Understanding Cyber Threats

What is a Threat?

• A threat refers to a possible undesirable occurrence which can eventually inflict harm and disrupt the operational as well as functional tasks of a firm.
• Cyber threats help attackers break into systems and pilfer data including personal details, financial data and sign-in information.

Examples of Threats

• An attacker might try to steal sensitive data belonging to an organization.
• A server could be forced to shut down by attackers.
• Attackers can try to trick staff into revealing private details.
• An attacker could unleash malware on a system.
• An attacker may assume an authorized person's identity to access a system.
• An attacker could alter information travelling through a network, or tamper with it.
• An attacker could alter data on a database server from a remote location.
• An attacker could conduct URL redirection, or URL forwarding.
• An attacker executing privilege elevation for unauthorized access.
• An attacker may launch denial-of-service (DoS) attacks with the aim of rendering resources inaccessible.
• An attacker can listen in on unauthorized communication channels.

Threat Sources

• Threat sources can be natural, unintentional, or intentional.

Natural Threats

• Natural factors such as fires, floods, power outages, lightning, meteors and earthquakes are potential threats to the assets of an organization.
• These natural threats may trigger severe physical harm to computer systems.

Unintentional Threats

• Unintentional errors within an organization have the potential to become threats.
• Insider-originating security breaches and operator error, unskilled administrators or lazy staff, negligence, and accidents can be examples of unintentional threats.

Intentional Threats

• Most computer and Internet-related crimes are insiders or internal attacks.
• These dangers are posed intentionally or unintentionally by internal parties like disgruntled or negligent staff, which impact the organization.
• Privileged users of the network carry out the most of these attacks.

External Threats

• External attacks happen by making use of flaws present in a system without the support of staff members.
• The capability to perform an external attack varies based on the gravity of the detected network flaws.

Structured External Threats

• Structured external threats are carried out by proficient attackers using various tools for gaining access into networks while wanting to break services.
• Motivations include criminal payoffs, racism, politics, inciting terrorism.
• Distributed ICMP floods and performing spoofing & executing attacks from different sources all at once are examples of such attacks.

Unstructured External Threats

• Unstructured external threats are carried out by unskilled script kiddies who may want to become hackers.
• Untrained attacker make use of free online tools to target network attacks as well as cause a website or other public domain online to crash.
• Security measures such as port scanning and address sweeping utilities can easily eliminate this type of threat.

Threat Actors/Agents

• Black hats, white hats, gray hats, suicide hackers, and script kiddies are types of threat actors/agents.

Black Hats

• Black hats use extraordinary computing skills for carrying out illegal acts or with malicious intent.
• They are often involved in criminal activities.
• Black hats are also referred to as crackers.

White Hats

• White hats or penetration testers utilize their hacking skills for defensive reasons.
• Nowadays, almost all firms hire security analysts who possess expertise in counter measures against hacking, to secure their networks.
• They have consent from system owners.

Gray Hats

• Individuals possessing varied experience and expertise that may work offensively and defensively but at any time could have their own agenda.
• Gray hats may assist hackers detect system vulnerabilities and at the same time assist vendors enhance their products through checking limitations and making them more secure.

Suicide Hackers

• Suicide hackers aim to degrade vital infrastructure due to some cause, and not afraid of facing punishment.
• Suicide hackers are similar to suicide bombers that sacrifice their life for an attack and not concerned with the consequences of their actions.

Script Kiddies

• Script kiddies, not formally educated or trained, make use of tools and scripts to infiltrate a system due to lack of ability.
• Their main goal is to gain popularity or prove their own technical skills and not concerned with the quantity, or quality the attack.
• Other categories of threat actors/agents include cyber terrorists, state-sponsored hackers, industrial spies, insiders, hacker teams, criminal syndicates, and hacktivists.

Cyber Terrorists

• Motivated by religious or political beliefs, cyber terrorists have a wide array of skills and create fear through large-scale disruption of computer networks.

State-sponsored hackers

• Skilled individuals employed or contracted by the government to infiltrate, acquire top-secret information and harm other government information systems.
• A state-sponsored hacker's main goal is to spot flaws and exploit a nation's infrastructure and gather sensitive information.

