Introduction to Cyber Attack
A cyber attack is a deliberate attempt to breach computer systems or networks by using malicious softwares to disrupt the system. It can be launched from one or more computers against one or multiple computers networks. Cyber attacks lead to practices like frauds, information theft, ransomware schemes, etc.
Types of Cyber Attacks
Common Types of Cyber attacks are as follows:
1. Malware
Malware is short term for Malicious Software which includes viruses, worms, spyware, trojans, and ransomware. When the user clicks on a malicious link or an email attachment, it gets installed on the system. Once it is installed on the system, it can do harmful activities such as Blocks access to the data and programs on the system, Steals information.
E.g. of Malware is Ransomware. It encrypts data on the victim’s system and then demands a ransom in exchange for the code for decryption which makes the system usable again or access to the blocked data.
2. Phishing
Phishing is an attempt to steal sensitive information like usernames, passwords, bank account details or to install malware by using emails which appears to be from a trusted source. It starts to work when the target user opens the link from an email and provides login details or other private information to the fake source
Eg: Phishing website. After that, the attacker collects this credentials and uses it on a legitimate website for harmful actions. This works just like a fisherman uses bait to catch a fish.
3. Denial of Service (DOS) and Distributed DOS (DDOS) Attack
A Denial of Service attack floods networks, servers or surrounding infrastructure with traffic to consume bandwidth and resources. After the specific time and traffic server can no longer effectively process incoming requests, it denies other incoming request services.
4.5 (5,317 ratings)
View Course
Eg: This makes the server unavailable to legitimate requests. A DOS attack performed one computer and one internet connection to flood the target server. DDOS which is short for Distributed DOS is an attack which takes place from multiple computers and multiple internet connections. i.e distributed sources such as a botnet.
4. SQL Injection
Sequel injection also called as SQLi. SQL is a programming language used for maintaining the database. The main motive of an attacker to perform SQL injection is to retrieve or modify data from the SQL database. An attacker can execute commands by inserting specialized SQL statements into the input fields of the website. If the website is vulnerable to SQL Injection, then the attacker can read sensitive data from the database, can manipulate the queries by giving commands such as INSERT, UPDATE, DELETE. Also, a hacker can execute the system admin operations shutdown database or give commands to the operating system.
Eg: There is a web form on the website which requests for a user’s account details. Hence the code for this query will be like as follows:
userID = getRequestString("userID");
lookupUser = "SELECT * FROM users WHERE userID = " + userID
If the user provides ID as 112 in the input areas of the website, then the resulting query will be as follows:
"SELECT * FROM users WHERE userID = '112';"
For SQL Injection, an attacker will provide input such as 112 OR 1=1
Therefore, in SQL Database this will get executed as
"SELECT * FROM users WHERE userID = '112' OR '1'='1';"
The logic behind this is ‘1’=’1′ is always results TRUE, so the database will return the data of all of the users but not single user.
5. Man In The Middle(MITM) Attack
In MITM, the attacker places himself between the two parties i.e the sender and receiver to intercept or manipulate the communication between them. By doing this, an attacker can collect information and impersonate any of the party.
Eg: A and B are communicating with each other. A sends some message to B but before it transfers to B, attacker which impersonate himself between the communication, receives that message and can read or edit the private message and sends that modified message to B. B is unaware about the modification and he believes this message is sent by A.
6. Cross-site Scripting(XSS) Attack
XSS is an attack in which attacker attaches malicious code or payload to a legitimate website. When the target loads the website, the code gets executed. For this, Firstly, an attacker searches for a website which has script injection vulnerabilities. After that, the attacker injects the payload with malicious javascript code in the database of that website. This payload steals cookies in the sessions. When the victim visits the trusted website, a malicious script gets executed by the victim’s browser. After script execution, a cookie is sent to the attacker. Then the attacker extracts this cookie and can use it for session hijacking attacks.
7. Eavesdropping attack
This attack happens when there is an interception of network traffic. Through this attack, the attacker can get access to the bank account, credits, and other private information.
There are two types of Eavesdropping attacks
- Active Eavesdropping: In this, hacker gathers information by actively participating in communication like scanning the network ports, tampering HTTP requests, etc.
- Passive Eavesdropping: This involves information gathering by secretly listening to communications.
Detecting Passive eavesdropping is harder than active ones because there are no backtracks to trace in the passive eavesdropping.
Example of Eavesdropping is as follows:
The attacker will contact a person through an email as a bank manager and sends message to him such as, because of server issue we are updating our system servers, please provide your bank details. As soon as a person sends his personal details to that mail, the attacker will get access to his account.
Different Ways to protect yourself from cyber attacks
- Do not share personal information online unless you’re sure about the authentication of a legitimate website. Also, change passwords regularly. Make sure that you’re not using the same password to different websites.
- Make sure that you are using a website which starts with Secure HTTP(https) extension.
- Always download and install software updates for your operating system.
- Secure Wi-Fi networks and control access to hardware systems also.
- In organizations, train employees about cyber threats and how to avoid them. Limit employees to access information and authority for installation of softwares.
- Limit access to the database. Also, restrict permission to update or modify database other than a system admin.
- Back up your files at least once per week. Save backup files to removable hard disk or a cloud. If it is possible to encrypt them with a strong encryption algorithm.
Recommended Articles
This has been guided to What is Cyber Attack. Here we discuss different types and how to protect yourself from cyber attack. You can also go through our other suggested articles to learn more –
