modifies the source address of data packets used in a denial-of-service attack. Signup and view all the answers

What is a DNS address spoof?

It changes the IP address that corresponds to a URL to redirect traffic. Signup and view all the answers

The DNS address spoof changes the ARP (Address Resolution Protocol) routing table on a local area network.

True Signup and view all the answers

How does address spoofing affect browsing?

By spoofing Google's IP address, users can be sent to a fake Google site. Signup and view all the answers

Why is encryption vulnerable?

The method of encrypting communication relies on a protocol called TLS that can be susceptible to attacks. Signup and view all the answers

What is the problem with TLS?

Digital certificates can be faked, compromising their trustworthiness. Signup and view all the answers

How does a digital certificate hack work?

By using DNS address spoofing, data can be tunneled through a malicious server. Signup and view all the answers

Basic digital security depends on which two techniques?

Encryption Signup and view all the answers

How does encryption work?

Encryption transforms a message or data file so that its contents are hidden from unauthorized readers. Signup and view all the answers

An original message or file that has not yet been encrypted is referred to as plaintext or cleartext.

True Signup and view all the answers

An encrypted message or file is referred to as ciphertext.

True Signup and view all the answers

What is encryption?

The process of converting plaintext into ciphertext. Signup and view all the answers

What is decryption?

The process of converting ciphertext into plaintext. Signup and view all the answers

How is data encrypted?

Data is encrypted by using a cryptographic algorithm and a key. Signup and view all the answers

What is a cryptographic algorithm?

A procedure for encryption or decryption. Signup and view all the answers

What is a cryptographic key?

A word, number, or phrase that must be known to encrypt or decrypt data. Signup and view all the answers

A password is typically used as the key to encrypt and decrypt data.

True Signup and view all the answers

What can be encrypted?

Data packets sent over networks, bank card numbers, email messages, storage volumes, and sensitive files can be encrypted. Signup and view all the answers

How well does encryption protect files?

There are various encryption methods, and some are more secure than others. Signup and view all the answers

What is the encryption standard currently used worldwide?

AES (Advanced Encryption Standard) Signup and view all the answers

It is possible to crack AES, but the process is difficult and requires lots of computer power.

True Signup and view all the answers

What is user authentication?

Any technique used to verify or confirm a person's identity. Signup and view all the answers

Authentication techniques such as passwords, PINs, fingerprint scans, and facial recognition can prevent unauthorized access to the data.

True Signup and view all the answers

How does two-factor authentication increase security?

It verifies identity based on two components, such as a password and a verification code. Signup and view all the answers

What does a brute force attack use?

Password-cracking software to generate every possible combination of letters, numerals, and symbols. Signup and view all the answers

What does a dictionary attack help hackers to do?

Guess your password by stepping through a dictionary containing common words and mutations. Signup and view all the answers

What makes a password susceptible to a dictionary attack?

Weak passwords such as passpass or computercomputer. Signup and view all the answers

What makes a password susceptible to a brute force attack?

Passwords are easier to crack if chosen from a smaller range of possibilities. Signup and view all the answers

The number of possible passwords depends on factors that include the size of the character set and the length of the password.

True Signup and view all the answers

What is password entropy?

A measure in bits of a password's unpredictability. Signup and view all the answers

Passwords with higher entropy are more secure than passwords with low entropy.

True Signup and view all the answers

How does a password manager work?

It keeps track of passwords so users don't have to memorize them. Signup and view all the answers

What does a password strength meter indicate?

The strength of a password and its resistance to attacks. Signup and view all the answers

The encrypted file that stores user IDs and passwords is protected by a master password.

True Signup and view all the answers

Passwords stored locally are tied to the device on which they are created.

True Signup and view all the answers

Malware is also a component of cyberwarfare attacks that pose a threat to national security.

True Signup and view all the answers

What are malware threats?

Any computer program designed to surreptitiously enter a digital device. Signup and view all the answers

What is a payload or malware exploit?

The action carried out by malware code. Signup and view all the answers

What can malware be used for?

Deleting files, recording keystrokes, allowing remote control of a device, and more. Signup and view all the answers

When was the first computer virus designed to affect personal computers appear?

In 1982. Signup and view all the answers

What is a virus?

A set of self-replicating program instructions that attaches itself to a legitimate executable file. Signup and view all the answers

What are logic bombs?

Viruses that deliver their payloads in response to some other system event. Signup and view all the answers

What are time bombs?

