10 Most Common Types of Cyber Attacks
It all started with ARPANET. Developed in the turmoil of the Cold War, ARPANET was the inception of the most fertile ground for any and every type of cyber attacks imaginable. This was the beginning, and it all just sort of continued from there. Then came the Internet. Through the evolution of ARPANET, human kind now has unlimited access to the greatest database of human knowledge in the history of the world. But it’s not that simple. There are those who try to exploit it, bypass the governing laws of this vast communications network only to provide personal gain to themselves. This topic is probably more relevant now than it has ever been before. With the existence and immeasurable popularity of social networks and cloud computing, the increase in types of cyber security attacks has become exponential. And with that increase comes the growing need for security against various computer attacks. But the situation has become more serious than anyone could have ever imagined. Whistleblowers such as Assange and Snowden have exposed the faults in the system itself, uncovering unauthorized surveillance programs such as PRISM. This has only further alerted the general public to the need for the protection of personal information that cannot be ignored. Now it’s not only the stereotypical hacker that you need to worry about. Now the government is involved. Which brings us to the matter at hand. But, before we begin our list of types of cyberattacks, let us give you a word of hope. Your PC, laptop, Facebook account, cloud storage space, and smartphone can be protected from unauthorized access. But that is a discussion for another time. The first step in preparing for the battle is to know your enemy, which is exactly what we’re going help you with.DoS and DDoS Attacks
This particular type of cyber attacks is the one you hear about the most, the one most frequently featured in inaccurate film representations of hacking communities. This is one is designed to cripple or damage your entire system. With it, there is absolutely no desire for the attacker to gain access to your private information. The only satisfaction there is to be gained from this attack is purely sadistic. The way denial of service and direct denial of service cyber attacks work is by overwhelming the resources of your system with too many service requests for it to handle. A great number of hosting machines is necessary for this type of intrusion, with the malicious software being controlled and planted by the person attacking your system.
However, although there are no direct benefits of this cyber attack in terms of data mining, there is another type of benefit to be reaped nonetheless. For example, imagine a business competition. Both companies producing the same sort of goods or services. Performing a DDoS attack on the competitor’s computer system could cripple their business operations, leaving ample time for the other side to take advantage of it. Also, a Dos attack can serve as a precursor of many other attacks. For example, attackers can first cripple your system with DDoS, then continue with session hijacking. Who knows what their true intentions might be. Not all DDoS attacks are exactly the same. There are, in fact, five different types of attacks under the DDoS category. These are teardrop attack, botnet, smurf attack, TCP SYN flood, and ping-of-death. They do sound scary, we know, but there are ways for you to be protected from all these different types of cyber attacks.
MitM Attack
The Man-in-the-middle attack, or MitM for short, relies also on social engineering. It usually occurs when an attacker inserts himself or herself between the communication channels of two different entities – the server and the client. The most used types of cyber attacks that fall into the MitM category are session hijacking, IP spoofing, and the replay attack. Session hijacking has already been mentioned. Simply put, during this cyber-attack a communication session is interrupted by the attacker, as he or she inserts their computer between a server and a client. The server doesn’t stop the session as the attacker swaps the IP address with that of the client. You can probably already sense the various negative repercussions of this type of attack. IP spoofing occurs when the attacker wants to convince the system that the communication is still with a well-trusted and vetted entity, and not a hacker. This attack has everything to do with IP address switching. The hacker sends a package to the server, containing the IP address of a familiar entity. The host might then choose to accept that package and continue the communication. Finally, as the name suggests, replay attack has something to do with rehashing old conversations between the client and the server. And that’s exactly what it is. If an attacker comes in possession of any of the old messages shared between the server and the client, he or she can then attempt to use them again for their own means. There is an easy way to protect yourself from these types of computer attacks – you can use a nonce or a session timestamp.
Phishing
Phishing is among the most common types of cyber attacks. They are extremely widespread, easily carried out, and can yield good results for the attacker. The idea behind phishing attacks is quite simple – you impersonate a trusted source and send emails to their clients. Again, a bit of a flair for social engineering is desired for phishing. However, the attacker still needs some technical prowess to carry out attack. Phishing attacks are quite diverse, and you should always pay close attention to every aspect of an email that you receives from various companies you are in business with. The same goes for emails from friends, social networks, and other addresses. For example, a phishing-designed email could have an attachment that could plant malware to your computer. Or it could contain a web address of a fake, malware-infested website. The possibilities are many.Another subcategory spear phishing. Whereas phishing attacks are of a wider scope, spear phishing attacks are a lot more targeted. Spear phishing attacks usually have a single target in their scopes. The attackers take their time developing highly personalized phishing content based on the knowledge about their victim. It is because of these facts that spear phishing is most difficult to identify, and perhaps even more difficult to protect against. A technique commonly used for spear phishing is website cloning, where the attacker copies the look and feel of a website you frequently visit with an attempt to steal your personal or login information. Another technique relies on email spoofing. The “From” area in the email is false, making the email appear to be from a person you know. Again, a crafty attempt at stealing personal information. There is no definitive protective method for phishing attacks other than the advice to pay close attention to all emails you receive, as well as the information they contain. If anything smells “phishy”, chances are it probably is. Be alert and protect yourself.
