A2.4.2 · Network security
A2.4.2 · 网络安全
Network vulnerabilities
网络漏洞
Ten different ways a network or the systems on it can be attacked. Each one is a genuinely different mechanism, not just a different name for the same idea.
网络及其上的系统可能遭受攻击的十种不同方式。每一种都是真正不同的机制,而不只是同一种想法换了个名字。
Explainer
讲解
A locked door left unlocked overnight is a weakness, whether or not anyone actually walks through it. Someone actually walking through it and taking something is a separate event. Networks work the same way.
一扇本该上锁却整夜没锁的门是一种弱点,无论是否真的有人从中走过。有人真的走进去并拿走了东西,则是另一件事。网络的运作方式与此相同。
A vulnerability is a weakness in a system that could be exploited. An attack is the act of actually exploiting one. This statement is about describing the vulnerabilities themselves, the specific weaknesses that make each kind of attack possible in the first place.
漏洞是系统中可能被利用的弱点。攻击则是实际利用该弱点的行为。本条考纲陈述关注的是描述漏洞本身,即最初使每一种攻击成为可能的那些具体弱点。
Explainer
讲解
Ten common vulnerabilities
十种常见漏洞
Click each one to see what it actually is and a real consequence it leads to.
点击每一项,查看它究竟是什么,以及它会导致的一个真实后果。
Worked example
示例讲解
How SQL injection actually works
SQL 注入究竟是如何运作的
A school's assignment portal checks a login by building a database query directly out of whatever the user typed, with no checking at all.
某学校的作业门户网站在检查登录时,直接用用户输入的内容拼接出一条数据库查询语句,完全没有做任何检查。
def build_query(username): return "SELECT * FROM Users WHERE username = '" + username + "'"
This looks harmless: it builds a query string by gluing the username straight into the middle of it.
这看起来无害:它只是把用户名直接拼接到查询字符串的中间,构建出一条查询语句。
A normal login, chloe123:
一次正常登录,chloe123:
SELECT * FROM Users WHERE username = 'chloe123'
Exactly what was intended: check the Users table for a row where the username is chloe123.
正如原本设计的那样:在 Users 表中查找用户名为 chloe123 的那一行。
A malicious login attempt, ' OR '1'='1:
一次恶意登录尝试,' OR '1'='1:
SELECT * FROM Users WHERE username = '' OR '1'='1'
The attacker's quote mark closes the string early, and OR '1'='1' is a condition that's always true. The query no longer checks for a specific username at all, it matches every single row in the table.
攻击者输入的引号提前闭合了字符串,而 OR '1'='1' 是一个永远为真的条件。这条查询已经完全不再检查具体的用户名,而是匹配表中的每一行。
The weakness isn't the database, it's that the program never checked what was inside username before using it to build a command. Any input that's trusted and used directly, without validating it first, can potentially be turned into something the program never meant to execute.
这个弱点并不在于数据库本身,而在于程序在用 username 构建命令之前,从未检查过它里面究竟是什么内容。任何被信任、且在未经验证的情况下直接使用的输入,都有可能被转变成程序从未打算执行的东西。
Try it yourself
动手试一试
Build the query yourself
自己构建这条查询
The exact function from above. Try changing malicious_input to your own string, and see what it does to the final query.
与上面完全相同的函数。试着把 malicious_input 改成你自己的字符串,看看它会对最终的查询造成什么影响。
Running in offline fallback mode. The full Python engine couldn't load (blocked school network, or no internet), so this console switched automatically to a small hand-written engine. It supports this page's functions and string handling, but it isn't full Python.
正在以离线备用模式运行。 完整的 Python 引擎未能加载(学校网络受限,或没有网络连接),因此本控制台已自动切换为一个手工编写的小型引擎。它支持本页所用的函数和字符串处理,但并非完整的 Python。
This console only ever builds a plain text string, it never runs it against a real database, so nothing is actually at risk here. The point is seeing exactly how the words OR '1'='1' change the meaning of the finished query.
这个控制台始终只会构建一个纯文本字符串,从不会真的拿它去操作真实的数据库,所以这里不会有任何实际风险。重点在于清楚地看到 OR '1'='1' 这几个字究竟如何改变了最终查询的含义。
Check your understanding
检验你的理解
A student's laptop is infected with malware after they installed a free game from an untrusted website. Months later, that laptop is one of thousands used to flood a company's server with traffic until it stops responding. Which vulnerability does the SECOND event best describe?
一名学生从一个不可信的网站安装了一款免费游戏后,笔记本电脑感染了恶意软件。几个月后,这台电脑成为数千台设备之一,被用来向某公司的服务器发送大量流量,直到服务器无法响应。第二个事件最能说明哪一种漏洞?
