Cyber Security and Digital Currency: Computer Science 0478 (Cambridge O Level / IGCSE)

A national ticketing website's server logs show that, over three minutes, one customer account received 40 000 login attempts from the same computer, each attempt trying a different password taken from a list of commonly used passwords. No email, text message or phone call was sent to the account holder at any point.

Which cyber security threat does this log describe?

A small architecture firm keeps every current project drawing on one shared office laptop. One afternoon, an employee opens a file attachment they were expecting from a regular supplier. Within an hour, every project drawing on the laptop has been renamed with a strange new file extension, and a text file appears on the desktop demanding that the firm pay an amount of digital currency before the files will supposedly be restored.

(a) State the specific type of malware most likely responsible for this incident, and identify the detail in the scenario that supports your answer. [2]

(b) Explain how this type of malware affects a user's files differently from how a computer virus typically affects a user's files. [2]

(c) The firm decides not to pay. Give two precautions, other than avoiding suspicious attachments, that the firm could put in place so that future project drawings can be recovered without paying. [2]

A national exam board runs an online portal where students upload coursework before a submission deadline. On the morning of the deadline, the portal receives an extremely high volume of requests within a few minutes, sent from tens of thousands of different IP addresses at almost the same moment. The web server cannot process the requests quickly enough, and genuine students are unable to load the submission page for over an hour.

(a) Name the cyber security threat being described. [1]

(b) State two aims an attacker might have for carrying out this attack against the exam portal. [2]

(c) Explain how an attacker is able to generate such a large volume of requests from tens of thousands of different IP addresses, rather than from their own single device. [2]

(d) State two technical solutions the exam board could put in place to help prevent this type of attack from succeeding. [2]

A cooperative of coffee farmers in three different countries is paid directly by an overseas roastery for each shipment, without a bank in every country processing the payment. The roastery pays the farmers using a digital currency, and each payment is added, in the order it happens, to a record that the cooperative and the roastery both keep a copy of.

(a) State what is meant by a digital currency. [1]

(b) Name the technology used to record and track digital currency transactions such as these payments. [1]

(c) Describe two features of this technology that make the payment record reliable. [2]

(d) Give one reason, other than avoiding bank fees, why it might benefit the farmers to be able to see the same payment record as the roastery. [1]

A hospital's computer system lets receptionists view a patient's appointment history, but only specialist doctors are allowed to view and edit that patient's full medical records, using the same login system.

Which security solution most directly achieves this difference in what receptionists and doctors can do once logged in?

A customer always logs into their bank account by typing the bank's correct web address directly into the browser, exactly as they always have, and pressing enter. One day, after typing this same correct address, the page that loads looks identical to the bank's website but is actually a convincing fake, which asks the customer to re-enter their login details and card number. No email, text message or phone call was sent to the customer beforehand.

Which cyber security threat does this describe?

An employee at a graphic design studio downloads what looks like a free, well-reviewed font-management application from a website and runs the installer. The application appears to work normally, but it also secretly opens a hidden connection that lets an attacker access the employee's computer remotely.

Weeks later, and completely separately, a different piece of malicious software spreads by itself from this computer to every other computer on the studio's network overnight. No member of staff opens a file or runs a program at any point; the software exploits a weakness in the network software to copy itself onto each connected computer in turn.

(a) State the type of malware responsible for the font-management application incident, and identify the detail in the scenario that supports your answer. [2]

(b) State the type of malware responsible for the overnight spread across the network, and explain how it is able to spread without any member of staff opening a file or running a program. [3]

(c) Identify one way in which this second type of malware's method of spreading is different from a computer virus's method of spreading. [1]

A caller phones the finance department of a company, claiming to be from the IT helpdesk and stating that a routine security check is underway. The caller asks the employee to confirm their username and read out their password "to verify the account", explaining that the account will otherwise be locked within the hour. Wanting to avoid being locked out, the employee reads out the password. No malicious code or software is used at any point in this incident.

(a) State the cyber security threat being described. [1]

(b) Explain why this incident is classified as this threat rather than as hacking. [2]

(c) Give two measures, other than warning this one employee personally, that the company could put in place to reduce the risk of staff being tricked in this way in future. [2]

An online banking app protects customer accounts and data using several different security measures at once.

(a) State which protocol encrypts data transmitted between the customer's browser and the bank's server during a session, and identify one visual sign in the browser that shows it is in use. [2]

(b) To log in, a customer enters a password, then must also enter a one-time code sent to their registered phone. Name this authentication method, and explain how it improves security compared with using a password alone. [2]

(c) The app also offers fingerprint login as an alternative to entering the password. State one advantage of this type of authentication over a password-based login. [1]

(d) Explain the role of a firewall in protecting the bank's servers from unauthorised access attempts arriving over the network. [2]

A collective of freelance illustrators, based in four different countries, is paid directly by clients in a digital currency. Each payment is checked and added to the shared transaction record by the network of computers running the currency's software, rather than by any single central bank or company approving it.

Which feature of this digital currency payment system does this describe?