HEADQUARTERS

ACADEMIC GROUP, PHILIPPINE MILITARY ACADEMY

Department of Information Technology
Fort General Gregorio H del Pilar, Baguio City

CYBERSECURITY 1 HANDOUT
UNIT II: THREATS, VULNERABILITIES, AND ATTACKS

COMMON THREATS
Definition of Terms
• Security vulnerabilities - any kind of software or hardware defect
• Exploit - a term used to describe a program written to take advantage of a known vulnerability •
Attack - the act of using an exploit against a vulnerability
– Goal: to gain access to a system, the data it hosts or to a specific resource.
• Cyber Threat – an activity intended to compromise the security of an information system by altering the
availability, integrity, or confidentiality of a system or the information it contains, or to disrupt digital life in
general.

Threat Domains
With organizations facing an ever-growing number of cyber threats, it is critical that they have robust security
solutions in place. But in order to protect themselves, organizations first need to know what vulnerabilities exist
within their threat domains. A ‘threat domain’ is considered to be an area of control, authority or protection that
attackers can exploit to gain access to a system.
There are many ways that attackers can uncover vulnerabilities and exploit systems within a
domain. Attackers can exploit systems within a domain through:

• Direct, physical access to systems and networks.

• Wireless networking that extends beyond an organization’s boundaries.
• Bluetooth or near-field communication (NFC) devices.
• Malicious email attachments.
• Less secure elements within an organization’s supply chain.
• An organization’s social media accounts.
• Removable media such as flash drives.
• Cloud-based applications.

Types of Cyber Threats

Cyber threats can be classified into different categories. This allows organizations to assess the likelihood of a
threat occurring and understand the monetary impact of a threat so that they can prioritize their security efforts.
• Software attacks (ex: a successful denial-of-service (DoS attack), a computer virus) • Software errors (ex: A
software bug, an application going offline, a cross-site script or an illegal file server share)
• Sabotage (ex: a backdoor, or a worm that erases files, an authorized user successfully penetrating and
compromising an organization’s primary database)
• Human error (ex: inadvertent data entry errors, an employee dropping a laptop computer) •
Theft (laptops or equipment being stolen from an unlocked room)
• Hardware failures (ex: a hard drive crashes, a firewall misconfiguration)
• Utility interruption (ex: electrical power outages, water damage resulting from sprinkler failure) •
Natural disasters (ex: severe storms such as hurricanes or tornados, earthquakes, floods, fires)

Cyber Criminals
 Page 1 of 11
Cyber Criminals - Individuals or teams of people who use technology to commit malicious activities on digital
systems or networks with the intention of stealing sensitive company information or personal data, and
generating profit.
Threats can originate from both within and outside of an organization, with attackers seeking access to
valuable sensitive information such as personnel records, intellectual property and financial data. Internal
threats are usually carried out by current or former employees and other contract partners who accidentally
or intentionally mishandle confidential data or threaten the operations of servers or network infrastructure
devices by connecting infected media or by accessing malicious emails or websites. The source of an
external threat typically stems from amateur or or skilled attackers who can exploit vulnerabilities in
networked devices or can use social engineering techniques, such as trickery, to gain access to an
organization’s internal resources.

Amateurs – aka script kiddies

- have little or no skills, often using existing tools or instructions found on the Internet to launch attacks
Hackers – break into computers or networks to gain access for various reasons

Classification of Hackers:
White Hat Attackers – break into networks or computer systems to discover weaknesses in order to improve the
security of these systems. Owners of the system give permission to perform the break-in, and they receive the
results of the test.
Black Hat Attackers – take advantage of any vulnerability for illegal personal, financial or political gain. Gray
Hat attackers – somewhere between white and black hat attackers. May find a vulnerability and report it to the
owners of the system if that action coincides with their agenda. Some publish the facts about the vulnerability
on the Internet, so that other attackers can exploit it

Organized hackers – include organizations of cyber criminals, hacktivists, terrorists, and state-sponsored
hackers.
– Usually group of professional criminals focused on control, power, and wealth.
– Highly sophisticated and organized, and may even provide cybercrime as a service

Hacktivists – make political statements to create awareness of issues that are important to them.
– Publicly publish embarrassing information about their victims

State-sponsored attackers - gather intelligence or commit sabotage on behalf of their government. These
attackers are usually highly trained and well-funded. Some are even members of their nations; armed forces.

