2.2. Types of Cyber Threats

1. Malware (Malicious Software)

Definition: Malware is software designed to cause damage or unauthorized access to computers or networks. Types of Malware:

• Viruses – Attach to clean files and spread.
• Worms – Spread without human interaction.
• Trojans – Disguised as legitimate software.
• Ransomware – Encrypts files and demands payment.
• Spyware – Secretly monitors user activity. Example: The WannaCry ransomware attack locked files and demanded payment in Bitcoin.

Malware, which stands for malicious software, is a term used to describe any software intentionally designed to cause damage to a computer, server, or computer network. There are several types of malware, including viruses that attach themselves to clean files and replicate, worms that spread independently without needing user action, Trojans which misrepresent themselves as legitimate software, ransomware that encrypt files and demands payment to decrypt them, and spyware that secretly collects information from users. A notable example is the WannaCry ransomware attack, which affected thousands of computers worldwide by encrypting users' files and demanding Bitcoin as ransom.

Think of malware like a flu virus that invades a healthy body. Just as the flu virus spreads from person to person, malware can spread from one computer to another, causing harm and disruption along the way.

2. Phishing

Definition: Phishing involves tricking users into revealing personal information (e.g., passwords, credit card numbers) via fake emails or websites. Common signs:

• Urgent messages
• Unfamiliar links
• Suspicious email addresses Variants:
• Spear Phishing – Targeted phishing aimed at specific individuals.
• Whaling – Phishing attacks on high-profile targets (e.g., executives).

Phishing is a deceptive practice where attackers impersonate legitimate entities to trick individuals into providing sensitive information such as passwords or credit card details. Phishing attacks often take place through emails or fake websites that appear genuine. Common red flags of a phishing attempt include urgent warnings that prompt immediate action, links leading to unfamiliar sites, and email addresses that look suspicious or don't match the organization's usual domain. There are targeted versions of phishing, including spear phishing, which focuses on specific individuals, and whaling, which targets senior executives or high-profile individuals.

Consider phishing like a fisherman casting a net into the water to catch fish. The fisherman uses bait (like fake emails) to entice victims to 'bite,' often leading them to reveal their personal information without realizing they're in danger.

3. Denial of Service (DoS) and Distributed DoS (DDoS) Attacks

Definition: These attacks flood a system, server, or network with traffic to overwhelm resources and make it unavailable to users.

• DoS – One machine attacks the target.
• DDoS – Multiple machines (botnets) attack the target. Impact: Website or service downtime, loss of revenue, reputational damage.

Denial of Service (DoS) attacks aim to make a computer or network resource unavailable to its intended users by overwhelming it with excessive traffic, often rendering the service unusable. A simple DoS attack originates from one device targeting the victim server. In contrast, a Distributed Denial of Service (DDoS) attack uses multiple compromised systems (often referred to as a botnet) to flood the target with requests, effectively crippling services on a much larger scale. The consequences of these attacks can be severe, leading to downtime, loss of revenue, and damage to the organization's reputation.

Imagine a popular restaurant that becomes so overcrowded because of a sudden influx of guests that they can’t serve anyone effectively. This represents how DoS attacks work: they fill up the restaurant (or server) with too many requests, leaving genuine customers (users) unable to get service.

4. Man-in-the-Middle (MitM) Attack

Definition: An attacker secretly intercepts and possibly alters the communication between two parties. Examples:

• Eavesdropping on Wi-Fi communication
• Redirecting traffic to fake websites Prevention: Use HTTPS, avoid public Wi-Fi, implement VPNs.

A Man-in-the-Middle (MitM) attack occurs when an attacker secretly intercepts communications between two parties, often aiming to steal or manipulate information being exchanged. Common examples include eavesdropping on unsecured Wi-Fi networks, where attackers can capture data sent over the network, and redirecting users to fake websites that look legitimate. To defend against MitM attacks, it is important to use secure communication protocols like HTTPS, avoid using public Wi-Fi for sensitive transactions, and opt for virtual private networks (VPNs) that encrypt internet connections.

Think of a MitM attack like a telephone conversation that is being listened to by an eavesdropper. Just as the listener can hear everything you say and even change what gets said back without your knowledge, an attacker can intercept and manipulate online communications.

5. SQL Injection

Definition: An attacker exploits vulnerabilities in an application’s database layer by injecting malicious SQL commands. Example: Entering ' OR 1=1-- into a login field can bypass authentication in poorly coded applications.

SQL Injection is a type of cyber attack that targets the database layer of web applications. Attackers exploit vulnerabilities by injecting specially crafted SQL queries that manipulate the database to return unauthorized data or bypass authentication entirely. For example, inserting a statement like ' OR 1=1-- into a login form could trick the application into thinking the user is authenticated, thus granting access without valid credentials. The effectiveness of SQL Injection relies on poor coding practices, where user input is not adequately sanitized.

Imagine if a security guard allowed people into a club based solely on what they say without checking any identification. This represents how SQL Injection works; it allows unauthorized access based on clever input that bypasses authentication checks.

6. Zero-Day Exploits

Definition: Attacks that occur on the same day a vulnerability is discovered and before a fix is available. Why it’s dangerous: No time for vendors to patch systems before attacks occur.

Zero-Day Exploits are security vulnerabilities that are exploited the moment they are discovered, often before the software vendor has had the chance to issue a patch or update to fix the vulnerability. This makes them particularly dangerous, as there is no available defense against them until the vendor addresses the issue. Cyber criminals take advantage of this window of opportunity, leading to potential widespread damage during the exploit period.

Picture a door with a lock that has just been discovered to be faulty. If someone learns about this fault before the lock can be repaired, they could enter the space unchallenged. This is similar to how zero-day exploits work; attackers exploit vulnerabilities before they can be fixed.

7. Password Attacks

Types:

• Brute Force – Trying all possible password combinations.
• Dictionary Attack – Using a list of common passwords.
• Credential Stuffing – Using leaked passwords from other breaches. Defense: Use strong passwords, enable MFA.

Password Attacks seek to gain unauthorized access to user accounts through various methods. A brute force attack tries every possible combination of characters until the correct password is found. Dictionary attacks are slightly faster, using a list of common passwords and phrases to crack accounts. Credential stuffing involves using username and password pairs stolen from one breach to gain access to accounts on other platforms where the same credentials might be reused. To protect against these attacks, users should implement strong, unique passwords and consider enabling multi-factor authentication (MFA) for an extra layer of security.

Imagine a thief trying to unlock a treasure chest with a lock. A brute-force approach would be like trying every possible key until it finds the correct one, while a dictionary attack is like using a set of commonly used keys known to fit many locks. Credential stuffing is using a key that has already been found to open similar locks elsewhere.

8. Social Engineering

Definition: Manipulating people into giving up confidential information. Common Tactics:

• Pretending to be IT support
• Impersonating trusted individuals
• Urgency or fear-based manipulation.

Social Engineering describes attempts to deceive individuals into divulging confidential information by manipulating their emotions or trust. This can involve impersonating someone like an IT support staff member to extract information or creating a sense of urgency to push the victim into making hurried decisions about sensitive data. Techniques often exploit human psychology, leading people to act contrary to their own best interests.

Think of social engineering like a con artist who gains a person's trust to cheat them out of their money. By posing as someone trustworthy, they manipulate the person's actions, leading them to divulge information they normally wouldn’t.

--