Recognise brute-force attacks and hacking
Explain how repeated password guessing and unauthorised access threaten accounts and systems.
Exam scope and assessment notes
This sequence follows Cambridge IGCSE Computer Science 0984, 2026–2028 syllabus Version 4. It covers subject content sections 5.1–5.3 only. The separately published 2029–2031 syllabus is not mapped here. Practice is original, self-checked and does not award an official Cambridge grade. Full timed papers and human subject-teacher review remain outstanding. Cambridge states that 0984 has the same 2026–2028 subject content as 0478, with 9–1 grading. In June and November, Cambridge lists 0984 in Administrative zone 3 and for centres in Oman and the UAE. Confirm availability for your centre and exam series with Cambridge International. The separately published 2029–2031 syllabus changes to Python 3 only and removes pseudocode; this 2026–2028 route does not cover those changes.
Before you begin
- No programming language is required. Be comfortable with place value and multiplication; each lesson introduces the computer-science notation it uses.
Work on paper. Try each question before revealing help, and explain why your method works.
Quick readiness check
What does unauthorised access mean?
What you will learn
- Describe a brute-force attack
- Describe hacking as unauthorised access
- Connect each threat to its aim
Attackers target credentials and access
A brute-force attack repeatedly tries possible passwords or keys until one works. Automated tools can try many combinations, especially against weak or reused passwords.
Apply and check the rule
Hacking is gaining unauthorised access to a computer system, account or data. An attacker may seek information, change data or disrupt services. The term describes unauthorised access; it does not mean every activity called hacking has the same method or aim.
Pause and explain
An attacker automatically tests many password combinations. Which threat is this?
Worked example
A login system receives thousands of different password guesses for one account. Identify the threat and its process.
Show the worked solution
- The attacker submits repeated candidate passwords.
- The aim is to discover the correct credential.
- This repeated guessing is a brute-force attack.
Answer A brute-force attack repeatedly guesses passwords in an attempt to gain unauthorised access.
Try a topic test
Choose Easy, Normal or Difficult. Save your answers and open worked review after finishing.
Test this topic →From guided practice to a new situation
Write your answer and reasoning first. Use a hint only if you are stuck. The model solution is for self-checking; your written work is not automatically marked.
Describe the steps in a brute-force password attack.
Give me a hint
Include repetition and the attacker's aim.
Compare my reasoning
- The attacker selects a candidate password.
- A program tests it against the login or protected data.
- The process repeats until access succeeds or is blocked.
An attacker repeatedly tests possible passwords, hoping one matches and grants access.
Look for these in your work
- Candidates tried
- Repeated process
- Aim stated
A security log shows a successful sign-in from a person with no permission. Explain why the event is hacking even if no password guesses are visible.
Give me a hint
Classify the access, not only the tool.
Compare my reasoning
- The person accessed the system without authorisation.
- Hacking describes unauthorised system access.
- The method could have been stolen credentials or another route.
It is unauthorised access, which is hacking; a brute-force method is not required if credentials were obtained another way.
Look for these in your work
- Permission status
- Threat classification
- Method distinguished
A school wants to reduce brute-force risk and limit damage if an account is compromised. Propose one control for each goal and explain the match.
Give me a hint
Use a login control and a separate permission control.
Compare my reasoning
- Rate limits or lockouts slow repeated guesses.
- Strong unique passwords and two-step verification make account takeover harder.
- Access levels restrict what a compromised account can reach.
Rate limiting or lockout reduces repeated guesses, strong unique credentials with two-step verification reduce takeover likelihood, and access levels limit damage after access.
Look for these in your work
- Guessing control
- Authentication control
- Impact-limiting control
Common mistakes
- Describing one stolen password as a brute-force attack
- Assuming every hacker uses the same tool or motive
What can you explain now?
What makes an attack brute force?
Compare with the explanation
Repeatedly trying possible passwords or keys
The attacker searches through candidates until one succeeds or the search is stopped.
After trying it yourself, choose your next review. This is your self-assessment.
Your review choice appears on Today. Sign in to sync it across devices.
Make it stick
How does a brute-force attack differ from the broader idea of hacking?
If you needed the solution, close it and solve the problem again from a blank page. A correct answer is stronger when you can explain the reason for each step.