Industrial Spies

• Industrial spies are individuals that perform corporate espionage through illegally spying on competitors stealing critical information like formulas and trade secrets.
• These threat actors utilize advanced persistent threats (APTs) for penetrating networks where they are able to can remain undetected for prolonged time periods.
• Social engineering is used at times to steal information such as marketing strategies, which leads to devastating financial losses for a targeted business.

Insiders

• An insider is any employee with access to an organization’s critical assets with privileged authorization to be there.
• An insider threat happens from the use of privileged access that intentionally result in harm or violate the regulation system.
• Disgruntled staff members can cause potential insider threats.

Hacker Teams

• A team or group of skilled hackers having their own resources for synergy while researching state-of-the-art technologies.
• Hacker teams also identify system flaws, develop advanced tools and implement the attacks accordingly.

Criminal Syndicates

• Groups or any community who intentionally perform illegal embezzlement with organized planning and cyber attacks.
• The most important goal of criminal syndicates is to generate income using complicated cyber-attacks and perform money laundering.

Hacktivist

• In the form of activism, hacktivists infiltrate computer systems for government organizations or corporate entities as an act to demonstrate social or political awareness.
• Their objective is to deface, and disable websites, and promote a political agenda.
• Gaining unauthorized access from government agencies by hacking is an example of when information hacktivists disclose information to the public.

Organized Hackers

• A group of hackers implementing hierarchical strategies that have an efficient plan organized.
• Organized hackers perform cyber attacks that will ultimately pilfer finances from victims while swindling trade secrets also covertly penetrating target locations without being discovered or detected for a lot longer.

Attributes of Threat Actors

• Internal, external, level of sophistication, resources or funding, and intent or motivation are several attributes of threat actors.

Internal Attributes

• Internal threat actors are usually trusted insiders with authorized permission to access resources.

External Attributes

• External threat groups have no authorization to directly engage network assets.

Level of sophistication

• Threat actors possess high levels of intelligence with sophisticated attacks that target less-sophisticated targets.

Resources or funding

• Identifies how a threat actor can financially support or execute attack with required software/equipment.

Intent/motivation

• Highly motivated actors will possibly launch attacks connected to their goals and objectives.
• A threat vector is a path or route an attacker uses to gain access or compromise a system.
• Direct access, removable media, wireless, email, cloud, ransomware, supply chain, and business partners are examples of threat vectors.

Via Direct Access

• An attacker obtains immediate and physical access to the systems with various types of software such as keyloggers being directly downloaded.

Via Removable Media

• Devices like USB drives & printers being plugged inside organizations may contain malware that may automatically run, steal, copy or corrupt.

Via Wireless

• An intruder may also crack wireless network security to exploit login identifications while also spoof them in gaining access.

Via E-mail

• Attackers trick user to disclose information within system and also to infect the system through attachments.

Via Cloud

• Attackers are able to inject malware into cloud systems as well to get access to user information, using virtualization while deceiving users. Therefore, cloud services/data become exploited using weak credentials.

Via Ransomware/Malware

• When targeting security flaws in computer softwares ransomware attacks can happen, therefore file-less malware is launched to cause further infiltration.

Via Supply Chain

• Attackers target vulnerabilities found in third party sellers through the vendor.

Via Business Partners

• Attackers access customer data using supply-chain attacks that can impact an organization.

Introduction to Malware

• Malware is malicious software that damages or disables computers or gives the Malware creator full control to commit fraud.
• Malware programs develop and use malware to track visited websites or slow down system performances.

Ways for Malware to Enter System

• Malware can enter an IT system via applications messengers, downloads from internet, portable hardware devices, Email Attachments and wireless networks.

Autorun.inf file

• Autorun.ini file is used to turn off Autoplay on windows 10 and mitigate infection

Common techniques attackers use to distribute malware on the web

• Drive-by downloads, social engineering, spam are all techniques used to commit black hat Search Engine Optimizations SEO.

Components of Malware

• Crypter, Downloader, Dropper, Exploit, Injector, Obfuscator, Packer Payload are different components of malware.

Crypter Component

• Used by attacker to evade detection and protect the malware.