Drive-by Attacks
Perhaps among the lesser-known types of cyber attacks, drives-by are, in fact, extremely common. These are primarily used to spread malware among as many Internet users as humanly possible. Attackers search the web for insecure or poorly-secured websites and install malicious scripts into the codes of the web pages. They plant these scripts into the PHP or HTTP codes, that is, the very core of the website in question. Upon visiting these insecure web pages, the planted script may install unwanted malware onto your computer, or it can redirect you to a hacker-controlled website. These things can happen by simply entering a website, viewing emails, or via pop-up windows. What makes these types of attacks really unpleasant is the fact that they do not require any active participation by the user. The only way for the user to minimize potential casualties is to constantly update their web browsers and steer clear of unfamiliar web addresses. Although virtually every website can be hit by a drive-by, it highly unlikely for that to happen to larger and more secure web pages. Stick to what you know, update your browsers, and you should be safe.Password Attacks
Password attacks are straight from television and big screens. Hollywood has often portrayed skilled hackers obtaining passwords in a jiffy by using complicated programs, algorithms, and sheer wits. And, let’s be completely honest, if an attacker wants your passwords, there are ways for them to get it. There are two main methods. We will exclude all types of social engineering and spying of the victim from this overview. The first one is called brute-force. This is a method that involves the use of an algorithm that randomly generates many different passwords in the blink of an eye, hoping one might work. The other method is the dictionary attack. With this attack, the hacker uses a dictionary that contains the most common passwords and tries to guess the one put as security by the user.
One way of protecting yourself from these types of cyber security attacks is to make your password as complicated as possible, an utter gibberish of lower-case and upper-case letters and numbers. Another way is to implement account lockout, which will lock the attacker out of the account upon attempting invalid passwords a couple of times in a row.
SQL Injection Attacks
Database-driven web addresses have been suffering more and more frequently in recent years. The attacker simply executes an SQL-based query within the database using the input data between the server and the client. This way, the attacker inserts SQL commands into the data-plane input, so as to be able to run certain predefined commands. By successfully employing SQL injection, the attacker can come in possession of sensitive data, become able to modify existing database entries, come in possession of administrator privileges, and, in rare instances, become able to issue OS commands. The problem here is that with SQL there is no distinction between data planes and the control. So, injection works most efficiently with dynamic SQL driven websites. There are several steps you should take when trying to prevent these cyber security attacks. First, you have to apply the least privilege permission model for the database. Then, resort only to those procedures that are stored, eliminating dynamic SQL from them, and use only prepared statements. There are always ways to protect yourself, although sometimes they are a bit complicated.XSS Attacks
Cross-site scripting attacks, that is, XSS attacks, employ third-party resources from the web to run various scripts in scriptable applications or web browsers of the victim. A payload containing malicious content is injected into the database of the website. Once a victim requests any of the pages from the domain of that website, the transmission begins, and the payload of the attacker becomes an integral part within the HTML code that is copied into the browser of the victim, upon which the execution of the attacker’s script begins. Yes, it’s as complicated as it sounds. One of the examples of many uses of XSS attacks is the instance where the attacker uses the victim’s cookies to perform session hijacking. Another, more dangerous consequence of XSS attacks is the occurrence of them being employed to exploit other vulnerable points of a system. These can include virtually anything, from collecting network information, to capturing screenshots, to logging key strokes. Better to protect yourself from XSS then. How? Well, it’s simple. All right, it’s not that simple, but it’s highly doable. Developers have to sanitize data inputs made by various users before reflecting the HTTP request back. All data has to be filtered, escaped, or validated. Only then can you echo that data back towards the user. You can also provide users with an option for disabling any client-side script. Finally, you can convert all special characters into their URL or HTML equivalents.Eavesdropping Attacks
These attacks occur when network traffic is intercepted. An attacker that employs the eavesdropping attack can learn about user’s passwords, numbers of credit cards, and other classified information that is being sent via the network. There are two main types of eavesdropping – active and passive eavesdropping. Passive eavesdropping occurs when the attacker steals the necessary information while listening to all message transmissions within the network. On the other hand, active eavesdropping consists of the attacker actively grabbing the wanted information by posing as a friendly unit, sending constant queries to the transmitters. There are also different names for active eavesdropping – scanning, probing, and tempering. The best manner of protection against both subcategories of eavesdropping is to employ data encryption.Birthday Attacks
Two more to go, if it already isn’t too much for you to take in. We did warn you that there are many different ways to crack your computer security, and birthday attacks are also a fairly common occurrence. They are devised against various hash algorithms used for verifying message integrity, digital signatures, and software. Messages that a hash function processes produce MDs, or message digests. MDs have a fixed length, and this length is independent from the original input message. Birthday attacks refer to the potential to find two completely random messages with an identical MD. Once the attacker has this MD, he or she can use it to calculate the exact replica of the MD for her or his own message, replace the message of the user with his own, leaving the receiver no ability to detect the attack, not even when comparing MDs.
Malware Attacks
Finally, we have come to the end, the last among the most common types of cyber attacks currently plaguing the Internet. Malware is defined as any type of unwanted or malicious software present in the system without the knowledge of the user. They can be used for all kinds of criminal intent, and there are so many types of malware it is hard to list them all. Malware usually attaches itself to some piece of existing, legitimate code, and it then propagates. It can become part of one of your favorite apps, or it can attach itself onto your browser and replicate across the vast network of the Internet.Since these types of cyber attacks are so frequent, common, and well-known among even the least educated of users, there are various ways for you to protect yourself from them. Most antivirus programs have malware protection nested deep within them. Also, update your browser regularly to stave off any unwanted access to your computer and your files. There are even specialized antimalware programs that are completely free to download and use. The options are many, and it would be wise to choose one, as malware is totally out there, replicating and increasing in number.