Cyber Criminal Motives

• 60’s: phone freaking (phreaking) - refers to various audio frequencies to manipulate phone systems •
80’s: criminals used computer dial-up modems to connect computers to networks and used password
cracking programs to gain access to data
• Nowadays: criminals use malware and viruses as high tech weapons
❖ Greatest Motivation for Cyber Criminals: Financial

User Threats and Vulnerabilities

Cyber threats can spread in various ways such as through users themselves, via devices connected to the
network or via services hosted on a public or private cloud.
A user domain includes anyone with access to an organization’s information system, including employees,
customers and contract partners. Users are often considered to be the weakest link in information security
systems, posing a significant threat to the confidentiality, integrity and availability of an organization’s data.

The following are the most common user threats found in many organizations: No awareness of
security: Users must be aware of and understand an organization’s sensitive data, security policies and
procedures, technologies and countermeasures that are implemented in order to protect information and
information systems.
Poorly enforced security policies: All users must be aware of and understand an organization’s security
policies, as well as the consequences of non-compliance.
Data theft: Data stolen by users can pose a significant financial threat to organizations, both in terms of the
resulting damage to their reputation and/or the legal liability associated with the disclosure of sensitive
information.
Unauthorized downloads and media:Many network and device infections and attacks can be traced back to
users who have downloaded unauthorized emails, photos, music, games, apps and videos to their computers,
networks or storage devices, or used unauthorized media such as external hard disks and USB drives.
Unauthorized virtual private networks (VPNs) : VPNs can hide the theft of unauthorized information because
the encryption normally used to protect confidentiality can stop a network administrator from tracking data
transmission (unless they have permission to do so).

Page 2 of 11
Unauthorized websites: Accessing unauthorized websites can pose a risk to a user’s data and devices, as
well as the organization itself. Often, these websites prompt users to download scripts or plugins that contain
malicious code or adware. Some of these sites can even take over user devices like cameras and applications.
Destruction of systems, applications or data: The accidental or deliberate destruction or sabotage of
systems, applications and data poses a serious risk to all organizations. Activists, disgruntled employees or
industry competitors attempt to delete data and destroy or misconfigure devices, to make organizational data
and information systems unavailable.
Always keep in mind that there are no technical solutions, controls or countermeasures that will make
information systems any more secure than the behaviors and processes of the people who use these systems.

Threats to Devices
• Any devices left powered on and unattended pose the risk of someone gaining unauthorized access to
network resources.
• Downloading files, photos, music or videos from unreliable sources could lead to the execution of
malicious code on devices.
• Cybercriminals often exploit security vulnerabilities within software installed on an organization’s devices
to launch an attack.
• An organization’s information security teams must try to keep up to date with the daily discovery of new
viruses, worms and other malware that pose a threat to their devices.
• Users who insert unauthorized USB drives, CDs or DVDs run the risk of introducing malware, or
compromising data stored on their device.
• Policies are in place to protect an organization’s IT infrastructure. A user can face serious consequences
for purposefully violating such policies.
• Using outdated hardware or software makes an organization’s systems and data more vulnerable to
attack.

Threats to the Local Area Network

• Unauthorized access to wiring closets, data centers, and computer rooms
• Unauthorized access to systems, applications, and data.
• Network operating system or software vulnerabilities and updates.
• Rogue users gaining unauthorized access to wireless networks.
• Exploits of data in transit.
• Having LAN servers with different hardware or operating systems makes managing and troubleshooting
them more difficult.
• Unauthorized network probing and port scanning.
• Misconfigured firewalls.

Threats to the Private Cloud

The private cloud domain includes any private servers, resources and IT infrastructure available to members
of a single organization via the Internet.
While many organizations feel that their data is safer in a private cloud, this domain still poses significant
security threats, including:
• Unauthorized network probing and port scanning.
• Unauthorized access to resources.
• Router, firewall or network device operating system or software vulnerabilities.
• Router, firewall or network device configuration errors.
• Remote users accessing an organization’s infrastructure and downloading sensitive data.
Threats to the Public Cloud
• public cloud domain is the entirety of computing services hosted by a cloud, service or Internet provider
that are available to the public and shared across organizations
While public cloud service providers do implement security controls to protect the cloud environment,
organizations are responsible for protecting their own resources on the cloud. Therefore, some of the most
common threats to the public cloud domain include:
• Data breaches.
• Loss or theft of intellectual property.
• Compromised credentials or account hijacking.
• Social engineering attacks.
• Compliance violation.

