The cyber world is growing rapidly. Everyone is involved, either directly or indirectly. Everything is available with a single click or tap on your mobile, tablet, or PC. You can browse websites, listen to or download audio, video, and software, place your order, buy products, book tickets, hotels, buses, taxis, etc. It has been made easy for everyone due to the cyber world or digital world.
You can see the very bright side of the cyber world, which you are enjoying in your daily routine, however, there is a dark side to the cyber world that exists in reality, called Cyber Crime or Hacking.
Have you ever heard about cyber crime? It happens due to cyber-attacks.
What is a cyber-attack?
The most valuable asset, nowadays, is data, not only for organizations but also for individual users. If you are able to protect your information or data, you or your organization are stable and secure. Perhaps at first glance, it is difficult to understand the importance, for those not that well-versed with this industry, however, understanding the need to stay protected is of high-value today. Cyber-attackers, at all times, are seeking these assets.
If you have data, you may fall victim to a cyber-attack.
We can define cyber-attacks as any type of illegal action by cybercriminals, hackers, or cyber experts attempting unauthorized access against a computer, information system, network, infrastructure or personal computer, or devices including; tablets, mobile phones, smart watches, smart TV, or other smart devices with the help of various methods to steal, alter, breach, modify, or destroy data or information systems.
What are the typical cyber-attacks?
1. Malware
In the cyber world, it has become common knowledge that around 300,000 thousand new pieces of malware are created daily.
Malware is a piece of code (software) that can be installed easily on your server, laptop or desktop, mobile device, tablet, etc., and it is used to leak private information or gain unauthorized access to data, information, or systems.
As stated by Datto, some types of malware are:
- Viruses — These infect applications by attaching themselves to the initialization sequence. The virus replicates itself, infecting other files or code in the computer system. Viruses can also attach themselves to executable code or associate themselves with a file by creating a virus file with the same name but with a .exe extension, thus creating a decoy that carries the virus.
- Trojans — A program hiding inside a helpful program with malicious purposes. It is commonly used to steal information or establish a backdoor to be exploited by attackers.
- Worms — Unlike viruses, they do not attack the host, being self-contained programs that propagate across networks and computers. Worms are often installed through email attachments. They are commonly used to overload an email server and achieve a denial-of service attack.
- Spyware — These programs are installed on laptops, mobiles, and other devices and are used to collect information about users, their systems, or browsing activities, sending the data to a remote user, the hacker.
2. Phishing
Approximately 6.4 billion fake emails are sent every day. For this reason, the attacker targets many victims for a phishing attack.
The most common and popular cyber-attack is Phishing, which indicates sending mass quantities of fraudulent emails to unsuspecting users, in a manner that appears as a reliable source.
Phishing attacks can also occur via social media, direct messages, or other online communities targeted by users with hidden intent.
There are multiple types of phishing attacks, as follows:
- Spear Phishing — Specific organizations or individuals are targeted
- Whaling — In an attempt to gain access to classified information, senior directors, stakeholders, or C-Level executives are targeted
- Pharming — Attacker uses Domain Name System (DNS) cache poisoning attack and manipulates DNS entry, to then redirect to a fake landing page to capture user credentials
- Voice Phishing – SMS Phishing – Attackers use phone calls or text messages to manipulate users in order to collect information
3. Ransomware
Ransomware is malware that encrypts critical data of a user or an organization so that they cannot access files, databases, or applications. The attacker decrypts the data and makes it available to the victim only after the ransom is paid. If the victim does not get access to the private key, it is impossible to decrypt those encrypted files that are being held by ransom. According to snap-tech.com, global ransomware damage costs are predicted to exceed $265 billion by 2031.
4. Cryptojacking
Cryptojacking is another form of cyber-attack. It involves the malicious act of the hacker, entirely hidden from the victim to unauthorized use of the victim’s computing resources for mining cryptocurrency.
5. Drive-By Attack
In a drive-by attack, sometimes referred to as a drive-by download, the attacker seeks vulnerabilities in various web browsers, plugins, or apps, to launch the attack. No action from the victim is required to initiate. With the help of this attack, hackers can hijack the device, install malware, keylogger, or spyware to spy on the user’s activity in an attempt to steal critical data or personal information.
6. MitM (Man-in-the-Middle) Attack
This is the most common attack and it is performed through public Wi-Fi. The attacker inserts themselves between the public Wi-Fi AP and the visitor’s device and starts intercepting a two-party communication or a transaction. From there, cyber-attackers can steal the password credential and other sensitive information, or potentially manipulate data by intercepting traffic.
