Lecture 3.pptx
- 1. Lecture 3 Part I: Introduction to Cyber Attacks Author: Muhammad Rehan
- 2. Objective • Overview of Cyber-attacks • Cyber-attacks prevention • How Cyber-attacks applied to IT systems and their initialization • Classification of malwares • Four stages/phases of computer viruses (Dormant phase, Triggering stage, Execution phase, Propagation phase)
- 3. What is a Cyber Attack? When there is an unauthorized system/network access by a third party, we term it as a cyber attack. The person who carries out a cyberattack is termed as a hacker/attacker. Cybersecurity is the method of safeguarding networks, computer systems, and their components from unauthorized digital access.
- 4. Types of Cyber Attacks Let’s start with the different types of cyberattacks on our list: 1. Malware Attack 2. Phishing Attack 3. Password Attack 4. Man-in-the-Middle Attack 5. SQL Injection Attack 6. Denial-of-Service Attack 7. Insider Threat 8. Crypto jacking 9. Zero-Day Exploit 10. Watering Hole Attack
- 5. Malware Attack This is one of the most common types of cyberattacks. “Malware” refers to malicious software viruses including worms, spyware, ransomware, adware, and Trojans. 1. The Trojan virus disguises itself as legitimate software. 2. Ransomware blocks access to the network's key components. 3. Spyware is software that steals all your confidential data without your knowledge. 4. Adware is software that displays advertising content such as banners on a user's screen. Malware breaches a network through a vulnerability. When the user clicks a dangerous link, it downloads an email attachment or when an infected pen drive is used.
- 6. Malware Attack Prevention • Use antivirus software. It can protect your computer against malware. • Use firewalls. Firewalls filter the traffic that may enter your device. Windows and Mac OS X have their default built-in firewalls, named Windows Firewall and Mac Firewall. • Stay alert and avoid clicking on suspicious links. • Update your OS and browsers, regularly.
- 7. Phishing Attack Phishing attacks are one of the most prominent widespread types of cyberattacks. It is a type of social engineering attack wherein an attacker impersonates to be a trusted contact and sends the victim fake mails. Unaware of this, the victim opens the mail and clicks on the malicious link or opens the mail's attachment. By doing so, attackers gain access to confidential information and account credentials. They can also install malware through a phishing attack.
- 8. Phishing Attack Prevention Phishing attacks can be prevented by following the below-mentioned steps: • Scrutinize the emails you receive. Most phishing emails have significant errors like spelling mistakes and format changes from that of legitimate sources. • Make use of an anti-phishing toolbar. • Update your passwords regularly.
- 9. Password Attack It is a form of attack wherein a hacker cracks your password with various programs and password cracking tools like Aircrack, Cain, Abel, John the Ripper, Hashcat, etc. Types of password attacks: 1. Brute force attacks 2. Dictionary attacks 3. keylogger attacks.
- 10. Password Attack Prevention Listed below are a few ways to prevent password attacks: • Use strong alphanumeric passwords with special characters. • Abstain from using the same password for multiple websites or accounts. • Update your passwords; this will limit your exposure to a password attack. • Do not have any password hints in the open.
- 11. Man-in-the-Middle Attack A Man-in-the-Middle Attack (MITM) is also known as an eavesdropping attack. In this attack, an attacker comes in between a two-party communication, i.e., the attacker hijacks the session between a client and host. By doing so, hackers steal and manipulate data.
- 12. Man-in-the-Middle Attack Prevention MITM attacks can be prevented by following the below-mentioned steps: • Be mindful of the security of the website you are using. Use encryption on your devices. • Refrain from using public Wi-Fi networks.
- 13. SQL Injection Attack A Structured Query Language (SQL) injection attack occurs on a database-driven website when the hacker manipulates a standard SQL query. It is carried by injecting a malicious code into a vulnerable website search box, thereby making the server reveal crucial information.
- 14. SQL Injection Attack Prevention To prevent a SQL injection attack: • Use an Intrusion detection system, as they design it to detect unauthorized access to a network. • Carry out a validation of the user-supplied data. With a validation process, it keeps the user input in check.
- 15. Denial-of-Service Attack • A Denial-of-Service Attack is a significant threat to companies. Here, attackers target systems, servers, or networks and flood them with traffic to exhaust their resources and bandwidth. • When this happens, catering to the incoming requests becomes overwhelming for the servers, resulting in the website it hosts either shut down or slow down. This leaves the legitimate service requests unattended. • It is also known as a DDoS (Distributed Denial-of-Service) attack when attackers use multiple compromised systems to launch this attack.