Threats to Applications
The application domain includes all of the critical systems, applications and data used by an organization to
support operations. Increasingly, organizations are moving applications such as email, security monitoring and
database management to the public cloud.
Common threats to applications include:
• Someone gaining unauthorized access to data centers, computer rooms, wiring closets or systems. •
Server downtime during maintenance periods.
Page 3 of 11
• Network operating system software vulnerabilities.
• Data loss.
• Client-server or web application development vulnerabilities.

Threat Complexity
Software vulnerabilities occur as a result of programming mistakes, protocol vulnerabilities or system
misconfigurations. Cybercriminals seek to take advantage of such vulnerabilities and are becoming increasingly
sophisticated in their attack methods.

Attack Methods
• Advanced Persistent Threat (APT) is a continuous attack that uses elaborate espionage tactics
involving multiple actors and/or sophisticated malware to gain access to and analyze a target’s network •
Algorithm Attacks take advantage of algorithms in a piece of legitimate software to generate unintended
behaviors
• Backdoor programs – used by cybercriminals to gain unauthorized access to a system by bypassing the
normal authentication procedures
• Rootkit – malware designed to modify the operating system to create a backdoor, which attackers can
then use to access the computer remotely

Threat Intelligence and Research Sources

Many organizations rely on threat intelligence data to help them understand their overall risk, so that they can
formulate and put in place effective preventative and response measures.
Some of this data is closed source and requires a paid subscription for access. Other data is considered open
source intelligence (OSINT) and can be accessed from publicly available information sources. In fact, sharing
threat intelligence data is becoming more popular, with governments, universities, healthcare sector
organizations and private businesses working together to improve everyone’s security.
Common Vulnerabilities and exposures (CVE) – a dictionary sponsored by The United States Computer
Emergency Readiness Team (US-CERT) and the U.S. Department of Homeland Security Each CVE entry
contains a standard identifier number, a brief description of the security vulnerability and any important
references to related vulnerability reports
The CVE list is maintained by a not-for-profit, the MITRE Corporation, on its public website.

Some other threat intelligence sources:

The dark web - refers to encrypted web content that is not indexed by conventional search engines and
requires specific software, authorization or configurations to access
Indicator of compromise (IOC) - such as malware signatures or domain names provide evidence of security
breaches and details about them
Automated Indicator Sharing (AIS) - a Cybersecurity and Infrastructure Security Agency (CISA) capability,
enables the real-time exchange of cybersecurity threat indicators using a standardized and structured language
called Structured Threat Information Expression (STIX) and Trusted Automated Exchange of Intelligence
Information (TAXII)
DECEPTION
Social engineering is a completely non-technical means for a criminal to gather information on a target. Social
engineering is an attack that attempts to manipulate individuals into performing actions or divulging confidential
information.
Social engineers often rely on people’s willingness to be helpful but also prey on people’s weaknesses.

These are some types of social engineering attacks:

Pretexting - This is when an attacker calls an individual and lies to them in an attempt to gain access to
privileged data. An example involves an attacker who pretends to need personal or financial data in order to
confirm the identity of the recipient.
Something for Something (Quid pro quo) - This is when an attacker requests personal information from a
party in exchange for something, like a gift.
Identity fraud - This is the use of a person’s stolen identity to obtain goods or services by deception. For
example, someone has acquired your data and is attempting to issue a credit card in your name.

Social Engineering Tactics

Authority – people are more likely to comply when instructed by “an authority”
Example: an executive opens an infected PDF that looks like an official subpoena
Intimidation – criminals bully a victim into taking action
Example: An executive’s secretary receives a call stating that her boss is about to give an important
presentation, but his files are corrupt. The cybercriminal asks for the files to be sent immediately to him.
Consensus/Social Proof – people will take action if they think that other people like it too Example:
Criminals create websites with fake testimonials that promote a product indicating that it is safe. Scarcity
– people will take action when they think there is a limited quantity
Page 4 of 11
Example: Criminals offer a limited opportunity that will not last hoping to spur the victim into taking action
quickly
Urgency – people will take action when they think there is a limited time
Example: Criminals establish a deadline for taking action based on a certain price
Familiarity/Liking – Criminals build a rapport with the victim to establish a relationship Example: People
are more likely to do what another person asks if they like that person Trust – Criminals build a trusting
relationship with a victim which may require more time to establish Example: A “security expert” calls the
victim offering advice and having the credentials to back it up. While helping the victim, the criminal
discovers a “serious error” that needs immediate attention. The solution provides the criminal with the
opportunity.