Downloader Component

• Used to download other malware after first initial access has been gained.

Dropper Component

• Attackers embed other files inside a dropper.

Exploit Component

• Used by attacker gain access to a system or device by breaching system's security vulnerabilities.

Injector Component

• Used to inject exploits and available codes into malware, and other such methods.

Obfuscator Component

• Concelaing malicious codes of malware creating difficulties in detective measures.

Packer Component

• Technique compresses the malware file to convert code and data into unreadable format.

Payload Component

• Part of malware that causes to compromise system security.

Types of Malware

• Trojans, viruses, ransomware and fileless malware are examples of malware.

What is a Trojan?

• Trojans get activated when a user performs certain actions.
• Trojans create a covert communication channel between a computer victim and the attacker for transferring data.

Indications of what happens when a Trojan is Attacking

• Computer starts acting erratically.

Types of Trojans

• Remote Access Trojans, backdoors, botnets, rootkits, E-Banking Trojans, point of sale Trojans and Service Protocol Trojans.

Remote Access Trojans

• Remote Access Trojan can take full control of victim system.

Backdoor Trojans

• Backdoor programs pass standard authentication which provides backdoor access at any time.

Botnet Trojans

• Infect large number of computers and can get control via control center.

Rootkit Trojans

• Rootkit Trojans give full control on root device to attacker.

E-Banking Trojans

• Steal account information, used for online banking

Point-Of-Sale Trojans

• Attacks POS and payment equipment such as credit card/debit card readers to grab sensitive data.

Service Protocol Trojans

• Trojans can take advantage of service protocols such as HTTP to attack.

Creating a Trojan

• Trojan horse construction kits help attackers to construct them, however are dangerous and if not coded write can backfire.

Virus

• Virus infect other programs and transform their self.

Purpose of Creating Viruses

• Causes harm on those attempting conduct and develop virus.

Indications of Attacking Virus

• Processes require resources and time by constant alerts causing constant antivirus issues.

Stages of Virus Lifecycle

• Design, replication Launch where activated, incorporate defenses, eliminate threats.
• Different types of virus exist including system or boot record, e-mail and armored.

Encrypted Virus

• Virus penetrates target system.

Polymorphic Virus

• Virus infect file will change how it replicates with different codes.

Shell Virus

• Consist of routine with host code as the source routine

Where they come from and are detected

• Viruses can be contracted by accepting infected files via email, freeware, or shareware.

Logic Bomb Virus

• If a bomb is programmed to execute on a specific date, it is referred to as a time bomb.

Web Scripting Virus

• Allows client side into web page code

How to create virus?

• Virus creates a batch file and also by using virus maker to customize it.

Characteristics of Ransomware

• A malware that holds a user system and its file hostage for ransom.

Computer Worms

• Programs replicated within the network connections to spread the payloads for installation.

Bot Command + Control

• Uses zombie commands to make other vulnerable systems.

Differnce from viruses?

• worms are specific from malware viruses attach to programs

Why Attackers Use a Botnet

• Botnets are used for malware and password/information theft.

How to build bots?

• Use to build botting applications that cause system paralysis

Fileless malware

• Infecting software, and protocols perform duties and vulnerability.

Reason for it it's attack and usage

• Stealth, system tool and easy run to attack.

Fileless Propagation?

• Memory Injection through Window Registry, and by using email in documents.

What is vulnerability?

• An existence from weakness that can be access by agents.

Common reason for existence includes

• Misconfiguration for Software to access security loopholes.
• Poor design of a networks where no technology is used for secure implementation.
• Vulnerbility exists due to weakness of protocols such HTTP.

End User Carlessness

• Affects network security with serious outcomes and data loss.

Intentional End User Actions

• Heavy data that has financial losses that leads to the company, called and end act.

Classifications of vulnerabilities

• Misconfigurations and Weak configurations. Can break into a network by the network configuration.

Misconfiguration is the most common vulnerability

• Allows attackers to break into the system and systems.

Host Misconfigurations

• Open Permissions/Unsecured Accounts.

Default configurations

• It enables a guesser to settings to break code.

Applications and security issues

• Application errors are for exploits configuration settings to the stores for exploits to configuration stores.