- 16. Denial-of-Service Attack Prevention Let’s now look at how to prevent a DDoS attack: • Run a traffic analysis to identify malicious traffic. • Understand the warning signs like network slowdown, intermittent website shutdowns, etc. At such times, the organization must take the necessary steps without delay. • Formulate an incident response plan, have a checklist and make sure your team and data center can handle a DDoS attack. • Outsource DDoS prevention to cloud-based service providers.
- 17. Insider Threat • As the name suggests, an insider threat does not involve a third party but an insider. In such a case; it could be an individual from within the organization who knows everything about the organization. Insider threats have the potential to cause tremendous damages. • Insider threats are rampant in small businesses, as the staff there hold access to multiple accounts with data. Reasons for this form of an attack are many, it can be greed, malice, or even carelessness. Insider threats are hard to predict and hence tricky.
- 18. Insider Threat Prevention To prevent the insider threat attack: • Organizations should have a good culture of security awareness. • Companies must limit the IT resources staff can have access to depending on their job roles. • Organizations must train employees to spot insider threats. This will help employees understand when a hacker has manipulated or is attempting to misuse the organization's data.
- 19. Cryptojacking • The term Cryptojacking is closely related to cryptocurrency. Cryptojacking takes place when attackers access someone else’s computer for mining cryptocurrency. • The access is gained by infecting a website or manipulating the victim to click on a malicious link. They also use online ads with JavaScript code for this. Victims are unaware of this as the Crypto mining code works in the background; a delay in the execution is the only sign they might witness.
- 20. Cryptojacking Prevention Cryptojacking can be prevented by following the below-mentioned steps: • Update your software and all the security apps as cryptojacking can infect the most unprotected systems. • Have cryptojacking awareness training for the employees; this will help them detect crypotjacking threats. • Install an ad blocker as ads are a primary source of cryptojacking scripts. Also have extensions like MinerBlock, which is used to identify and block crypto mining scripts.
- 21. Zero-Day Exploit • A Zero-Day Exploit happens after the announcement of a network vulnerability; there is no solution for the vulnerability in most cases. Hence the vendor notifies the vulnerability so that the users are aware; however, this news also reaches the attackers. • Depending on the vulnerability, the vendor or the developer could take any amount of time to fix the issue. Meanwhile, the attackers target the disclosed vulnerability. They make sure to exploit the vulnerability even before a patch or solution is implemented for it.
- 22. Zero-Day Exploit Prevention Zero-day exploits can be prevented by: • Organizations should have well-communicated patch management processes. Use management solutions to automate the procedures. Thus it avoids delays in deployment. • Have an incident response plan to help you deal with a cyberattack. Keep a strategy focusing on zero-day attacks. By doing so, the damage can be reduced or completely avoided.
- 23. Watering Hole Attack • The victim here is a particular group of an organization, region, etc. In such an attack, the attacker targets websites which are frequently used by the targeted group. Websites are identified either by closely monitoring the group or by guessing. • After this, the attackers infect these websites with malware, which infects the victims' systems. The malware in such an attack targets the user's personal information. Here, it is also possible for the hacker to take remote access to the infected computer.
- 24. Watering Hole Attack Prevention Let's now see how we can prevent the watering hole attack: • Update your software and reduce the risk of an attacker exploiting vulnerabilities. Make sure to check for security patches regularly. • Use your network security tools to spot watering hole attacks. Intrusion prevention systems(IPS) work well when it comes to detecting such suspicious activities. • To prevent a watering hole attack, it is advised to conceal your online activities. For this, use a VPN and also make use of your browser’s private browsing feature. A VPN delivers a secure connection to another network over the Internet. It acts as a shield for your browsing activity. NordVPN is a good example of a VPN.
- 25. Four stages/phases of computer viruses Let's now see how we can prevent the watering hole attack: 1. Dormant phase. • The virus is idle. 2. Propagation phase. • The virus places an identical copy of itself into other programs or into certain system areas on the disk. 3. Triggering phase. • The Virus is activated to perform the function for which it was intended. • Caused by a variety of system events. 4. Execution phase. • The virus function is performed.