Deception methods
Shoulder Surfing and Dumpster Diving
Shoulder surfing is a simple attack that involves observing or literally looking over a target’s shoulder
to gain valuable information such as PINs, access codes or credit card details.
dumpster diving — the process of going through a target's trash to see what information has been
thrown out.
Impersonation and Hoaxes
Impersonation – the act of tricking someone into doing something they would not ordinarily do by
pretending to be someone else
Hoax – an act intended to deceive or trick someone, and can cause just as much disruption as an
actual security breach
Piggybacking and Tailgating - occurs when a criminal follows an authorized person to gain physical entry
into a secure location or a restricted area.
Criminals can achieve this by:
- Giving the appearance of being escorted into the facility by an authorized person. -
Joining and pretending to be part of a large crowd that enters the facility.
- Targeting an authorized person who is careless about the rules of the facility.
Invoice Scam
- Fake invoices are sent with the goal of receiving money from a victim by prompting them to put their
credentials into a fake login screen. The fake invoice may also include urgent or threatening language.
Watering Hole Attack – Describes an exploit in which an attacker observes or guesses what websites an
organization uses most often, and infects one or more of them with malware
Typosquatting
- This type of attack relies on common mistakes such as typos made by individuals when inputting a website
address into their browser. The incorrect URL will bring the individuals to a legitimate-looking website owned
by the attacker, whose goal is to gather their personal or financial information. Prepending
Attackers can remove the ‘external’ email tag used by organizations to warn the recipient that an email has
originated from an external source. This tricks individuals into believing that a malicious email was sent from
inside their organization.

Influence Campaigns
Often used in cyberwarfare, influence campaigns are usually very well coordinated and blend various methods
such as fake news, disinformation campaigns and social media posts.

Prevention Measures
• Never disclose confidential information or credentials via email, chat, text messages, in person or over
the phone to unknown parties.
• Resist the urge to click on enticing emails and web links.
• Be wary of uninitiated or automatic downloads.
• Establish and educate employees on key security policies.
• Encourage employees to take ownership of security issues.
• Do not give in to pressure by unknown individuals.

Page 5 of 11
CYBERATTACKS
Malwares
Malicious software, or malware, is a term used to describe software designed to disrupt computer operations,
or gain access to computer systems, without the user's knowledge or permission. Malware has become an
umbrella term used to describe all hostile or intrusive software. The term malware includes computer viruses,
worms, Trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. Malware
may be obvious and simple to identify or it can be very stealthy and almost impossible to detect.

Types of malware
Virus
A virus is malicious executable code attached to another executable file, such as a legitimate program. Most
viruses require end-user initiation, and can activate at a specific time or date. Computer viruses usually spread
in one of three ways: from removable media; from downloads off the Internet; and from email attachments.
Viruses can be harmless and simply display a picture or they can be destructive, such as those that modify or
delete data. In order to avoid detection, a virus mutates. The simple act of opening a file can trigger a virus. A
boot sector, or file system virus, infects USB flash drives and can spread to the system’s hard disk. Executing a
specific program can activate a program virus. Once the program virus is active, it will usually infect other
programs on the computer or other computers on the network. The Melissa Virus was an example of a virus
spread via email. Melissa affected tens of thousands of users and caused an estimated $1.2 billion in damage.

Worm
Worms are malicious code that replicates by independently exploiting vulnerabilities in networks. Worms usually
slow down networks. Whereas a virus requires a host program to run, worms can run by themselves. Other
than the initial infection, worms no longer require user participation. After a worm affects a host, it is able to
spread very quickly over the network. Worms share similar patterns. They all have an enabling vulnerability, a
way to propagate themselves, and they all contain a payload.
Worms are responsible for some of the most devastating attacks on the Internet. For example, in 2001, the
Code Red worm infected 658 servers. Within 19 hours, the worm infected over 300,000 servers.

