Network Security
Threats to computer systems and networks
What You'll Learn
Understand viruses, worms, trojans, ransomware, and spyware
Learn how attackers exploit human psychology
Understand password cracking techniques
Learn how attackers overwhelm systems
Understand how data can be stolen in transit
Learn how databases can be attacked
Why Network Security Matters
As more of our lives move online, computer systems become targets for attackers. Understanding threats helps us protect ourselves, our data, and the systems we use.
1. Malware
Malware (malicious software) is any software designed to harm, exploit, or damage computer systems, networks, or users.
Virus
How it works: Attaches itself to legitimate programs or files. Spreads when the infected file is shared or executed.
Purpose: Damage files, corrupt systems, spread to other computers.
Worm
How it works: Self-replicating malware that spreads across networks automatically without needing a host file.
Purpose: Spread rapidly, consume bandwidth, deliver other malware payloads.
Trojan
How it works: Disguises itself as legitimate software. Users willingly install it, not knowing it contains malicious code.
Purpose: Create backdoors for attackers, steal data, install other malware.
Ransomware
How it works: Encrypts files on the victim's computer, making them inaccessible. Demands payment for the decryption key.
Purpose: Extort money from victims who need their files back.
Spyware
How it works: Secretly monitors user activity. May record keystrokes (keylogger), capture screenshots, or track browsing.
Purpose: Steal passwords, financial details, personal information, or monitor activity.
Adware
How it works: Displays unwanted advertisements, often through pop-ups or browser redirects.
Purpose: Generate advertising revenue for attackers, may also collect browsing data.
How Malware Spreads
- Email attachments: Opening infected files attached to emails
- Malicious downloads: Downloading software from untrusted sources
- Infected websites: Visiting compromised websites (drive-by downloads)
- USB drives: Plugging in infected removable media
- Network vulnerabilities: Exploiting unpatched security holes
3. Brute-Force Attacks
A brute-force attack attempts to crack passwords or encryption by systematically trying every possible combination until the correct one is found.
How It Works
- Attacker obtains a password hash or encrypted data
- Software automatically tries millions of password combinations
- Each guess is compared to the target until a match is found
- Simple passwords can be cracked in seconds; complex ones take years
Types of Brute-Force Attacks
Pure Brute-Force
Tries every possible combination of characters.
Tries: a, b, c... aa, ab, ac... aaa, aab...
Dictionary Attack
Uses a list of common passwords and words.
Tries: password, 123456, qwerty, letmein...
Hybrid Attack
Combines dictionary words with numbers/symbols.
Tries: password1, password123, P@ssword...
Password Cracking Time
| Password | Type | Time to Crack |
|---|---|---|
123456 |
Numbers only | Instant |
password |
Dictionary word | Instant |
Fluffy2019 |
Word + numbers | Minutes to hours |
Tr0ub4dor&3 |
Mixed characters | Days to weeks |
correct-horse-battery-staple |
Long passphrase | Centuries |
4. Denial of Service (DoS) Attacks
A Denial of Service (DoS) attack aims to make a system, network, or website unavailable to legitimate users by overwhelming it with traffic or requests.
How It Works
Attacker sends massive amounts of requests
Server becomes overwhelmed
Legitimate users cannot access the service
Types of DoS Attacks
DoS (Single Source)
Attack comes from a single computer or location.
- Easier to block (block one IP)
- Limited attack power
- Less common today
DDoS (Distributed)
Attack comes from many computers simultaneously (often a botnet).
- Very difficult to block
- Massive attack power
- Uses thousands of infected computers
What is a Botnet?
A botnet is a network of computers infected with malware and controlled by an attacker. The owners often don't know their computers are being used for attacks.
- Computers in a botnet are called "zombies" or "bots"
- Botnets can contain millions of infected devices
- IoT devices (cameras, routers) are often targeted
Impact of DoS Attacks
- Website downtime: Online shops, banks, services become inaccessible
- Financial losses: Every minute of downtime costs money
- Reputation damage: Customers lose trust in unreliable services
- Distraction: May cover up other attacks happening simultaneously
5. Data Interception and Theft
Data interception occurs when attackers capture data as it travels across a network. This is sometimes called a "man-in-the-middle" attack.
How It Works
Neither the user nor the website knows the attacker is in the middle!
