If you're seeing this message, it means we're having trouble loading external resources on our website.

If you're behind a web filter, please make sure that the domains *.kastatic.org and *.kasandbox.org are unblocked.

Main content

Cybersecurity and crime

Google Security Princess Parisa Tabriz and Jenny Martin from Symantec introduce the most common types of cybercrime, including viruses, malware, DDOS attacks and phishing scams. 

Want to join the conversation?

  • sneak peak blue style avatar for user Evan S
    Are there any cases where hacking is a good thing to do?
    (19 votes)
    • aqualine ultimate style avatar for user c2j
      Any case where it is not a bad thing to do.
      "Ethical hacker" is a widely used term, it usually describes people who are hired specifically to test the security of systems.
      But it can be you, me, or anyone else who decides that they're going to 'see what happens if I do this?'. The difference between good and bad is what you do with it.
      It is good if you report it to the website, contact the administrator, or someone that could fix it.
      It is bad if you don't report it, and wait for the bad person to discover it. It would be even worse if you damaged parts of it, or you've just seen things you shouldn't have.

      It often becomes a dilemma to know what to do, as even today, many institutions become hostile to the good hackers who report their vulnerabilities. A good rule is to always get permission before you attempt to do something.

      *WARNING: Doing "testing" without permission is illegal in many countries. You should read up on the laws before doing anything that could be illegal. Many companies offer bug bounty programs where anyone can participate.*
      (47 votes)
  • blobby green style avatar for user sunilkarki320
    If a virus is a program too then who created it, why and how? Can someone tell me?
    (23 votes)
    • male robot hal style avatar for user Cameron
      In addition to the reasons jeppemh mentioned above, many viruses are developed:
      - for the challenge of it (this was very typical in the days before the internet)
      - for research and/or demonstration purposes (often by researchers in computer security)

      Often, these viruses will only be released on controlled systems i.e. they will not be released "into the wild" (the internet).
      (33 votes)
  • blobby green style avatar for user Jai
    Is there a specific way to know if a link that you are about to click will direct you to a Phishing Site? Is there a way to decrypt those TinyUrls? to check if that's a legit site or not?
    (8 votes)
  • blobby green style avatar for user Yizhou A. Jiang
    When we make our own website we need to buy an SSL certificate - what kind of service are we really paying for when paying for SSL? Does the company just authenticate/ license whoever that pays? Thanks!
    (4 votes)
    • male robot hal style avatar for user Cameron
      Certificate authorities apply their digital signature to your certificate. In doing so, they are saying that your certificate is accurate i.e. they confirm that the public key for that website is what it says on the certificate. You pay for their reputation of only signing accurate certificates.

      Before a certificate authority gives you a certificate for your website they need to confirm that you actually own that website. Different certificate authorities have different procedures for determining that. The more thorough the check, the more others will trust that certificate, and the more it is likely to cost. You can get free certificates, but the checks will likely be minimal, and others will likely not trust it.

      So why do we need a certificate authority ? Imagine a hacker intercepts your request to connect to your bank's website. They send you a web page that looks like your bank's web page and give you a public key that they have chosen. You use that public key to encrypt your data, and think that everything is secure, but in reality the hacker can see everything because they have the private key corresponding to that public key. A certificate prevents that, because a hacker shouldn't be able to obtain a certificate (from a trusted certificate authority) for that website that contains their public key.

