CYBERSECURITY MODULE 2.1-2.2

Main ideas, concepts, and lessons

1) What “attacks, concepts, and techniques” mean (Module 2.1)

• Attacks: Intentional attempts to compromise the confidentiality, integrity, or availability (CIA) of a system or information.
• Concepts: Core cybersecurity ideas that explain how attacks happen and how systems should be protected.
• Techniques: Specific, practical methods attackers use to accomplish their goals.

2) Why successful compromise is dangerous

If a cybercriminal gains access to your computer/network/account, they may:

• Steal information
• Damage files
• Monitor your activities
• Prevent you from accessing your own data

3) Malware (Module 2.1)

Malware = malicious software/code that can:

• Steal data
• Bypass access controls
• Cause harm / compromise systems

Malware is framed as an unauthorized, harmful program that performs actions you didn’t authorize.

Types of malware (with explanations and examples)

• Spyware

  • Designed to spy on users
  • Can:
    • Monitor online activity
    • Record keystrokes (including passwords)
    • Capture sensitive data (e.g., banking details)
  • Example framing: “Secretly recording everything you type” → Spyware

• Adware

  • Automatically delivers/places ads, often through a web browser
  • Not all ads are necessarily malware; the key is software that automatically displays advertisements

• Ransomware (described as one of the most serious)

  • Holds data/systems “captive” until payment is made
  • Often works by encrypting data, preventing access until payment
  • Example scenario: files can’t be opened + message demanding payment

• Scareware

  • Uses fear/intimidation
  • Example: pop-up claiming the computer is infected and urging immediate action or installation
  • Emphasized lesson: fear can be a weapon because attackers want victims to panic and act without thinking

• Backdoor

  • Malware technique that bypasses normal authentication
  • Access is obtained without the standard login/process

• Rootkit

  • Modifies the system and often enables/creates a backdoor
  • Analogy: normal entry uses a key; the rootkit uses a different tool to unlock the door and allow malware in

• Virus

  • Malicious code that replicates and attaches to executable files
  • Becomes active when the user opens/runs the infected executable (e.g., an infected document)
  • Key comparison: user interaction is needed before it spreads/activates

• Trojan (Trojan Horse)

  • Disguises itself as legitimate-looking software
  • Once executed, it performs harmful actions
  • Story reference: Trojan Horse—appears safe, enters anyway, then “comes out” to cause harm
  • Often leads to severe outcomes such as reformatting/reinstalling (described as a common “end state” in the talk)

• Worm

  • Replicates itself without needing a host program
  • Can spread across computers, especially when connected to a network
  • Contrast: viruses typically need user interaction/transfer; worms can spread through network connectivity

4) Warning signs / symptoms of possible malware

Indicators listed include:

• Increased CPU usage
• Frequent freezing or crashes
• Slower web browsing
• Unexplained network problems
• Modified or deleted files
• Unknown files or programs
• Unknown processes
• Programs turning off or changing configurations
• Emails sent without the user’s knowledge

Important clarification: These symptoms are not proof of malware. Unusual behavior should trigger investigation, not being ignored.

---

Module 2.2: Methods of infiltration (how attackers get in)

5) Social engineering (human-targeted attacks)

Social engineering = manipulating people to:

• Perform actions, or
• Reveal confidential information

Focus: instead of breaking technical security, attackers convince victims to provide access/info.

Lay term noted: scamming

Common social engineering types listed

• Pretexting

  • Attacker creates a false story and pretends to be someone else to obtain:
    • Access/privilege, and
    • Information from the victim
  • Example: someone impersonates an IT employee and asks questions to extract access info

• Tailgating

  • Attacker follows an authorized person into a secure physical area
  • Example: “Hold the door / I forgot my access card”
  • Emphasis: physical security matters; unauthorized entry by following someone is risky

• Quid pro quo (“something for something”)

  • Attacker requests personal information in exchange for a supposed gift
  • Example concept: a “free” offer used to extract details
  • Lesson emphasized: don’t be hasty; scammers aim to surprise/panic victims so they act immediately
  • Example outcome: attacker claims a deal/free item, but it requires payment or an exchange of sensitive information

• Denial of Service (DoS) (included after social engineering in the talk)

  • A network attack that interrupts services for users/devices/applications
  • Mechanism:
    • Attacker overwhelms a legitimate website with malicious traffic/requests
    • Legitimate users can’t access the service

• Distributed DoS (DDoS)

  • Same idea as DoS but on a larger scale using multiple coordinated sources
  • Botnet is introduced as important background for DDoS

6) DDoS sub-techniques and related terms

Main DDoS mechanisms described:

• Overwhelming traffic quantity (enormous data slows responses)
• Maliciously formatted packets (packets that the receiver can’t handle)

Botnet

• Defined as a set/group of infected computers (“bots”) controlled by attackers via the internet
• Importance: coordinated large-scale control gives attackers more power
• DDoS framing from the talk: “They use a bot … and spread it to computers in a company” (as described)

7) Man-in-the-middle (MITM) and variants

• On-path attack

  • Attackers intercept/modify communication between two devices (e.g., server and browser)
  • Concept: attacker places themselves in the middle
  • Example: sender sends “Php 10,000” → man-in-the-middle replaces it with “Php 5,000” before the receiver sees it

• Man-in-the-middle (MITM) (restated)

  • Attacker takes control of a device without the user knowing
  • Can intercept/capture user information before it reaches its intended destination
  • Often used to steal financial information

• Man-in-the-mobile

  • Variant where the takeover is specifically on the mobile device
  • Mentioned example: Zeus
    • Allows attackers to quietly capture two-step verification (2FA) SMS messages

8) SEO poisoning (search engine poisoning)

• Defined as manipulating search results so malicious sites rank highly.
• Mechanism described:
  • Search engines show a list of websites relevant to a query (e.g., “Korean drama”)
  • Attackers increase traffic/push malicious sites so they appear in results
  • Victims may click a link expecting “best result,” but it leads to a malicious/dangerous website

---

Password-related attacks and APT

9) Password attacks listed

• Password spraying

  • Try a small set of commonly used passwords across many accounts

• Dictionary attack

  • Try words from a dictionary/common password list

• Brute force attack

  • Try all possible combinations of letters/numbers/symbols until correct password is found

• Rainbow attack (as described)

  • Systems store hashed values; attackers use precomputed/hash-matching techniques
  • (Talk mentions mapping hashes to plaintext-equivalent identities)

• Traffic interception (as described)

  • Intercepting communication that is readable to humans (framed as “easy for the human eye,” machines intercept it)

• Advanced Persistent Threat (APT)

  • Long-term, multi-phase, advanced operation against a specific target
  • Goal:
    • Deploy customized malware that stays undetected for a long time
  • Emphasis: not quick/simple; requires planning for long-term presence

10) Core concluding lesson (key takeaway)

Cybersecurity must protect not only computers, but also:

• Information networks
• Accounts
• People

Attackers use:

• Technology, and also
• Deception and human behavior

Final motto: “Think before you click. Verify before you trust. Protect before you regret.”

---

Speakers / sources featured

• No specific named speakers or external sources are mentioned in the subtitles.
• The content is delivered by an unnamed instructor/presenter.