Trojan horse
• malware that carries out malicious operations under the guise of a desired operation such as playing an
online game
• differs from a virus because the Trojan binds itself to non-executable files, such as image files, audio files,
or games.
Logic Bombs
A logic bomb is a malicious program that uses a trigger to awaken the malicious code. For example, triggers
can be dates, times, other programs running, or the deletion of a user account. The logic bomb remains
inactive until that trigger event happens. Once activated, a logic bomb implements a malicious code that
causes harm to a computer. A logic bomb can sabotage database records, erase files, and attack operating
systems or applications. Cybersecurity specialists recently discovered logic bombs that attack and destroy the
hardware components in a workstation or server including the cooling fans, CPU, memory, hard drives and
power supplies. The logic bomb overdrives these devices until they overheat or fail.

Ransomware
Ransomware holds a computer system, or the data it contains, captive until the target makes a payment.
Ransomware usually works by encrypting data in the computer with a key unknown to the user. The user must
pay a ransom to the criminals to remove the restriction.
Some other versions of ransomware can take advantage of specific system vulnerabilities to lock down the
system. Ransomware propagates as a Trojan horse and is the result of a downloaded file or some software
weakness.
Payment through an untraceable payment system is always the criminal’s goal. Once the victim pays, the
criminal supplies a program that decrypts the files or sends an unlock code.

Spyware
Spyware is software that enables a criminal to obtain information about a user’s computer activities. Spyware
often includes activity trackers, keystroke collection, and data capture. In an attempt to overcome security
measures, spyware often modifies security settings. Spyware often bundles itself with legitimate software or
with Trojan horses. Many shareware websites are full of spyware.

Adware
Adware typically displays annoying pop-ups to generate revenue for its authors. The malware may analyze user
interests by tracking the websites visited. It can then send pop-up advertising pertinent to those sites. Some
versions of software automatically install Adware. Some adware only delivers advertisements, but it is also
common for adware to come with spyware.

Page 6 of 11
Defending against all forms of malware
A few simple steps can help defend against all forms of malware:
Antivirus Program - The majority of antivirus suites catch most widespread forms of malware. However, cyber
criminals develop and deploy new threats on a daily basis. Therefore, the key to an effective antivirus solution is
to keep the signatures updated. A signature is like a fingerprint. It identifies the characteristics of a piece of
malicious code.
Up-to-Date Software - Many forms of malware achieve their objectives through exploitation of vulnerabilities in
software, both in the operating system and applications. Although operating system vulnerabilities were the
main source of problems, today’s application-level vulnerabilities pose the greatest risk. Unfortunately, while
operating system vendors are becoming more and more responsive to patching, most application vendors are
not.

Denial of service
• a type of network attack
• results in some sort of interruption of network services to users, devices, or applications

2 Major Types of DoS Attacks

Overwhelming Quantity of Traffic – The attacker sends an enormous quantity of data at a rate that the
network, host, or application cannot handle. This causes a slowdown in transmission or response, or a crash
of a device or service.
Maliciously Formatted Packets – The attacker sends a maliciously formatted packet to a host or application
and the receiver is unable to handle it. For example, an application cannot identify packets containing errors or
improperly formatted packets forwarded by the attacker. This causes the receiving device to run very slowly or
crash.
Goal of DOS Attack: to deny access to authorized users making the network
unavailable Distributed Dos Attack (DDoS)
• similar to a DoS attack, but it originates from multiple, coordinated sources.
Zombies – A threat actor builds a network of infected hosts. The zombie computers constantly scan and infect
more hosts, creating more zombies
How DDoS Happens
1. An attacker builds a network (botnet) of infected hosts called zombies, which are controlled by handler
systems.
2. The zombie computers constantly scan and infect more hosts, creating more and more zombies. 3.
When ready, the hacker will instruct the handler systems to make the botnet of zombies carry out a DDoS
attack.

Layer 2 attacks
Layer 2 refers to the data link layer in the Open Systems Interconnection (OSI) data communication model.
This layer is used to move data across a linked physical network. IP addresses are mapped to each physical
device address (also known as media access control (MAC) address) on the network, using a procedure called
address resolution protocol (ARP).
In its simplest terms, the MAC address identifies the intended receiver of an IP address sent over the network,
and ARP resolves IP addresses to MAC addresses for transmitting data.
Attackers often take advantage of vulnerabilities in this layer 2 security.

