System Software Security

System Software Security

1. Cybercrime can take many forms including planting viruses, acquiring and using personal or confidential data and disrupting a website or service Cyber attacks take advantage of: Human weakness or gullibility Technical weaknesses in computer systems, networks or digital devices

2. Humans are often the weakest point in security Social engineering is the art of manipulating or ‘conning’ individuals into giving away private information or login IDs and passwords Two common techniques are: Phishing Shoulder surfing

3. A phishing email is one that tricks you into handing over sensitive or personal information (login details, bank details, etc.) You receive what looks like a legitimate email, for example from a bank or an organisation such as PayPal or eBay The email urges you to visit a bogus website and enter your personal details, which are then captured by the phishers

4. Phishers send out hundreds of thousands of emails that look as though they are from legitimate companies For phishing to be successful, the criminals must get you to click on a link in the email to go to a website A successful phishing campaign has around a 5% response rate – meaning 5% of recipients are conned!

5. Greeting: The phishers don’t know your name – just your email address, so the greeting is not personalised The sender’s address is often a variation on a genuine address Forged link: The link looks genuine, but it may not link to the website given. Roll your mouse over it to check Request for personal information: Genuine organisations never do this Sense of urgency: Criminals try to persuade you that something bad will happen if you don’t act fast Poor spelling and grammar

6. Use a SPAM filter to prevent common scams ever reaching your inbox Be suspicious! If you aren’t completely certain it’s genuine, NEVER click any links or download attachments

7. Shouldering involves direct observation of a user entering their security details

8. In a brute force attack, a hacker may go through a list of different passwords until access to an account is gained Alternatively, the attacker may try every combination of characters until the correct password is found

   • Validation checks on a new password may specify that it must be: between 10 and 15 characters (length check) a mixture of numbers, lower and uppercase characters and symbols (format check) You should never include your name, DOB or personal details
     • The mobile phone hacking scandal, concluded in 2012, involved the use of default PIN numbers Journalists used the mobile phone numbers of prominent people to gain access to their voicemail remotely, using a public voicemail access number When asked for a PIN to listen to their messages, they tried the default PIN number which was frequently unchanged

9. A computer virus is one type of malware (malicious software) which is installed without your knowledge, with the purpose of doing harm A virus is a program which infects (embeds itself in) other programs or data files It is easily spread if a user innocently sends an infected file to someone else It is commonly found in email attachments with macros

   • A worm is another type of malware It is a standalone program that doesn’t need to attach itself to an existing program in order to spread It may scan the Internet looking for vulnerable computers to infect
     • Common sources and forms of attack include: USB devices digital devices eavesdropping
       • Criminals sometimes leave a USB stick contaminated with a virus lying, for example, in the car park of a company that they wish to infect with a virus or steal data from An unsuspecting employee may pick it up and insert it into their computer
   • “Eavesdropping” is used to intercept data packets as they move across networks Packets are inspected for useful data that could be misused or sold The practice is also carried out by some security agencies in information gathering Eavesdropping is a modern day form of wiretapping
     • Hackers can use your mobile device to access detailed information about your daily life While you browse Facebook on your smartphone, someone could be tracking your every move, determining your GPS coordinates, the direction you are walking in and how fast you’re walking
       • Digital devices are often targeted by criminals Loss of a mobile phone can lead to the loss of all the data stored on it, including passwords, account numbers and credit card details Malware which targets digital devices may create “back doors” to give malicious users access to your device Many apparently legitimate apps are malicious and may lead to fraudulent charges on your phone bill or theft of personal information Technical measures like firewalls, antivirus protection and encryption are uncommon on mobile phones

10. A DoS attack attempts to flood a website server with an overwhelming number of data requests It may flood the victim’s site with spam emails (an “email bomb”) or disrupt access to a victim’s website or entire geographical area by reconfiguring software to crash network sites The motive is often revenge, blackmail or terrorism

    • SQL is a database query language SQL injection takes advantage of web input forms to access or destroy data SQL commands can be input into web forms instead of the expected ‘real’ data This can be interpreted by vulnerable web applications as an additional instruction to operate in the hacker’s favour