Methods of Data Interception
Packet Sniffing
Using software to capture network traffic. Effective on unencrypted connections.
WiFi Eavesdropping
Monitoring unsecured or poorly secured wireless networks.
Fake WiFi Hotspots
Creating a fake public WiFi (e.g., "Free_Coffee_Shop_WiFi") to capture all traffic.
ARP Spoofing
Redirecting network traffic through the attacker's computer.
What Data Can Be Stolen?
- Login credentials: Usernames and passwords
- Financial data: Credit card numbers, bank details
- Personal information: Names, addresses, dates of birth
- Session cookies: Allowing account takeover
- Emails and messages: Private communications
6. SQL Injection
SQL Injection is an attack that inserts malicious SQL code into application queries, allowing attackers to manipulate databases.
How It Works
Websites often use forms (login boxes, search fields) that send user input to a database. If the website doesn't properly validate input, attackers can inject SQL commands.
Normal Login Process
User enters: Username: alice Password: secret123
Query becomes: SELECT * FROM users WHERE username='alice' AND password='secret123'
Result: Returns Alice's account if credentials are correct
SQL Injection Attack
Attacker enters: Username: ' OR '1'='1 Password: ' OR '1'='1
Query becomes: SELECT * FROM users WHERE username='' OR '1'='1' AND password='' OR '1'='1'
Result: '1'='1' is always TRUE - returns ALL users! Attacker gains access!
What Attackers Can Do
- Bypass authentication: Log in without valid credentials
- Access data: Retrieve sensitive information from the database
- Modify data: Change prices, grades, account balances
- Delete data: Drop tables, destroy records
- Execute commands: Sometimes run system commands on the server
Real-World Impact
SQL injection has been used in major data breaches affecting millions of users. It consistently ranks in the OWASP Top 10 most critical web security risks.
Example attacks:
- 2017 Equifax breach - 147 million people affected
- TalkTalk breach - 157,000 customers' data stolen
- Sony Pictures hack - internal data leaked
Summary: Forms of Attack
| Attack Type | How It's Used | Purpose |
|---|---|---|
| Malware | Installed via downloads, emails, infected media | Damage systems, steal data, extort money, gain control |
| Social Engineering | Manipulates people through deception | Obtain credentials, sensitive info, or system access |
| Brute-Force | Tries all possible password combinations | Crack passwords to gain unauthorised access |
| DoS/DDoS | Floods systems with traffic | Make services unavailable, cause disruption |
| Data Interception | Captures data travelling across networks | Steal sensitive data in transit |
| SQL Injection | Inserts malicious code into database queries | Access, modify, or delete database contents |
Practice Activities
Apply what you've learned with these interactive exercises:
Key Terms
- Malware
- Malicious software designed to harm or exploit systems
- Virus
- Malware that attaches to files and spreads when executed
- Ransomware
- Malware that encrypts files and demands payment
- Social Engineering
- Manipulating people to reveal information or grant access
- Phishing
- Fraudulent messages designed to steal credentials
- Brute-Force Attack
- Trying all possible password combinations
- DoS/DDoS
- Overwhelming a system to make it unavailable
- Botnet
- Network of infected computers controlled by an attacker
- Data Interception
- Capturing data as it travels across a network
- SQL Injection
- Inserting malicious SQL into database queries
2. Social Engineering
Social engineering attacks manipulate people into revealing confidential information or performing actions that compromise security. These attacks exploit human psychology rather than technical vulnerabilities.
Phishing
How it works: Attackers send fraudulent messages (usually emails) that appear to come from trusted sources (banks, companies, colleagues). The message tricks victims into:
Purpose: Steal login credentials, financial information, or install malware.
Example Phishing Email
Dear Customer,
We have detected unusual activity on your account. Your account has been temporarily suspended.
Click here to verify your identity: http://amaz0n-verify.suspicious-site.com/login
If you do not verify within 24 hours, your account will be permanently deleted.
Other Social Engineering Techniques
Pretexting
Creating a fake scenario to gain trust. Example: Calling and pretending to be IT support to get login details.
Baiting
Leaving infected USB drives in public places, hoping someone will plug them into their computer.
Tailgating
Following an authorised person through a secure door without proper credentials.
Quid Pro Quo
Offering something (like free tech support) in exchange for information or access.