Lecture 01  ·  Introduction

CYBERSECURITY

By: Hamed Okhravi, Ph.D. (MIT Lincoln Laboratory)

Three moments that changed history — and none of them looked like hacking

DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited. This material is based upon work supported by the Department of the Air Force under Air Force Contract No. FA8702-15-D-0001 or FA8702-25-D-B002. Any opinions, findings, conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the Department of the Air Force.

▼   scroll to begin
Act One
Three Turning Points in History

Before we talk about cybersecurity, let's travel back in time. Three seemingly unrelated events. Three outcomes that shaped the modern world. What do they have in common?

Bombe decryption machine at Bletchley Park
01
1939 – 1945  ·  World War II, Atlantic Theater

The Allies Break Nazi Germany's Stranglehold at Sea

For years, German U-boats ravaged Allied supply lines across the Atlantic, sinking thousands of ships and threatening to starve Britain into submission. Then, almost inexplicably, the tide turned. Allied naval commanders began predicting U-boat positions with uncanny accuracy. Convoys slipped through. U-boats were hunted down. Germany lost the Battle of the Atlantic — and with it, the war.

For decades, the true reason was classified. The official story? Better radar. Luck. But the real answer was far more audacious.

🔒 How did it really happen?
Natanz nuclear enrichment facility in Iran
02
2007 – 2010  ·  Natanz, Iran

Iran's Nuclear Ambitions Stall for Years

Iran's Natanz facility was enriching uranium at a pace that alarmed the international community. Then centrifuges began failing — at a rate far beyond normal wear and tear. Hundreds of machines spun themselves to destruction. Engineers were baffled. The control systems reported everything was nominal. Iran's nuclear program lost years of progress.

No bombs fell. No missiles were launched. No soldiers crossed any border. Iran was set back by a ghost — something the engineers could see the effects of, but not the cause.

🔒 What destroyed those centrifuges?
IBM Selectric typewriter
03
1976 – 1984  ·  US Embassy, Moscow

The Soviets Read Every Secret the Americans Typed

For nearly eight years, the Soviet KGB knew the contents of classified diplomatic cables typed at the US Embassy in Moscow — almost in real time. The Americans swept for bugs repeatedly. They found nothing. No transmitters. No cameras. No listening devices.

The operation — codenamed GUNMAN — was only exposed in 1984, after a NSA technician performed an extraordinarily thorough inspection. What he found inside the IBM Selectric typewriters shocked the intelligence community.

🔒 How were they reading the cables?

They Were All Cyber Attacks

Different eras. Different targets. Different methods. One common truth: information and computation were weaponized.

🔐
Cryptanalysis
Breaking the Enigma

The Enigma machine was Germany's state-of-the-art encryption device — mathematically, it generated a staggering 158 quintillion possible settings. Allied mathematicians at Bletchley Park, led by Alan Turing, built electromechanical computers called Bombes to crack it systematically.

The attack exploited cribs (known plaintext fragments) and structural weaknesses in the Enigma protocol — for instance, a letter could never encrypt to itself. This cryptographic break gave the Allies access to German military communications and is credited with shortening the war by an estimated two years.

🐛
Malicious Code
Stuxnet Worm

Stuxnet was the world's first publicly confirmed cyberweapon. It exploited four separate zero-day vulnerabilities to infiltrate air-gapped industrial control systems.

Once inside, it targeted Siemens PLCs controlling centrifuge motors, commanding them to spin at destructive speeds while falsely reporting normal operation. Operators watched helpless as machines failed. Stuxnet crossed the boundary between cyberspace and physical destruction, establishing that software alone could cause real-world industrial damage.

📡
Side-Channel Attack
The GUNMAN Implant

KGB engineers had secretly implanted tiny sensors inside the IBM Selectric typewriters at the US Embassy. The Selectric uses a rotating metal type ball — its precise angular position encodes every keystroke as a pattern of electromagnetic pulses in the motor.

The implants captured these magnetic field variations and transmitted keystrokes wirelessly to a nearby KGB receiver. This is a textbook side-channel attack: rather than breaking encryption, it bypassed it entirely by observing unintentional physical signals from the hardware itself — a technique still exploited today.

Act Two
The Stories in Full
Enigma machine with labeled components
01

Breaking Enigma

Cryptanalysis · 1939–1945

The German military believed Enigma was unbreakable. Each keystroke passed through three or more rotating cipher wheels, a plugboard with billions of configurations, and a reflector. The key space was effectively infinite by hand.

Turing's insight was mathematical: instead of brute-forcing all keys, search for contradictions. If a guessed plaintext fragment ("crib") leads to a logical impossibility — such as a letter encrypting to itself — that key setting can be eliminated. The Bombe automated this elimination across thousands of settings per minute.

The intelligence produced — codenamed Ultra — was so sensitive that Churchill deliberately allowed some German attacks to succeed rather than risk revealing that Enigma had been broken.

