Attacks and brute force
Cyber security Lesson 3 2:06 English narration · English + 中文 subtitles burned in
Chapters
Transcript
Beyond malware, attackers go at a system directly.
除了恶意软件，攻击者还会直接冲着系统来。
A brute-force attack tries every possible password until one works — no cleverness, just patience and a fast computer.
暴力破解就是把每一个可能的密码都试一遍，直到有一个对为止—— 没有什么巧妙之处，只有耐心和一台快机器。
Hacking means gaining access without permission, usually through a weakness somebody forgot to close: an old version, a default password, a setting nobody checked.
黑客入侵指的是未经许可获得访问权限， 通常是通过某个别人忘了堵上的弱点： 一个旧版本、一个默认密码、一项没人检查过的设置。
Two more happen on the network.
还有两种发生在网络上。
Data interception is listening in: a packet sniffer reads your data as it travels between you and the server.
数据拦截就是偷听：一个抓包工具在数据从你到服务器的路上把它读走。
And a denial-of-service attack floods a server with so many requests that it cannot serve anyone real.
而拒绝服务攻击用海量请求把服务器淹掉，让它没法为真实用户服务。
A distributed one — a DDoS — does that from thousands of machines at once, which makes it hard to block: there is no single address to shut out.
分布式的那种——DDoS——是从成千上万台机器上同时干这件事， 这让它很难拦：没有哪一个地址可以封掉。
Now the numbers, because they make the argument.
现在来看数字，因为数字才是论据。
A four-digit PIN has ten thousand codes.
一个四位 PIN 只有一万种。
Two more digits takes it to a million — better, and still nothing.
再加两位就到一百万——好一些，但仍然不算什么。
Allow letters as well and six characters gives fifty-six billion.
再允许字母，六个字符就有 560 亿种。
Two more characters, and you are at two hundred and eighteen trillion.
再多两个字符，你就到了 218 万亿。
Look at why.
看看这是为什么。
Each extra character does not ADD to the work, it MULTIPLIES it — by sixty-two, if letters and digits are allowed.
每多一个字符，不是给工作量"加"了点什么，而是把它"乘"了一次—— 如果允许字母和数字，就是乘以 62。
That is the whole reason length beats complexity: one more character multiplies the attacker's work by sixty-two, while swapping an o for a zero does not.
这就是"长度胜过复杂度"的全部理由： 多一个字符把攻击者的工作量乘以 62， 而把字母 o 换成数字 0 做不到这一点。
Lesson six comes back to this when you build a password checker.
第 6 课在你写密码检查器时会回到这里。
Four things to take with you.
带走四点。
One: brute force tries every possibility until one works.
第一：暴力破解把每一种可能都试一遍，直到成功。
Two: data interception reads data as it travels.
第二：数据拦截在数据传输途中把它读走。
Three: a DDoS floods a server from thousands of machines.
第三：DDoS 用成千上万台机器同时淹没一台服务器。
Four: each extra character multiplies the guesses needed.
第四：每多一个字符，所需的猜测次数就被乘一次。
Now brute-force the PIN in the task below.
现在去下面的题目里把那个 PIN 暴力破解出来。