Viruses that deliver their payloads on a specific date. Signup and view all the answers

What is code injection?

The process of modifying an executable file or data stream by adding additional commands. Signup and view all the answers

How does a virus spread?

By exchanging infected files, email attachments, and through social networking sites. Signup and view all the answers

What is side-loading?

A process where an app from a source other than an official app store is installed. Signup and view all the answers

What is a rootkit?

Any code that hides the existence of processes and privileges. Signup and view all the answers

Modern rootkits are used to hide malicious code by replacing parts of the operating system with modified code.

True Signup and view all the answers

What is a worm?

A small self-replicating program designed to carry out unauthorized activities. Signup and view all the answers

How can worms enter a device?

Through security holes in browsers, email attachments, and infected links. Signup and view all the answers

A mass-mailing worm spreads by sending itself to every address in the worm's contact list.

True Signup and view all the answers

What does an Internet worm look for?

Vulnerabilities in operating systems, open communications ports, and JavaScripts. Signup and view all the answers

What does a file-sharing worm do?

Copies itself into a shared folder under an innocuous name. Signup and view all the answers

Today, more than 80% of malware infections are trojans.

True Signup and view all the answers

How do trojans differ from viruses and worms?

Trojans do not spread themselves; they rely on users to install them. Signup and view all the answers

What are trojans?

Programs that masquerade as useful utilities but perform harmful actions. Signup and view all the answers

What can trojans contain?

Viruses, code to take control of a device, or routines called droppers. Signup and view all the answers

What is a dropper?

A tool designed to deliver or 'drop' malicious code into a device. Signup and view all the answers

What is the difference between a dropper and code injection?

A dropper installs a malicious program, while code injection adds malicious code to an existing program. Signup and view all the answers

Antivirus software is a type of utility software that looks for and eliminates malware.

True Signup and view all the answers

What is a virus signature?

A section of code that uniquely identifies a malware exploit. Signup and view all the answers

How well does heuristic analysis work?

It requires time and system resources to examine files. Signup and view all the answers

Heuristics may produce false positives that mistakenly identify a legitimate file as malware.

True Signup and view all the answers

What happens when malware is detected?

Antivirus software can try to remove, quarantine, or delete the malware. Signup and view all the answers

How dependable is antivirus software?

Today's antivirus software is quite dependable but not infallible. Signup and view all the answers

What is the purpose of a manual scan?

To scan specific files initiated by a user. Signup and view all the answers

What's a virus hoax?

An email warning about a supposed new virus, often leading to unwanted downloads. Signup and view all the answers

What is the risk of online intrusions?

When an unauthorized person gains access to a digital device via the Internet. Signup and view all the answers

What are the characteristics of online intrusions?

Most begin with malware setting up a backdoor for future access. Signup and view all the answers

What are the steps of an online intrusion?

Malware enters a device, creates a backdoor, opens communication with a hacker, and executes commands. Signup and view all the answers

Are there different types of intrusions?

True Signup and view all the answers

What is a RAT?

Malware that disguises itself as legitimate software to establish a secret link to a hacker. Signup and view all the answers

What is a backdoor?

An undocumented method of accessing a digital device. Signup and view all the answers

What is ransomware?

A virus that encrypts user storage until payment is made to unlock it. Signup and view all the answers

What is a botnet?

A network of compromised devices controlled by hackers. Signup and view all the answers

Botnets have been used to carry out massive DDoS attacks.

True Signup and view all the answers

What is DDoS?

A distributed denial of service attack. Signup and view all the answers

A botmaster controls a network of victims' computers using IRC channels for communication.

True Signup and view all the answers

Commands from botmaster include:

Click fraud, DDoS, spam, mine bitcoins, and crack encryption. Signup and view all the answers

Does antivirus software protect devices from intrusions?

It can prevent some, but not all, intrusions. Signup and view all the answers

What is a zero-day attack?

An attack that exploits previously unknown vulnerabilities. Signup and view all the answers

On-access scans are also called:

Real-time protection, background scanning, and autoprotect. Signup and view all the answers

Study Notes

Digital Security Fundamentals

Basic digital security relies on encryption and authentication for protection.
Encryption hides information from unauthorized readers by transforming messages or files.
The original unencrypted content is known as plaintext or cleartext, while the encrypted content is termed ciphertext.

