Cybersecurity Chapter 3: Threats and Attacks

Chapter 3: Cybersecurity Threats, Vulnerabilities, and Attacks

• Cybersecurity threats, vulnerabilities, and attacks are the central focus of cybersecurity specialists.
• The chapter covers various cyberattacks launched by cybercriminals.
• Malware and malicious code threats are explained.
• Deception techniques, including social engineering, are discussed.
• The chapter details attacks on wired and wireless networks.
• Application vulnerabilities are also explored.
• Understanding these threats helps organizations identify vulnerabilities and develop defenses against attacks.

3.1 Malware and Malicious Code

• Cybercriminals use malware to target user devices.
• Viruses are malicious executable code attached to legitimate programs.
• Worms are malicious code that replicates independently.
• Trojan horses are malware that masquerade as legitimate programs.
• Logic bombs are malicious programs triggered by specific events.
• Ransomware holds computer systems or data captive demanding payment.
• Backdoors and rootkits are malicious programs that bypass normal security.

3.2 Deception

• Social engineering is a non-technical method to gather information.
• Social engineers manipulate individuals for actions or disclosures.
• Pretexting involves creating false scenarios to extract information.
• Quid pro quo involves requesting information in exchange for something.
• Shoulder surfing and dumpster diving involve observing or accessing discarded information.
• Impersonation is pretending to be someone else to gain access.
• HOAX messages are false or misleading information.
• Piggybacking and tailgating involves following authorized people to gain access.
• Online, emails, and web-based trickery involves deceiving users online.

3.3 Attacks

• Denial-of-Service (DoS) attacks interrupt network services.
• Sniffing involves eavesdropping on network traffic.
• Spoofing involves impersonation to trick systems into trusting false identities.
• Man-in-the-middle (MitM) attacks intercept communications to steal information or manipulate messages.
• Zero-day attacks exploit software vulnerabilities unknown to vendors.
• Keyboard logging records keystrokes to steal sensitive information.
• Grayware are applications that behave undesirably.
• SMiShing involves using SMS messages for phishing attacks.
• Rogue access points are unauthorized wireless access points.
• RF jamming interrupts transmissions

3.4 Chapter Summary

• Cybersecurity threats, vulnerabilities, and attacks are crucial aspects of cybersecurity.
• Types of attacks, vulnerabilities, and deceptive techniques are covered.
• Understanding the threats and vulnerabilities is crucial for network defenses.

Email and Browser Attacks

• Email is a major vulnerability for users and organizations
• Spam is unsolicited email often used for advertising.
• Spyware tracks user activity and collects information.
• Adware displays pop-up advertisements.
• Scareware tricks users into action through fear-based pop-ups.
• Phishing is a form of fraud, used to obtain user credentials.
• Spear phishing targets specific individuals.
• Vishing uses voice communication for phishing.
• Pharming impersonates legitimate websites.
• Whaling targets high-profile individuals.
• Plugins such as Flash and Shockwave can be used for malicious activities
• SEO poisoning uses SEO techniques to make malicious websites more visible.
• Browser hijackers redirect users to malicious sites.

Wireless and Mobile Attacks

• Grayware includes applications acting undesirably.
• SMiShing is SMS phishing through fake text messages.
• Rogue access points are unauthorized wireless access points.
• RF jamming interrupts wireless signals.
• Bluejacking sends unauthorized messages via Bluetooth.
• Bluesnarfing copies information from a Bluetooth device.
• Authentication and encryption settings should be changed from default.
• Wireless devices should be placed outside the firewall or DMZ.
• Tools exist to help find rogue points.
• Guest network policies are important.

Application Attacks

• Cross-site scripting (XSS) allows injecting malicious scripts into web pages.
• Code injection involves using vulnerabilities in databases to perform malicious actions
• Buffer overflows exploit memory vulnerabilities in applications.
• Remote code execution attacks allow executing malicious commands.
• ActiveX controls have the potential to install malicious code.
• Java controls, through their JVM interpreter, can be vulnerable.
• Keeping software up-to-date and writing good code are essential protections.