Cybersecurity basics: passwords, malware and phishing

边玩边学

回答这些题目来赚取能量，然后钓鱼探索。无需账号。

给教育者：面向 Cybersecurity basics: passwords, malware and phishing（KS3 Computing，Digital Literacy）的即用型课程幻灯片, 复习笔记, 图示——用在你的课堂上，或将该知识点作为学习者可实时游玩的互动课堂活动来运行。

课程笔记

Strong Passwords

A strong password is long, random, and unique for each account.
Use a mix of upper and lower case letters, numbers, and symbols.
Avoid using personal information like names, birthdays, or common words.
Consider using a passphrase – a sequence of random words – which is easier to remember and harder to crack.
Never reuse passwords across different accounts; if one is compromised, others are at risk.
Use a password manager to store and generate strong passwords securely.

Long, unique passphrases with a password manager and multi-factor authentication resist guessing far better than short reused passwords.

Malware Types

Malware is malicious software designed to harm or exploit devices and data.
A virus attaches itself to a file or program and spreads when the infected file is opened.
A worm spreads automatically across networks without needing a host file.
Ransomware locks your files or device and demands payment to restore access.
Malware can be delivered via email attachments, malicious links, or compromised websites.
Keeping software updated helps patch vulnerabilities that malware exploits.

Phishing and Social Engineering

Phishing is a scam where attackers trick people into revealing sensitive information or installing malware.
It is a form of social engineering – manipulating people rather than hacking systems.
Phishing messages often pretend to be from trusted sources like banks or government agencies.
They create urgency or fear, e.g., 'Your account has been compromised – click here now.'
The goal is usually to steal login credentials, financial details, or install malware.
Phishing is the most common type of cybercrime globally.

Types of Phishing

Email phishing – bulk emails sent to many people, often with fake login links.
Spear phishing – targeted attacks on specific individuals using personal information to seem credible.
Vishing (voice phishing) – fake phone calls, often using VoIP and number spoofing.
Smishing (SMS phishing) – fraudulent text messages with links or phone numbers.
Quishing – phishing using QR codes that lead to malicious sites.
Page hijacking – redirecting users from legitimate websites to malicious ones.

Staying Safe Online

Always think critically before clicking links or opening attachments, even if they look familiar.
Check the sender's email address or phone number for unusual details.
Hover over links to see the real URL before clicking.
Never enter personal information on a site reached via a suspicious link.
Use multi-factor authentication (MFA) where possible for extra security.
Keep all software and devices updated to protect against known vulnerabilities.

Software Updates

Software updates fix security holes (vulnerabilities) that attackers can exploit.
Enable automatic updates for your operating system, apps, and antivirus.
Updates often include patches for newly discovered malware threats.
Ignoring updates leaves your device at higher risk of infection.
Only download updates from official sources to avoid fake update scams.

A security update patches the vulnerability an attacker could otherwise exploit.

Account and Device Safety

Use a different strong password for each important account.
Log out of accounts on shared or public devices.
Be cautious when using public Wi-Fi – avoid accessing sensitive accounts without a VPN.
Install and maintain reputable antivirus software.
Back up important data regularly to recover from ransomware attacks.
Report phishing attempts to your school, workplace, or relevant authorities.

A phishing message uses urgency to make you click; the safe response is stop, check independently, report.

The malware infection chain: delivery, execution, infection, impact, then persistence and spread.

Social engineering relies on urgency, impersonation and requests for sensitive information; pause, verify, report.

幻灯片

Step through every slide for this topic — plus flashcards and revision notes — with a free account.

练习题

免费预览——58 题中的 8 题。注册即可查看全部。

1.Phishing is a type of social engineering attack.
Easy
True or false?
2.What does the term 'phishing' refer to?
Easy
- AUsing a fishing rod to catch fish
- BA type of computer virus
- CA scam that uses lures to 'fish' for sensitive information
- DA method of securing passwords
3.Malware only includes viruses.
Easy
True or false?
4.Which of the following are types of malware mentioned in the source? (Select all that apply)
Easy
- AVirus
- BWorm
- CRansomware
- DPhishing
- EAdware
5.Spear phishing targets a specific individual or group.
Easy
True or false?
6.What is 'smishing'?
Easy
- APhishing via email
- BPhishing via SMS text messages
- CPhishing via voice calls
- DPhishing via QR codes
7.Keeping software up to date is not important for cybersecurity.
Easy
True or false?
8.Match each phishing type to its description.
Medium
- Vishing
- Smishing
- Quishing
- Voice phishing
- SMS phishing
- QR code phishing

