Each year records more cybercrime than the previous, as attackers develop more sophisticated and efficient ways of exploiting your devices. Cyber-attacks occur due to a wide range of reasons, and in many different ways. However, the general idea, for most cybercriminals is for them to look for exploits, things that they can take advantage of, whether it be in a company’s security practices, policies or technology.
So what is a cyber-attack?
To put it simply, a cyberattack is when a computer hacker attempts to gain unauthorised access to a system, for the sole purpose of extortion, theft, disruption or some other illegal reason.
When we look at security incidents, we find that a large amount of them are actually caused by insiders – whether due to malice or negligence. However, for the sake of this conversation, we’re going to assume that the cyberattack is being carried out by an individual who was never a part of the organisation that they are looking to attack.
While there are many different methods that a hacker can use to gain unauthorised access to a system, for the vast majority of cybercriminals, they prefer to use the same tried and tested methods. Below you will find the most common of these cyberattack types.
1. Man-In-The-Middle Attack (MITM)
A man-in-the-middle attack (MITM) occurs when a computer hacker intercepts the communications of two or more parties, for the sole purpose of either spying, stealing credentials or personal information, or to gain some kind of influence over the conversation itself.
MITM attacks are not so common nowadays, because most instant messaging systems and email providers use some kind of end-to-end encryption, which makes it impossible for third-parties to tamper with the data that is being sent across the internet, irrespective of whether it’s being transmitted over a secure network or not.
2. Phishing Attacks
Phishing attacks occur when a computer hacker sends out emails that are disguised to look like legitimate emails from, maybe a bank or some other financial institution. They do this, so they can trick the victim into giving up sensitive information. Phishing attacks work by combining both technology and social engineering and work by “fishing” for access to sensitive data by using “bait” or what appears to be a trustworthy sender.
In order for the attack to work, the cybercriminal must send a link to the victim, in an email, which sends them to a website that tricks him/her into downloading a virus or some other malicious file or giving the cybercriminal sensitive financial data. In a lot of cases, the victim is totally oblivious to the fact that they have been compromised, which in turn allows the cybercriminal to try the same attack method on other unsuspecting victims within the same organisation.
The most effective way of preventing phishing attacks is by having the knowledge. You can prevent an attack simply by being careful of what emails to open, and which links to click on. Pay great attention to the headings of the emails, and never click on anything you’re unfamiliar with. Look at the return-path and reply-to parameters of the email. If anything looks odd, like they go to different domains, then that’s a positive sign.
3. DNS Spoofing
When it comes to Domain Name System (DNS) spoofing, this entails a cybercriminal changing the DNS records so that data is sent to a spoofed or fake website. Once the victim reaches the fraudulent website, they may then enter confidential information that can be sold or used by the cybercriminal. Some hackers may also go as far as to create a poorly looking site, which contains inflammatory or derogatory information, to make a competitor site look bad.
DNS spoofing attacks work, because the cybercriminal is able to take advantage of the fact that the victim is none the wiser, believing that they are visiting a legitimate site. This allows the cybercriminals to carry out their nefarious activities in the name of a legitimate company, at least, that’s how it may appear to the victim.
You can prevent DNS spoofing attacks by making sure that your DNS servers are all up-to-date. A cybercriminal is looking to exploit vulnerabilities that exist within a DNS server, this is why it’s so important the latest patches and updates are installed, as they typically contain fixes for the latest known vulnerabilities.
4. Drive-by Attack
Drive-by download attacks are amongst the most common ways of spreading viruses. A cybercriminal will seek out insecure websites, to plant a malicious script into it, using PHP or HTTP code, on one of the sites pages. This script may be designed to install a small piece of malware onto systems that visit the site, or it could implement a redirect, that sends the victim to the cybercriminals website. Drive-by downloads occur when viewing an email message, visiting a website or during a pop-up window. Unlike the other kinds of attacks a victim may fall prey to, when it comes to drive-by attacks, they don’t actually need the user to do anything specific in order for them to be enabled. So, you don’t have to open a malicious email attachment or click on a download button for your system to be infected. A drive-by download is capable of taking advantage of a web browser, operating system or app that has security vulnerabilities, either due to lack of updates or unsuccessful updates.
You can protect yourself from these kinds of attacks by keeping both your operating system and its browsers up to date, while avoiding websites from bad neighbourhoods. Stick to sites that you’re familiar with, although know that, they too, can also be hacked. Also, be sure to remove any programs or apps that you do not use anymore. You also don’t want to have too many plug-ins on your browsers, as this creates more vulnerabilities that a hacker can potentially use to exploit your system.
5. Crypto-jacking
Crypto-jacking is when a cybercriminal compromises a victims system or other device, and uses it to mine for cryptocurrency, like Bitcoin. Unlike other attack vectors, crypto-jacking isn’t as well known. But that doesn’t mean you shouldn’t be cautious about it.
When an organisation falls victim to this kind of attack, it’s very difficult for them to spot it. Which means, cybercriminals could be, for some time, using a significant amount of a networks resources, to mine for their Bitcoin, without the organisation knowing anything about it.
Of course, when we compare bleeding a company’s resources to stealing confidential data, the theft of data is definitely more problematic.
—AUTHOR INFO—
Uchenna Ani-Okoye is a former IT Manager who now runs his own computer support website https://www.compuchenna.co.uk.