Spoofing
Spoofing, or poisoning, is a type of impersonation attack that takes advantage of a trusted relationship between
two systems.
Types of Spoofing Attacks:
MAC address spoofing occurs when an attacker disguises their device as a valid one on the network and can
therefore bypass the authentication process.
ARP spoofing sends spoofed ARP messages across a LAN. This links an attacker’s MAC address to the IP
address of an authorized device on the network.
IP spoofing sends IP packets from a spoofed source address in order to disguise it.

MAC Flooding
• Compromises the data transmitted to a device. An attacker floods the network with fake MAC addresses,
compromising the security of the network switch.

Man-in-the-Middle and Man-in-the-Mobile Attacks

Man-in-the-Middle (MitM) Attack
A MitM attack happens when a cybercriminal takes control of a device without the user’s knowledge. With this
level of access, an attacker can intercept, manipulate and relay false information between the sender and the
intended destination.

Man-in-the-Mobile (MitMo) Attack

• A variation of man-in-the-middle
Page 7 of 11
• A type of attack used to take control over a user’s mobile device
ZeuS is one example of a malware package with MitMo capabilities. It allows attackers to quietly capture two
step verification SMS messages sent to users.
Zero-Day Attacks
A zero-day attack or zero-day threat exploits software vulnerabilities before they become known or before they
are disclosed by the software vendor.
A network is extremely vulnerable to attack between the time an exploit is discovered (zero hour) and the time it
takes for the software vendor to develop and release a patch that fixes this exploit.
Defending against such fast-moving attacks requires network security professionals to adopt a more
sophisticated and holistic view of any network architecture.

Keyboard Logging
• refers to recording or logging every key struck on a computer’s keyboard
• Cybercriminals log keystrokes via software installed on a computer system or through hardware devices
that are physically attached to a computer, and configure the keylogger software to send the log file to
the criminal
• Many anti-spyware suites can detect and remove unauthorized key loggers.
Defending against attacks
Organizations can take several steps to defend against various attacks. These include the following: •
Configure firewalls to remove any packets from outside the network that have addresses indicating that
they originated from inside the network.
• Ensure patches and upgrades are current.
• Distribute the workload across server systems.
• Network devices use Internet Control Message Protocol (ICMP) packets to send error and control
 messages, such as whether or not a device can communicate with another on the network. To prevent
DoS and DDoS attacks, organizations can block external ICMP packets with their firewalls.

WIRELESS AND MOBILE DEVICE ATTACKS

Grayware
Grayware is becoming a problem area in mobile security with the popularity of smartphones. Grayware
includes applications that behave in an annoying or undesirable manner. Grayware may not have recognizable
malware concealed within, but it still may pose a risk to the user. For example, Grayware can track the user’s
location. The authors of grayware usually maintain legitimacy by including an application’s capabilities in the
small print of the software license agreement. Users install many mobile apps without really considering their
capabilities.

SMishing
SMiShing is short for SMS phishing. It uses Short Message Service (SMS) to send fake text messages. The
criminals trick the user into visiting a website or calling a phone number. Unsuspecting victims may then
provide sensitive information such as credit card information. Visiting a website might result in the user
unknowingly downloading malware that infects the device.
Rogue Access Point
• a wireless access point installed on a secure network without explicit authorization
can be set up in two ways:
• when a well-intentioned employee is trying to be helpful by making it easier to connect mobile
devices
• when a criminal gains physical access to an organization by sneaking in and installs the rogue
access point
• Also known as a criminal’s access point, the access point can be set up as a MitM device to capture
your login information
Evil Twin Attack: uses the criminal’s access point improved with higher power and higher gain antennas
to look like a better connection option for users
RF JAMMING
Wireless signals are susceptible to electromagnetic interference (EMI), radio-frequency interference (RFI), and
may even be susceptible to lightning strikes or noise from fluorescent lights. Wireless signals are also
susceptible to deliberate jamming. Radio frequency (RF) jamming disrupts the transmission of a radio or
satellite station so that the signal does not reach the receiving station.
Bluejacking and Bluesnarfing
Bluetooth - is a short-range, low-power protocol
- transmits data in a personal area network, or PAN, and can include devices such as mobile phones,
laptops, and printers
- uses pairing to establish the relationship between devices
Bluejacking - the term used for sending unauthorized messages to another Bluetooth device. A variation of
this is to send a shocking image to the other device.
Bluesnarfing - occurs when the attacker copies the victim's information from his device. This information can
include emails and contact lists.
Page 8 of 11
WEP and WPA Attacks
Wired Equivalent Privacy (WEP) is a security protocol that attempted to provide a wireless local area network
(WLAN) with the same level of security as a wired LAN. Since physical security measures help to protect a
wired LAN, WEP seeks to provide similar protection for data transmitted over the WLAN with encryption. WEP
uses a key for encryption. There is no provision for key management with WEP, so the number of people
sharing the key will continually grow. Since everyone is using the same key, the criminal has access to a large
amount of traffic for analytic attacks.
WEP also has several problems with its initialization vector (IV) which is one of the components of the
cryptographic system:
• It is a 24-bit field, which is too small.
• It is cleartext, which means it is readable.
• It is static so identical key streams will repeat on a busy network.
Wi-Fi Protected Access (WPA) and then WPA2 came out as improved protocols to replace WEP. WPA2 does
not have the same encryption problems because an attacker cannot recover the key by observing traffic.
WPA2 is susceptible to attack because cyber criminals can analyze the packets going between the access
point and a legitimate user. Cyber criminals use a packet sniffer and then run attacks offline on the
passphrase.
Defending Against Wireless and Mobile Device Attacks
• Take advantage of the basic wireless security features such as authentication and encryption by
 changing the default configuration settings.
• Restrict access point placement with the network by placing these devices outside the firewall or within a
demilitarized zone (DMZ) which contains other untrusted devices such as email and web servers. • Use
WLAN tools such as NetStumbler to detect rogue access points or unauthorized workstations. • Develop a
policy for guest access to an organization’s Wi-Fi network.
• Employees in an organization should use a remote access VPN for WLAN access.

