Exam practice

• a.MFA: multi-factor authentication.
• b.2FA: two-factor authentication.
• c.VPN: virtual private network.
• d.DDoS: distributed denial of service.
• e.XSS: cross-site scripting.
• f.AES: Advanced Encryption Standard.
• g.HTTPS: HyperText Transfer Protocol Secure.
• h.TLS: Transport Layer Security.

Each letter 4 places along: S → W, C → G, I → M, E → I, N → R, C → G, E → I; P → T, L → P, A → E, Y → C, G → K, R → V, O → S, U → Y, N → R, D → H.
SCIENCE PLAYGROUND → WGMIRGI TPECKVSYRH.
Decrypting, each letter 4 places back: X → T, L → H, M → I, W → S; M → I, W → S; E → A; W → S, I → E, G → C, V → R, I → E, X → T.
XLMW MW E WIGVIX → THIS IS A SECRET.

• Brute force: try every shift, 1 to 25, and see which one gives sensible words. It works because the key space is tiny: 25 tries take a person a few minutes and a computer less than a millisecond.
• Frequency analysis: count how often each letter comes in the ciphertext. The commonest letter probably stands for E (or T or A); the distance from E to it is the shift. It works because the cipher moves every letter by the same amount, so the language’s pattern of common and rare letters is kept, only moved along. It needs a long enough message for the pattern to show.

• i.2⁴⁰ = 1,099,511,627,776, about 1.1 × 10¹² keys.
• ii.1.1 × 10¹² ÷ 10⁹ = 1,100 seconds, about 18 minutes.
• iii.40 more bits multiply the keys by 2⁴⁰ ≈ 1.1 × 10¹². So 1,100 seconds × 1.1 × 10¹² ≈ 1.2 × 10¹⁵ seconds. Dividing by about 3.2 × 10⁷ seconds in a year: about 38 million years. Doubling the key’s length doesn’t double the time; it multiplies it by a trillion.

A hash function works out a short, fixed-size value, the hash, from any data. The same input always gives the same hash; the hash can’t be turned back into the input; and a tiny change in the input gives a completely different hash.
Websites store a hash because their list of users may one day be stolen. If they stored passwords, the thief would have every password at once, and could use them on other websites too. A list of hashes can only be attacked by guessing passwords one by one, which is slow for strong passwords, especially with a salt and a slow hash.
To check a login, the website hashes the password typed (with that user’s salt) and compares the result with the stored hash. If they are the same, the password was right. It never needs to know the password itself.

A salt is a few random characters, different for each user, added to the password before hashing, and stored beside the hash.

1. Users with the same password get different hashes, so cracking one user’s hash tells the thief nothing about the others: each must be attacked separately.
2. Ready-made lists of the hashes of common passwords become useless, because they weren’t made with these salts: the thief must start every guess from scratch for every user.

Each person has a key pair. The public key is like an open padlock: its owner gives copies to anyone. The private key is like the padlock’s only key: its owner keeps it. To send Ram a secret, Sita locks it with Ram’s public key (snaps his padlock shut); now only Ram’s private key can open it, and Sita doesn’t need any key to lock it.
It works between strangers because no secret ever has to travel: only the public key crosses the network, and an eavesdropper who copies it can lock messages but never open them. In practice the two sides use it to agree on a fresh shared key, then a fast cipher like AES does the rest.
One difference: a real padlock can be cut or picked, but a public key is mathematics, which can be broken only by working out the private key, practically impossible with long keys. (Or: a public key can be copied endlessly and posted anywhere, which gives an attacker nothing.)

It proves who signed something (only the owner of the private key could have made the signature) and that it hasn’t been changed since it was signed.
Making it: the signer hashes the document, and from the hash makes a signature with their private key; the signature is sent with the document.
Checking it: anyone hashes the document they received, and uses the signer’s public key to check that the signature matches that hash. If even one letter of the document was changed, the hashes differ and the check fails.

It protects what you send and receive from being read or changed by anyone on the way: for example, someone else on a tea shop’s free Wi-Fi can’t read the password you type into your bank’s website, or change the page you see.
It doesn’t protect you from a dishonest website: for example, a thief’s fake page at bhakaripay-reward.com can have a valid certificate and a padlock; HTTPS will faithfully encrypt your password on its way to the thief. It also doesn’t hide which website you visit, or protect you from malware already on your phone.

Social engineering is tricking people into giving away secrets, money or access, instead of breaking the technology.

• Phishing: a message with a link to a fake login page, which collects the password and code.
• Pretexting: a made-up story told to the right person, such as a caller pretending to be from the bank and asking for a PIN to “stop a fraud”.
• Baiting: a tempting pen drive left lying around, or a free app, which carries malware.
• (Or tailgating: following someone with a key through a locked door.)

It works by pressing on urgency, authority, fear, greed or kindness. Defenses: slow down; check through a channel you choose yourself (call the bank on the number on your card, open the app yourself); never share codes or PINs; for organizations, rules (call back on the registered number, nobody enters without a card) and training staff to follow them.

• a.SQL injection. As the password the attacker types ' OR '1'='1. The query becomes … AND password = '' OR '1'='1': the first quote mark closes the password, and OR '1'='1' is always true, so the database finds the account whatever the password. It works because the user’s input is joined into the command and becomes part of it.
• b.1. Input joined into the command: send the command and the input separately (placeholders), so the input can only ever be data. 2. Passwords stored as they are (the query compares the password itself): store a salted, slow hash of each password, and compare hashes. (Also good: lock or slow down an account after several wrong tries; log failed logins.)

A buffer overflow is when a program writes more data into a space in memory than was kept for it, so the extra spills into the memory next to it. That memory may hold other data (such as whether the user is an admin) or the address the program will jump to next, which an attacker can overwrite to run instructions of their own.
Python checks every position: writing past the end of a list stops the program with an error (IndexError) instead of spilling into other memory.
The operating system runs apps in user mode, so a hijacked app still can’t touch the hardware or other apps’ memory directly; it can do only what that app was allowed to. Updates fix such flaws once they are found.

• i.Flooding (a DDoS attack): the school and its students, who can’t see their results (availability).
• ii.Passwords (credential stuffing, using reused passwords): the email users, whose messages and other accounts are now open.
• iii.People (tailgating, social engineering), and a physical security gap: the office, and everyone whose data was on the laptop, if it wasn’t encrypted.
• iv.Old software: the phone’s owner, whose data, accounts and money are now at risk.

The most urgent: stop installing apps from links (it could put malware next to the wallet) and add the screen lock; both cost almost nothing. A shop’s payments phone protects the family’s income, so it deserves the strongest protection the family owns.

Any three, such as:

• Locking an account after five wrong tries stops guessing, but an attacker can lock the real user out on purpose, and a forgetful user gets locked out too.
• Two-step login stops a thief with a stolen password, but takes longer every time, and if the phone is lost the user needs backup codes to get in.
• Encrypting a laptop protects the data if it is stolen, but if the owner forgets the password, the data is lost to them too.
• CCTV in an office keeps strangers out, but costs money and watches the staff, a cost to their privacy.
• Updates close holes, but take time and data, and sometimes break things.

So a good choice weighs the protection against the price, and is strongest where the harm would be greatest.