Introduction to Security
AP Cybersecurity Topic 1 7:55 English narration · English + 中文 subtitles burned in
Chapters
Transcript
You can build a perfect wall. Unbreakable encryption, a firewall on every port, patches applied the day they ship.
你可以筑起一道完美的墙：无法破解的加密、每个端口都有防火墙、 补丁一发布就打上。
And an adversary can still walk straight through it — because the weakest part of almost every system is not the code.
可是对手照样能直接穿过去——因为几乎每个系统里最薄弱的 并不是代码，而是使用它的人。
It is the person using it. One convincing email, and someone hands over the key.
一封足够可信的邮件，就有人把钥匙交了出去。
That is why this course starts with people, not machines.
这就是这门课从"人"而不是从"机器"开始的原因。
Welcome to Unit One. Social engineering, password attacks, public networks, and the new problem on both sides of the fight: artificial intelligence.
欢迎来到第一单元：社会工程学、密码攻击、公共网络， 以及在攻防双方都出现的新问题——人工智能。
Let's begin.
让我们开始吧。
Social engineering is the art of tricking a person into breaking security — giving away a password, opening a bad file, clicking a bad link.
社会工程学是一门"骗人破坏安全"的手艺——让人交出密码、打开恶意文件、 点开恶意链接。
The adversary never has to break the code; they only have to fool a human.
对手根本不必攻破代码，只需要骗过一个人。
Most of it arrives by email, text or social media, and the goal is elicitation: getting sensitive information out of someone without them realising.
大多数攻击通过邮件、短信或社交媒体到来，目的是"套取信息"： 在对方毫无察觉的情况下问出敏感信息。
Two feelings do most of the work. Intimidation — threatening a bad outcome if you do not obey. And urgency — an invented deadline, because when we feel rushed we stop checking whether an action is safe.
有两种情绪承担了大部分工作： 恐吓——威胁你不照做就有坏结果；以及紧迫感——编造一个截止时间， 因为人一着急就不再核实这么做是否安全。
And the impact can be serious: personal details that later answer security challenge questions, a one-time password — an OTP — handed over, or malware downloaded.
而影响可能很严重： 个人信息日后被用来回答安全问题、一次性密码被交出去，或者下载了恶意软件。
Here is what it looks like in practice.
来看它在现实中的样子。
A message arrives that appears to come from somewhere you trust. It carries a link to a page that looks exactly like the real login.
一封信息到达，看起来来自你信任的地方， 里面有一个链接，指向一个和真正登录页一模一样的页面。
You type your password into it, and the adversary now has your credentials — while the page quietly forwards you to the real site, so nothing seems wrong.
你把密码输了进去，对手就拿到了你的凭据——而这个页面还会悄悄把你转到真网站， 让你觉得一切正常。
Watch the whole chain: the lure, the fake page, the captured password.
看完整条链路：诱饵、假页面、被窃取的密码。
The exam does not want you to say an email is "suspicious". It wants the name of the tactic.
考试不要你说这封邮件"可疑"，它要的是手法的名称。
Seven tactics by name: intimidation, urgency, pretexting, authority, consensus, scarcity and familiarity.
七种手法要记住名字： 恐吓、紧迫感、借口、权威、从众、稀缺、熟人。
Look at this email: "Over ninety percent of staff have already verified their account — confirm yours in the next hour or lose payroll access."
看这封邮件： "超过百分之九十的员工已经验证了账户——请在一小时内确认，否则将失去工资系统访问权限。
Two tactics are stacked. "In the next hour" is urgency. "Over ninety percent of staff have already" is consensus — social pressure to follow the crowd.
" 这里叠加了两种手法："在一小时内"是紧迫感； "超过百分之九十的员工已经"是从众——用社会压力促使你随大流。
Naming each tactic is exactly what earns the mark.
把每一种手法的名字点出来，才是拿分的关键。
A password attack is any attempt to log in with guessed or stolen passwords.
密码攻击是指用猜测或窃取来的密码尝试登录。
In an online password attack the adversary tries passwords against the real login page — and that leaves visible signs in the logs: many failed logins in a short time, attempts at unusual hours, attempts from unknown devices.
在线密码攻击是对着真实登录页反复尝试—— 这会在日志里留下明显的痕迹：短时间内大量失败登录、异常时间的尝试、 来自陌生设备的尝试。
It works because people choose weak passwords: a word plus a two-digit year plus a symbol, or a pet's name.
它之所以奏效，是因为人们选的密码很弱： 一个单词加两位年份再加一个符号，或者宠物的名字。
Those patterns are so predictable that an adversary builds a dictionary of likely passwords and lets a tool try each one.
这些模式太好猜了， 对手会据此建一本可能密码的"字典"，让工具逐个尝试。
So: make passwords long, random and unique, and let a password manager remember them.
所以： 密码要长、要随机、每处都不同，交给密码管理器去记。
Then turn on multifactor authentication, MFA, which demands a second proof on top of the password.
然后打开多因素身份验证，它会在密码之外再要一重证明。
Not all adversaries are the same, and the exam expects you to distinguish them.
对手并不都一样，考试要求你能区分他们。
We sort them by skill. A low-skilled attacker buys ready-made tools online and reuses exploits that are already known and already patched. A high-skilled attacker writes their own tools and can find a brand-new hole that nobody has fixed yet — a zero day.
我们按技能水平分类： 低水平攻击者在网上买现成工具，重复利用那些已知、也已经打了补丁的漏洞； 高水平攻击者会自己写工具，能找到还没有人修复的全新漏洞——也就是零日漏洞。
Their motivation varies just as much: greed, revenge, politics, or belief.
他们的动机差别同样大：贪财、报复、政治或信念。
Skill tells you what they can do; motivation tells you what they will aim at.