Iranian nuclear facility
02

Stuxnet

Cyberweapon · 2007–2010

Natanz was physically isolated — no internet connection. To reach it, Stuxnet was designed to spread via USB drives and local networks, silently checking each system it infected for the specific Siemens configuration it was hunting. The vast majority of the 100,000+ infected computers it touched were quietly ignored.

Only when it found its precise target did it activate. It reprogrammed centrifuge speeds while feeding false sensor data to operators — a strategy of plausible deniability. Engineers initially blamed manufacturing defects. Stuxnet is estimated to have destroyed roughly 1,000 centrifuges and set Iran's nuclear timeline back by years.

Stuxnet marked a historic threshold: cyberattack as act of war.

IBM Selectric typeball mechanism
03

Operation GUNMAN

Side-Channel · 1976–1984

The KGB's implant was a masterpiece of miniaturized engineering. Hidden in the space bar support rods and carriage mechanisms of IBM Selectrics, it contained tiny sensors measuring the magnetic flux produced by the type ball's stepper motors. Each character produced a unique electromagnetic signature.

The device had no battery — it harvested power wirelessly from an external signal. It transmitted only when interrogated by a nearby receiver, leaving no detectable emissions during routine sweeps.

When the NSA finally found one in 1984, they analyzed all US Embassy typewriters in Eastern Europe. Sixteen compromised machines were discovered. The operation had given the Soviets an eight-year window into classified diplomatic traffic — without ever touching the encryption.

The Common Thread

In each case, the attacker did not need to overpower the enemy physically. They needed to understand the information system — its structure, its assumptions, its blind spots — better than its designers did.

Cryptographic weaknesses. Software logic. Physical signal leakage. These are not exotic vulnerabilities. They are the inevitable consequence of complex systems built by humans, under time pressure, without adversarial thinking. This is why cybersecurity exists.

Act Three
Why This Matters Now — More Than Ever

The three attacks above spanned decades and targeted isolated systems. Today, billions of devices are permanently connected. The attack surface is orders of magnitude larger. And the stakes are not just military — they are personal, economic, and democratic.

$10.5T
Annual cybercrime cost globally by 2025
4.4B
Records exposed in data breaches — in one year
11 sec
Ransomware attacks a new victim every 11 seconds
🏥

Critical Infrastructure

Power grids, water treatment plants, hospital networks, and financial systems are all reachable from the internet — and have been attacked. A successful attack can cost lives.

🗳️

Democratic Processes

Disinformation campaigns, election system intrusions, and manipulation of public discourse are now standard tools of geopolitical competition between nations.

🔒

Personal Privacy

Every device you carry knows your location, health patterns, social graph, and financial behavior. That data is a target. Its compromise can ruin careers, relationships, and lives.

🤖

AI & Autonomous Systems

As AI systems take on medical, legal, and military decisions, their security properties become critical. Adversarial attacks on AI models are an active and rapidly evolving threat.

🚗

Embedded & Physical Systems

Cars, aircraft avionics, insulin pumps, and industrial controllers all run software. Like Stuxnet showed, software vulnerabilities can translate directly into physical consequences.

💸

Financial Systems

Nation-state actors and criminal organizations target banks, exchanges, and payment infrastructure. The 2016 Bangladesh Bank heist — $81M stolen via SWIFT — was just the beginning.

"We are all, whether we know it or not, participants in a global security ecosystem. Every insecure device is a potential weapon against someone else. Every software vulnerability is a door left unlocked. Security is not an optional feature — it is a social responsibility."

This Course
What You'll Learn

The attacks above span cryptography, software, hardware, and human psychology — and that is exactly the scope of this course. Security is not one discipline. It is the intersection of all of them.

01
🔐

Foundations of Cryptography

Symmetric and asymmetric encryption, hash functions, digital signatures, and key exchange protocols. The mathematical bedrock of secure communication — and what happens when it breaks.

AES · RSA · ECC TLS/SSL PKI Cryptanalysis
02
💻

Software Security

Memory layout, memory corruption, buffer overflows, injection attacks, and secure coding principles. How software gets exploited, and how to build systems that resist exploitation.

Memory Layout Buffer Overflow Return-Oriented Programming Control Hijacking
03
🔧

Hardware Security

Side-channel attacks (timing, power, electromagnetic), hardware trojans, trusted execution environments, and the security implications of CPU architecture. How attackers reach below the software layer.

Side-Channel Spectre · Meltdown TPM · TEE TEMPEST
04
🌐

Web & Network Security

The security of the protocols and platforms that power the modern internet: web application vulnerabilities, network intrusion, DoS, DNS attacks, and secure system design.

XSS · CSRF · SQLi Firewalls · IDS TLS Attacks BGP Hijacking
05
🧠

Human Aspects of Security

The most sophisticated technical defenses can be bypassed with a well-crafted email. Social engineering, phishing, insider threats, security UX design, and the psychology of deception.

Social Engineering Phishing Usable Security Insider Threat

Security Is How You Think, Not Just What You Know

The goal of this course is to build adversarial intuition — to train you to see systems the way an attacker does, so you can build them better.