Encryption and Decryption

Encryption: The process of converting plaintext into ciphertext.
Decryption: Reverses encryption, converting ciphertext back to plaintext.
Data encryption utilizes a cryptographic algorithm paired with a cryptographic key for secure communication.

Cryptographic Key and Algorithms

A cryptographic key is typically a word or number necessary for encryption/decryption.
Cryptographic algorithms define the methods used for encryption and decryption.

Passwords and Security

Passwords function as keys, playing a crucial role in data protection.
Various data types can be encrypted, including personal data, email communications, and entire storage volumes.
Password strength hinges on complexity; weak passwords (e.g., "passpass") are easily crackable.

Attack Methods

Brute Force Attack: Attempts every possible password combination, often requiring substantial time and resources.
Dictionary Attack: Uses common words and phrases to guess passwords, leveraging known weaknesses.

Security Measures

Employing two-factor authentication enhances security by requiring two verification components.
Password strength meters evaluate password security against brute force and dictionary attacks.

Malware and Cyber Threats

Malware encompasses harmful programs designed to infiltrate devices, including viruses, worms, and trojans.
A virus replicates by attaching itself to legitimate files; worms are standalone programs that spread autonomously.
Trojan horses masquerade as legitimate software but lead to malicious activities upon installation.

Specific Types of Malware

Ransomware encrypts user data until a ransom is paid for access.
Rootkits hide malicious processes from detection, often modifying operating system components.
Backdoors allow unauthorized remote access to victim systems, often utilized by RAT (Remote Access Trojans).

Intrusions and Defense Strategies

Online intrusions often initiate through malware, which opens backdoors for hackers.
Botnets consist of networks of compromised devices controlled by a hacker, often utilized for DDoS attacks.
Firewalls block unauthorized access and can be software-based (personal firewalls) or hardware-based (network routers).

Protection and Reliability

Antivirus software detects and eliminates malware but may not catch sophisticated threats like zero-day exploits.
Manual scans help users check for infections if there are suspicions of malware incidents.

Exploiting Vulnerabilities

Hackers conduct port scanning to identify open communication ports on devices.
Spyware collects user data without consent, while adware monitors web activity to serve targeted ads.

Threat Prevention

Systems utilizing Network Address Translation (NAT) enhance security against outside attacks, complementing personal firewalls by addressing internal threats.

Keyloggers

Keyloggers are a type of spyware that record keystrokes and transmit the information to hackers.
They are commonly used by identity thieves and industrial spies to obtain user passwords and access accounts.

Man-in-the-Middle Attacks

A Man-in-the-Middle (MITM) attack involves a third party intercepting communication between two entities without their knowledge.
Types of MITM attacks include Evil Twins, address spoofing, digital certificate hacks, and IMSI catchers.
A third party can either passively monitor communications or actively modify data during transfer.

Evil Twin Exploit

An Evil Twin is a fraudulent Wi-Fi hotspot that mimics a legitimate network to deceive users.
Hackers set up unsecured Wi-Fi hotspots to capture data from users, including online banking details and social media passwords.

Address Spoofing

Address spoofing involves altering the originating or destination address of data to redirect communication.
Various types include email address spoofing, IP address spoofing, and DNS address spoofing.

Spoof Types

Email address spoofing disguises the sender's address, often used in spam.
IP address spoofing modifies source IP addresses in denial-of-service (DoS) attacks.
DNS address spoofing changes the IP address associated with a URL, redirecting victims to fraudulent websites.

ARP Address Spoofing

ARP spoofing alters the routing table on a local area network, redirecting traffic through a malicious device.

Address Spoofing Impact on Browsing

Spoofing of Google’s IP address by authorities can redirect users to fake sites, which may block access to controversial content.

Vulnerability of Encryption

Encryption of client-server communication relies on TLS (Transport Layer Security) and digital certificates to verify server identity.
Public keys are used by clients to encrypt messages sent to servers.

Issues with TLS

Digital certificates, which validate server identities, can be faked, creating security vulnerabilities.
A valid certificate is signed by an official certificate authority, while a fake may appear legitimate but lacks a valid signature.

Digital Certificate Hacking

Digital certificate hacks can involve DNS address spoofing, which routes all data from users through malicious servers, potentially enabling surveillance or censorship.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Description

Explore the essential concepts of digital security in this Module 7 quiz. Test your knowledge on encryption, authentication, and plaintext definitions through flashcards designed for effective learning.