技能告诉你他们能做什么，动机告诉你他们会盯上什么。
Public Wi-Fi is a favourite hunting ground, and three wireless attacks are named in the syllabus.
公共 Wi-Fi 是对手最爱的猎场，考纲里点名了三种无线攻击。
An evil twin is a fake access point using a network name — an SSID — copied from the real one; victims connect to it, and the adversary reads their traffic.
"双胞胎恶意热点"是一个假的接入点，用的是从真网络抄来的名字； 受害者连上它，对手就能读到他们的流量。
Jamming floods the air with a strong radio signal so nobody can connect at all — that is a denial of service, a DoS attack.
"干扰攻击"用强无线电信号淹没空中， 让谁都连不上——这是一种拒绝服务攻击。
And war driving is simply driving around, detecting networks and finding where their signal leaks outside the building.
"战争驾驶"就是开着车四处探测无线网络， 找出它们的信号泄漏到建筑物外面的地方。
To protect yourself: check the network name matches exactly, prefer encrypted sites, and consider a virtual private network, a VPN.
要保护自己： 核对网络名称是否完全一致、优先使用加密网站、并考虑使用虚拟专用网络。
And note this carefully — on an evil twin, encryption still protects you. The adversary sees your traffic but cannot read an encrypted page.
还要特别注意：在恶意热点上，加密依然保护着你—— 对手看得见你的流量，却读不了加密页面的内容。
Now the AI-based cybersecurity attacks.
人工智能给对手递上了一套新工具。
Artificial intelligence handed adversaries a new toolbox. With enough voice and image samples they can build a deepfake avatar and impersonate someone on a call.
有了足够的语音和图像样本， 他们就能做出深度伪造的形象，在通话中冒充某个人。
Large language models — LLMs — let them write convincing phishing emails in perfect, native-sounding language — removing the clumsy wording that used to give scams away.
大语言模型让他们 能用完美地道的语言写出可信的钓鱼邮件——过去那种别扭的措辞不再暴露骗局。
AI also helps them on the back end: crafting prompts that pull secrets out of a model, planting false information so it poisons training data, scanning the internet for facts about a target, even writing malware.
AI 在幕后同样帮忙：精心构造提示词把模型里的秘密套出来、 散布虚假信息以污染训练数据、在互联网上搜集目标的资料，甚至编写恶意软件。
But you can defend against most of it: agree a shared secret word with close contacts, enable multifactor authentication so a cloned voice alone is not enough, never type sensitive data into a chatbot, and check AI output against a non-AI source.
但这些大多可以防：与亲近的人约定一个"暗号"、 启用多因素认证让克隆的声音单独不够用、绝不把敏感数据输进聊天机器人， 并用非 AI 的来源核对 AI 的输出。
Leveraging AI in cyber defense is the other half, and the exam calls this dual use.
同样的技术也在保护我们，考试称之为"两用"。
AI can review firewall rules and access settings and recommend safer ones. It can scan application code for weaknesses and suggest detection rules.
AI 可以审查防火墙规则和访问设置， 并推荐更安全的配置；可以扫描应用代码里的弱点，并给出检测规则的建议。
But its biggest advantage is scale.
但它最大的优势是规模。
A medium-sized network produces millions of events every single day — far more than any team can read.
一个中等规模的网络每天产生数以百万计的事件—— 远远超过任何团队能读完的量。
AI sorts the harmless from the likely-malicious, alerts a human, or acts automatically.
AI 把无害的和可能有害的分开， 提醒人工处理，或者自动采取动作。
That turns a response time of days into seconds.
这把以"天"计的响应时间变成了以"秒"计。
One caution the exam wants: a human expert must always check the advice before it is applied.
考试要求你记住一个警告：在应用这些建议之前，必须由人类专家把关。
Three marks students throw away.
三个学生常丢的分。
First, when you rank risks, high risk means high impact AND easy to exploit — both, not either.
第一，给风险排序时，"高风险"意味着影响大**并且**容易被利用—— 是两者兼具，不是二选一。
A Wi-Fi signal leaking into a car park matters far less than an open internal port that lets an adversary spoof a device.
信号泄漏到停车场，远不如一个对外开放的内部端口严重。
Second, encryption still protects you on an evil twin: say exactly what is exposed and what is not, rather than just calling it unsafe.
第二，在恶意热点上加密依然保护你：要说清楚具体什么暴露了、什么没有， 而不是笼统地说"不安全"。
Third, AI is dual-use — the same tool shows up on the attack side and the defence side, so read the question carefully to see which one it is asking about.
第三，AI 是两用的—— 同一种工具会同时出现在攻击方和防守方，所以要看清题目问的是哪一边。
Five leftover facts.
还剩五件事实。
First, the goal of social engineering is elicitation: getting a one-time password, answers to challenge questions, or a malware download, without the victim realising.
第一，社会工程学的目的是套取信息： 在对方毫无察觉时拿到一次性密码、安全问题答案，或让人下载恶意软件。
Second, weak passwords lose because an adversary builds a dictionary from facts about you and tries every entry.
第二，弱密码会输，因为对手会根据关于你的事实建一本字典，然后逐条试。
Third, war driving is driving around to find where a wireless signal leaks outside a building.
第三，战争驾驶是开车四处找无线信号漏出建筑物的地方。
Fourth, on public Wi-Fi use a VPN, and agree a shared secret word with close contacts so a deepfake cannot impersonate them.
第四，公共 Wi-Fi 上用虚拟专用网络，并与亲近的人约定暗号， 好让深度伪造无法冒充他们。
Fifth, MFA is almost always how you make authentication stronger, and high risk means high impact AND easy to exploit.
第五，让认证变强几乎总要加上多因素认证； 高风险意味着影响大并且容易被利用。