复习笔记

## Cybersecurity Basics: Passwords, Malware & Phishing ### Why Strong Passwords Matter - **Strong passwords** are your first line of defence. They should be long, unique, and not easily guessed (avoid names, birthdays, common words). - Use a mix of letters, numbers, and symbols. Never reuse passwords across accounts. - Consider a password manager to keep track of them. ### Malware Types - **Virus**: Malicious software that attaches to a program or file and spreads when you run it. - **Worm**: Self-replicating malware that spreads without human action, often over networks. - **Ransomware**: Locks your files or device and demands payment (ransom) to unlock them. - Malware can be delivered via phishing, malicious downloads, or compromised websites. ### Phishing and Social Engineering - **Phishing** is a scam where attackers trick you into revealing sensitive info or installing malware. It's a form of **social engineering**. - Common types: - **Email phishing**: Bulk fake emails that look like they're from a bank or service, directing you to a fake login page. - **Spear phishing**: Targeted at specific people, using personal info to seem credible. - **Vishing**: Voice phishing via phone calls, often with spoofed numbers. - **Smishing**: Phishing via text messages (SMS). - **Quishing**: Phishing using QR codes. - **Red flags**: Urgency, unexpected attachments/links, requests for personal info, poor spelling/grammar, unusual sender addresses. ### Staying Safe - **Software updates**: Install updates promptly – they patch security holes. - **Think before you click**: Hover over links to see the real URL; don't enter credentials on unfamiliar sites. - **Use multi-factor authentication (MFA)** where possible. - **Be cautious** with calls, texts, and emails asking for sensitive data. - **Report** suspicious messages to your teacher, parent, or IT department. ### Key Facts - Phishing is the most common cybercrime globally. - Business phishing attacks rose from 72% in 2017 to 94% in 2023. - Generative AI makes phishing more convincing and automated. - The term 'phishing' was first recorded in 1995 in the AOHell toolkit.

Phishing: A form of social engineering and a scam where attackers deceive people into revealing sensitive information or installing malware such as viruses, worms, adware, or ransomware.
Social engineering: Psychological manipulation of people to divulge confidential information or perform actions, often used in phishing.
Virus: Malware that attaches to a program or file and spreads when the infected file is executed.
Worm: Self-replicating malware that spreads without human action, often over networks.
Ransomware: Malware that locks or encrypts a victim's files or device and demands payment (ransom) to restore access.
Spear phishing: Targeted phishing attacks tailored to specific individuals, using personal or organizational information to increase credibility.
Vishing: Voice phishing using VoIP or phone calls, often with spoofed numbers, to trick victims into revealing sensitive information.
Smishing: Phishing via SMS text messages, asking victims to click links, call numbers, or provide personal information.
Quishing: Phishing using QR codes to direct victims to malicious websites or downloads.
Software updates: Patches and fixes released by software vendors to address security vulnerabilities and improve functionality.

闪卡

What is phishing?

Phishing is a form of social engineering and a scam where attackers deceive people into revealing sensitive information or installing malware.

What are common types of malware mentioned in the source?

Viruses, worms, adware, and ransomware.

What is the origin of the term 'phishing'?

It was first recorded in 1995 in the cracking toolkit AOHell, and is a variation of fishing, referring to lures to 'fish' for sensitive information.

What is spear phishing?

Spear phishing is a targeted phishing attack tailored to specific individuals, using personal or organizational information to increase credibility and success.

What is vishing?

Vishing (voice phishing) uses VoIP to make automated phone calls, often spoofing numbers, to trick victims into revealing sensitive information.

What is smishing?

Smishing (SMS phishing) uses mobile text messages to deliver bait, asking victims to click links, call numbers, or provide private information.

What is quishing?

Quishing is phishing using QR codes to trick users into visiting malicious sites or downloading malware.

What is page hijacking?

Page hijacking involves redirecting users to malicious websites by compromising legitimate web pages, often using cross-site scripting.

What is a watering hole attack?

A watering hole attack compromises a website frequented by a target group to exploit visitors, often used with page hijacking.

Why are strong passwords important?

Strong passwords help protect accounts from unauthorized access, reducing the risk of identity theft and data breaches.

What is social engineering?

Social engineering is manipulating people into divulging confidential information or performing actions, often by exploiting trust or urgency.

What is ransomware?

Ransomware is malware that encrypts a victim's files and demands payment for decryption.

What is a virus?

A virus is malware that attaches to legitimate files and spreads when the infected file is executed.

What is a worm?

A worm is self-replicating malware that spreads without human action, often over networks.

Why are software updates important for security?

Updates patch vulnerabilities that attackers could exploit, helping to protect against malware and other threats.

What is a common sign of a phishing email?

Urgency or threats, requests for personal information, and links to fake login pages.

What should you do if you receive a suspicious email?

Do not click links or download attachments; report it and delete it.

What is two-factor authentication (2FA)?

2FA adds an extra layer of security by requiring a second form of verification beyond a password.

What is a MiTM 2FA attack?

A man-in-the-middle attack that intercepts 2FA credentials to bypass security.

What is the role of user education in preventing phishing?

Educating users helps them recognize and avoid phishing attempts, reducing the success of attacks.

What is the trend in phishing attacks among businesses?

Phishing attacks among businesses rose from 72% in 2017 to 86% in 2020, reaching 94% in 2023.

What is the goal of bulk phishing attacks?

Bulk attacks are not targeted and are sent to a wide audience to trick anyone into giving away sensitive information or credentials.

What is the impact of generative AI on phishing?

Generative AI enables highly convincing, automated, and hyper-targeted phishing campaigns at an unprecedented scale.

Unlock all 58 questions, flashcards & more

创建免费账号，即可查看该知识点的每一道题、幻灯片、闪卡和复习笔记。

历年真题

该知识点的历年真题练习即将推出。

即将推出