      Hope this makes sense
      (7 votes)
  • starky sapling style avatar for user Sahasra😁😆😬
    At the lady said that lots of viruses are disguised as security updates, but then at one of the things on the list to avoid being hacked is to install security updates often. How do we know if it is a good update or a bad update?
    (4 votes)
    • blobby green style avatar for user thomaspearson990
      Most fake security updates are displayed over the web with JavaScript alerts. To make sure you actually have the correct version, ignore such pop-ups and go to the company's website to check. Another way hackers try to trick you is with fake emails. Same thing here. The main thing to be aware of is that JavaScript is designed to be safe, and require your permission to run programs and download software, same thing applies for running Java applets. if you don't click to choose to download anything, you should be safe from downloading malware, and if you are told you need a security update, be suspicious, and visit the website through a search engine instead of clicking a link.
      (3 votes)
  • aqualine ultimate style avatar for user Erwin Solorzano
    I've heard Apple products get no viruses, is that true? And if it is, how is that possible?
    (3 votes)
  • leaf red style avatar for user 𝓙σ∪ℝ∂αη
    How can hackers get your login credentials from you just opening an official looking document?
    (2 votes)
    • leaf green style avatar for user alzuubi1
      If the document contains malicious macros and you enable them, hackers can get into your system and insert spyware to get login credentials that you may type afterwards. Those types of hackers are called keyloggers. Another way a hacker can get your login credentials through an "official document" is through bogus login pages. Hackers can mimic a login page like gmail to steal your login credentials without you knowing. This can be easily prevented by looking closely at the pages you insert you credentials on. Hope this was helpful!
      (3 votes)
  • female robot ada style avatar for user gardner.maryum
    If you are on a website, and a message pops up saying that if you do not install this, you are going to get a virus. If you download, does this lead hackers to unleash the virus on your device?
    (1 vote)
    • piceratops seed style avatar for user alexlightname
      yes, this is the most simplest form of coercion to install malware on your device by using browser alert box. Most users of web browsers don't really know how alert box operates so they take advantage of that. It includes you ;). Never install and to get rid off pop-up box is just by using own alert box tool prevent check -- you see it on box just check it and close it and then close the whole tab. That's how you deal with it.
      (3 votes)
  • blobby green style avatar for user LukeE
    can you be a hacker easily.
    (2 votes)
    Default Khan Academy avatar avatar for user
  • blobby green style avatar for user Dhanvi Jamana
    What is a virus
    (1 vote)

Video transcript

- Hi. My name's Jenny Martin and I'm the Director of Cybersecurity Investigations at Symantec. Today cybercrime causes huge problems for society. Personally, financially, and even in matters of national security. Just in the last few years, hundreds of millions of credit card numbers have been stolen. Tens of millions of social security numbers and health care records were compromised. Even nuclear centrifuges have been hacked and unmanned aerial drones have been hijacked. This is all done by exploiting vulnerabilities in hardware and software. Or more often by taking advantage of unintentional decisions made by the people using the software. The people committing these cybercrimes don't fit a single profile or motivation. It could be anyone from an international terrorist, to a teenager competing for bragging rights. Today, the largest countries not only have a regular army, but also have a well-armed cyber army. In fact, the next world war may not be fought with traditional weapons but with computers, used to shut down national water supplies, energy grids, and transportation systems. - Hi. My name is Parisa and I'm Google's Security Princess. I've worked on a lot of different Google products in a lot of different ways to try and make our software as secure as possible. Now let's take a look at how cybercrime works under the hood. We'll learn about software viruses, denial-of-service attacks, and phishing scams. In biology in life, a virus is an organism that is spread by coughing, sneezing, or physical contact. Viruses work by infecting cells, injecting their genetic material and using those cells to replicate. They can make people really sick and then spread to other people. A computer virus works a bit similarly. A virus is an executable program that gets installed, usually unintentionally, and harms a user and their computer. It's also possible for a virus to spread itself to other computers. Now how does a virus get on your computer in the first place? There are couple ways an attacker can infect someone's computer. They might lure a victim into installing a program with deception about the program's purpose. So for example, a lot of viruses are disguised as security updates. It's also possible that the software on your computer has a vulnerability. So an attacker can install itself without even needing explicit permission. Once a virus in on your computer it can steal or delete any of your files, control other programs, or even allow someone else to remotely control your computer. Using computer viruses, hackers can take over millions of computers worldwide. And then use them as a digital army, otherwise known as a botnet, to attack and take down websites. This kind of attack is called a distributed denial-of-service. A denial-of-service is when hackers overwhelm a website with too many requests. We call it a distributed denial-of-service when the attack comes from many computers all at once. Most websites are ready to respond to millions of requests a day, but if you hit them with billions or trillions of requests coming from different places, the computers are overloaded and stop responding. - Another trick used by cybercriminals is to send large amounts of spam email in an attempt to trick people into sharing sensitive personal information. This is called a phishing scam. A phishing scam is when you get what seems like a trustworthy email asking you to login to your account, but clicking the email takes you to a fake website. If you login anyway, you've been tricked into giving your password away. Hackers can then use your login credentials to access your real accounts to steal information, or maybe even to steal your money. Fortunately there are many companies, laws, and government organizations working to make the internet safer. But these efforts are not enough. You may think when a computer system gets hacked, the problem was the security design, or the software. 90% of the time a system gets hacked however, it's not because of a security bug, but because of a simple mistake made by a human. - It turns out there are steps we can all take to protect ourselves. Often, your actions not only impact the security of your own data and computer, but the security of everyone at your school, workplace, and home. With billions or trillions of dollars at stake, cybercriminals get smarter each year, and we all need to keep up.