7. Session
Hijacking In this attack, the attacker takes over a session between a client and the server, this leads to the victim losing access to their social media accounts.
8. Password Attack
Because passwords are the most basic used mechanism to authenticate users to an information system, obtaining passwords is a common and effective approach to attack. Hacker uses sniffing, social engineering, and other techniques to get access to passwords, to a password database, or outright guessing. The last approach that can be done, in either a random or systematic manner, is brute-force and a dictionary attack.
9. Rootkits
Hackers install rootkits inside legitimate software, therefore, once the victims install this software on their system, it is activated and attackers can gain remote control or administration-level access over a system. Later, the attacker uses it to steal passwords, keys, or other credentials, and retrieve critical data.
10. Internet of Things (IoT) Attacks
Multiple research shows that a large percentage of organizations worldwide have experienced an IoT attack.
Attacks on IoT devices grow rapidly due to gaining popularity and since these devices are given low priority to embed security in their operating systems.
11. Denial-of-Service (DoS) Attack
In a DoS attack, attackers work by flooding traffic to systems, servers, or networks, and overload resources and bandwidth. As result, the server or system is unable to process legitimate requests. Another type of denial-of-service (DoS) attacks is distributed denial-of-service (DDoS) attacks.
12. SQL Injections
In this attack, an attacker inserts malicious code into a server using a server query language (SQL) forcing the server to deliver protected information. This happens on unprotected or less secure websites.
13. Zero-Day Exploit
A Zero-day Exploit refers to exploiting an unknown vulnerability in an application, system, network, etc. It also refers to exploiting a new and recently announced vulnerability prior to any patch being released or implemented.
14. Cross-Site Scripting
A cross-site scripting attack sends malicious scripts into content from reliable websites (unprotected or less protected). The malicious code serves with the dynamic content to the victim’s browser. Usually, this malicious code may have JavaScript code executed in the victim’s browser but can include Flash, HTML, and XSS.
Facts about Cyber-attacks:
- Botnets are responsible for 31% of all cyber-attacks targeting corporate networks.
- Education and Research was the most targeted sector, which are facing an average of 1,605 weekly attacks.
- The malicious file type EXE is making up 52%, PDF comprising 20%, and DOCs in 5% of all malicious files.
- Over 84% of all cyber-attacks were distributed via e-mail in 2021.
- Cybercriminals can penetrate 93% of company networks.
- Cyber-attacks are up 50% in 2021 in comparison to 2020, peaking in December, largely due to Log4j exploitations.
- Software supply chain attacks have increased by 650%, in 2021.
- The healthcare industry has seen a 51% increase in breaches and leaks since 2019. Furthermore, 70% of surveyed organizations reported healthcare ransomware attacks.
- By 2025, cryptocurrency crime is predicted to surpass $30 billion, up from $17.5 billion in 2021 according to Cybersecurity Ventures.
- In a recent phishing attack, $7 million in NFTs were stolen from OpenSea users.
- In 2021, organizations experienced the highest average cost of a data breach in 17 years at $4.24 million, rising from $3.86 million the previous year.
- Mobile apps are responsible for 80% of mobile fraud.
Can ethical hacking protect you from cyber-attacks?
Ethical hacking not only protects you from cyber-attacks but also combats the hacker. Hacking is a bunch of skills, methods, and techniques used by a hacker to commit a cyber-attack.
Ethical hacking is the process of hacking in an ethical way, the persons who are involved in this process are called ethical hackers.
Ethical hackers are responsible to:
- Test a system, application, or network for security vulnerabilities to evaluate its performance.
- Test the security of the system and find any weakness they suggest ways to improve it.
- Perform regular pen testing, which helps to improve the security of the system, web app, and network.
- After identifying vulnerabilities in the system, they should create reports and provide feedback after the issue has been resolved.
- Inform the organization of the possible effects on its operations and users.
- Use hacking as a technique to find solutions for the system’s exploiting points.
Essential steps to protect yourself from cyber-attacks:
- Install anti-virus and anti-malware software on your devices (PC, mobile).
- You must set up a strong password (combination of number, small and capital letters, symbols, and numbers), gesture, or fingerprint.
- Avoid using most commands and basic passwords. Use different passwords for different websites.
- Always hide or switch off Bluetooth when not in use and disable automatic connection to networks.
- Do not open emails from unknown sources (email addresses) and avoid risky clicks.