Common mistake
常见错误
RecurringA recurring pattern is naming a vulnerability correctly, then stopping, without describing what actually makes it a weakness or how it plays out. General statements without specific detail are marked down even when the named term itself is correct.
反复出现一个反复出现的模式是:正确说出了漏洞的名称就停下了,没有描述究竟是什么使它成为一个弱点,或者它是如何发生的。即使术语本身说对了,缺乏具体细节的笼统陈述仍会被扣分。
Named, not described: "Phishing is a type of attack where hackers try to trick you." Correctly identifies phishing by name, but says nothing about the actual mechanism, a message posing as legitimate, aimed at extracting real information like a password.
只说名称,没有描述: "网络钓鱼是一种黑客试图欺骗你的攻击。" 正确说出了网络钓鱼的名称,但完全没有说明实际的机制:一条伪装成合法来源的信息,目的是骗取密码等真实信息。
Described, with the mechanism: "Phishing is when a victim is sent a message that appears to come from a trustworthy source, such as their bank, and is tricked into revealing sensitive information like login details, which the attacker then uses to access their accounts." States the mechanism (a message disguised as trustworthy) and the specific consequence (stolen credentials, account access).
有描述,包含机制: "网络钓鱼是指受害者收到一条看似来自可信来源(例如其银行)的信息,并被诱骗泄露登录信息等敏感信息,攻击者随后利用这些信息访问其账户。" 说明了机制(伪装成可信来源的信息)以及具体后果(凭证被盗、账户被访问)。
Revision questions
复习题
Past-paper style. Write an answer, then reveal the marking points and mark yourself.
采用历年真题风格。写下答案,然后展开评分要点给自己打分。
[2]Describe what is meant by a "zero-day exploit".
[2]描述"零日漏洞利用(zero-day exploit)"的含义。
Marking points
评分要点
- A zero-day exploit is an attack that targets a vulnerability the software vendor does not yet know about.
- Because the vendor is unaware, no patch exists, so there is no direct fix until the vendor learns of it and releases one; monitoring is the only defence in the meantime.
- 零日漏洞利用是针对软件厂商尚不知情的漏洞的攻击。
- 由于厂商不知情,没有补丁,所以在厂商得知并发布补丁之前没有直接的修复办法;在此期间监控是唯一的防御。
[4]Describe two differences between a man-in-the-middle attack and a phishing attack.
[4]描述中间人攻击与网络钓鱼攻击之间的两项差异。
Marking points
评分要点
- Any two: a man-in-the-middle attack intercepts a real connection between two parties automatically, whereas phishing sends a fake message to trick a person into acting.
- MITM is a technical attack on the communication channel; phishing is social, targeting the person.
- In MITM both sides believe they are talking directly to each other; in phishing the victim knowingly interacts, but with what they think is a legitimate sender.
- MITM can relay and alter messages in transit; phishing collects information the victim hands over.
- 以下任选两项:中间人攻击自动拦截两方之间的真实连接,而网络钓鱼发送一条虚假消息诱骗某人采取行动。
- 中间人是对通信通道的技术性攻击;钓鱼是社会性的,针对人。
- 在中间人攻击中,双方都以为在直接相互通信;在钓鱼中,受害者是有意在互动,但对象是他们以为合法的发送者。
- 中间人可以在传输中转发和篡改消息;钓鱼收集的是受害者主动交出的信息。
[3]A website allows comments to be posted and displayed on its pages exactly as typed, with no checks at all. Identify the vulnerability this creates and describe how an attacker could exploit it.
[3]某网站允许用户发布评论,并将其原样显示在页面上,完全没有做任何检查。指出这会造成哪种漏洞,并描述攻击者可能如何利用它。
Marking points
评分要点
- The vulnerability is stored cross-site scripting (XSS), caused by displaying user input with no validation or escaping.
- An attacker posts a comment containing script code instead of ordinary text.
- Because the site displays it exactly as typed, that script then runs in the browser of every other visitor who views the page, so it could steal their session cookies, redirect them, or act as them on the site.
- 这个漏洞是存储型跨站脚本(XSS),由不加验证或转义就显示用户输入所造成。
- 攻击者发布一条含有脚本代码而非普通文本的评论。
- 由于网站原样显示它,该脚本随后在查看该页面的其他每位访客的浏览器中运行,所以它可能窃取他们的会话 Cookie、把他们重定向,或在网站上冒充他们行事。
Flashcards
记忆卡片
Active recall for this statement’s key terms.
针对本条考纲陈述关键术语的主动回忆练习。
Keep this statement’s practice with you
把这条考纲陈述的练习保存下来
Free account: unlock every revision question and flashcard for A2.4.2, and every other IB CS 2027 statement.
免费账户:解锁 A2.4.2 以及所有其他 IB CS 2027 考纲陈述的全部复习题和记忆卡片。