Cyber Threats and How Systems Defend
How attackers use deception and exposed passwords, and how account safeguards, router settings and lost-device tools address different threats.
What a learner can do afterwards
- Match a threat to a defence that addresses it, and identify the defence's limits
- Explain how social engineering uses trust or urgency to obtain information or access
- Explain how length and unpredictability resist password guessing, and how reuse spreads a password leak
1 · Read
You have followed a browser's requests and responses. A page can also pretend to be a genuine sign-in page. Social engineering uses trust, fear or urgency to persuade a person to reveal information or grant access. Phishing uses deceptive messages or pages. Do not send anyone your password, reset code or sign-in code. Check a worrying message by opening the service's official app or website yourself.
Suppose an unauthorised device joined your home Wi-Fi using an exposed password. Ask the network owner to change it through the router's official settings and reconnect trusted devices. Follow the router's instructions to disconnect unauthorised devices. Laptop antivirus checks that laptop for malicious software; it does not manage router access. Device blocking and guest networks are other router controls, with different uses.
A screen lock helps protect a stolen phone. If its lost-device service was enabled, use the official service from a trusted device to request a lock or erase. A command may wait for a connection, and features vary. Erasing may remove data you have not backed up. Protect the linked account and ask the mobile provider to suspend service. Do not approach a suspected thief.
Choose a long, unpredictable password that differs for each account. A password manager can generate and store random passwords. A passphrase made from randomly selected words can also resist guessing; familiar sayings and personal details are predictable. Reuse creates another risk: attackers can try a leaked password at other services. Someone who learns a Wi-Fi password can try it against an email account using that same password.
The account controlling remote phone protection needs protection too. Use a unique password and two-factor authentication where available. Two-factor authentication adds a different kind of proof, such as a code from an authenticator app. It reduces risk from a stolen password, but a fake page can steal a code too. A weak or reused password still puts the linked account at risk. Remote lock is not a guarantee.
Check messages independently, use unique unpredictable passwords, and match each safeguard to its threat. Remote protection has limits.
The lesson, questions, worked solutions and flashcards about security threats and defence limits were written for this dataset.
Four readings and six flashcards were written for this dataset. The linked video, How Not To Get Hacked: Messaging and Downloads, is published by CodeAI (@codeorg) on YouTube, with a description directing viewers to code.org. Its reference was imported from the academy catalog, which names Khan Academy as its source. Video licence terms are unknown.
More to read
Check through a separate route
An account warning can arrive in a convincing-looking message. A familiar logo or sender name does not establish who sent it. Someone may also pose as a friend or support worker and ask you to help urgently.
Look at the action requested. Sending a password or forwarding a sign-in code can give someone access. Keep those secrets private. Open the official app yourself, or use a website address you already know, to check an account warning.
If the request claims to come from someone you know, contact that person through a separate known route. Replying to the suspicious message only reaches whoever controls that message.
Two-factor authentication adds another kind of proof at sign-in. It reduces risk from a stolen password, but a fake page may request a code too. Enter codes only when completing an action you intended through the genuine service. Do not forward them to a caller or message sender.
You do not need to investigate the sender yourself. Use the service's official reporting tools or ask a trusted adult for help.
Find the Wi-Fi access problem
A router lists an unfamiliar device name. Before calling it an intruder, ask the network owner to identify the household's equipment. A device may use a name you do not recognise.
Suppose the owner confirms that an unauthorised device joined using an exposed Wi-Fi password. Replacing that password addresses the exposed credential. Use the router's official settings and follow its instructions for disconnecting unauthorised devices. Trusted equipment will need the new password when it reconnects.
Some routers offer device blocking or a separate guest network. These controls do different jobs. Check the particular router's instructions instead of assuming every model behaves alike.
Laptop antivirus checks the laptop for malicious software. It does not replace management of router access.
Keep the Wi-Fi password different from email and school-account passwords. Someone who learns a reused secret can try it at those services. The password for managing the router may also be separate from the password used to join its Wi-Fi.
A missing phone and a pending command
A remote-lock request is an instruction sent through a service. Sending it does not prove that the missing phone has received it. Connection, prior setup and the device's supported features affect what can happen.
Prepare before a loss by using a screen lock, setting up the official lost-device service and keeping backups. Protect the account that controls the service with a unique password and two-factor authentication where available.
After a theft, use a trusted device to open the official service. It may offer a lock request, a contact message or erasure. Follow its current instructions. A command may wait for a connection, and erasure may remove files that were never backed up.
Ask the mobile provider to suspend service and use the appropriate local reporting route. Suspending mobile service is not the same as erasing files or signing out of online accounts.
Do not approach a suspected thief or follow a location report yourself. Recovery tools should reduce harm without putting you at risk.
Two separate password questions
Ask two questions about a password: could someone predict it, and is it used anywhere else?
A long familiar saying can still be predictable. Adding capitals or punctuation does not remove the pattern. Random character selection or a passphrase made from randomly selected words can make guessing harder. The selection method matters; using words is not itself the problem.
Now suppose a strong password leaks from one service. If it was reused, someone can try it at other services. Different passwords limit that route. They do not prevent every other kind of attack.
A password manager can help generate and store separate credentials. It does not make an existing predictable password unpredictable merely by storing it. Protect the manager's own account too.
Do not assume every factory Wi-Fi password is identical across devices. Check the router's guidance and replace a password that is exposed, predictable or reused. A change should address an identified risk, not a claim about every manufacturer's defaults.
Explore more
2 · Watch
به انگلیسیTake it off screen
Where it sits
Learn first
Optional connections
8 questions wait behind this lesson, each with its answer explained. Every answer feeds the sky: stars light as they are learned, and dim when it is time to come back.