Brute force, denial of service, SQL injection and data interception, and the maths of guessing passwords.
What you will learn
- Recognise brute force, DoS, SQL injection and interception
- Work out how many passwords or PINs are possible
- Explain how SQL injection works
Four attacks
- Brute force: try every possible password, or a list of common ones, until one works.
- Denial of service (DoS): flood a server with requests so real users cannot get through. A distributed DoS uses many computers at once, often a botnet.
- SQL injection: type SQL into an input box on a site that puts input straight into its database queries, so the extra code runs.
- Data interception: capture data as it travels, for example with a packet sniffer (software that captures and reads packets on a network) on open Wi-Fi.
Each attack has its own defence. Brute force: strong passwords, locking the account after a few wrong tries, and two-factor authentication. Denial of service: a firewall that blocks floods of traffic from suspicious sources.
SQL injection: validating and sanitising input, and using parameterised queries, so typed text is never run as SQL. Data interception: encrypting data before it is sent. Shouldering is stopped by shielding the keypad, and phishing by training staff to spot suspicious emails.
SELECT * FROM Users WHERE username = 'x' OR '1'='1'The text x' OR '1'='1 closes the quote early; '1'='1' is always true, so every record comes back.
The rest of this lesson and its 7 practice questions are locked.
In this lesson
- Four attacks
- Counting possible passwords
- Try it: How many PINs?
7 practice questions, marked as you go; about 20 minutes in all.
In this unit: Cyber security
Malware and social engineering, brute force, denial of service, SQL injection and interception, and the defences against them, with Caesar ciphers and password maths.