OTHER ATTACKS
Application attacks
Cross-Site Scripting (XSS)
Cross-site scripting (XSS) is a common vulnerability found in many web applications. This is how it works: 1.
Cybercriminals exploit the XSS vulnerability by injecting scripts containing malicious code into a web page. 2.
The web page is accessed by the victim, and the malicious scripts unknowingly pass to their browser. 3. The
malicious script can access any cookies, session tokens or other sensitive information about the user, which is
sent back to the cybercriminal.
4. Armed with this information, the cybercriminal can impersonate the user.

Code Injection
• Seeks to exploit weaknesses in Structured Query Language (SQL) or an Extensible Markup Language
(XML) database
• Common Types:
– XML Injection – an attack that can corrupt the data when using an XML Database –
SQL Injection – the cybercriminal exploits a vulnerability by inserting a malicious SQL
statement in an entry field
– DLL Injection Attack – allows a cybercriminal to trick an application into calling a malicious
DLL file, which executes as part of the target process
• dynamic link library (DLL) file - is a library that contains a set of code and data for
carrying out a particular activity in Windows
– LDAP Injection Attack - exploits input validation vulnerabilities by injecting and executing
queries to LDAP servers, giving cybercriminals an opportunity to extract sensitive information
from an organization’s LDAP directory.
• Lightweight Directory Access Protocol (LDAP) - is an open protocol for
authenticating user access to directory services.
Buffer Overflow - occurs when data goes beyond the limits of a buffer.
Buffers are memory areas allocated to an application. By changing data beyond the boundaries of a buffer, the
application accesses memory allocated to other processes. This can lead to a system crash, data compromise,
or provide escalation of privileges.
Remote Code Executions - allows a cybercriminal to take advantage of application vulnerabilities to execute
any command with the privileges of the user running the application on the target device Privilege escalation
exploits a bug, design flaw or misconfiguration in an operating system or software application to gain access to
resources that are normally restricted.
Every piece of information that an attacker receives about a targeted system or application can be used as a
valuable weapon for launching a dangerous attack.

The following are some other types of application attacks:

1. Cross-site request forgery (CSRF)

Page 9 of 11
CSRF describes the malicious exploit of a website where unauthorized commands are submitted from a user’s
browser to a trusted web application.
A malicious website can transmit such commands through specially-crafted image tags, hidden forms or
JavaScript requests — all of which can work without the user’s knowledge.
2. Race condition attack
Also known as a time of check (TOC) or a time of use (TOU) attack, a race condition attack happens when a
computing system that is designed to handle tasks in a specific sequence is forced to perform two or more
operations simultaneously.
For example, operating systems are made up of threads — the smallest sequence of program instructions
required to carry out a process. When two or more threads access shared data and try to change it at the exact
same time, a race condition attack occurs.
3. Improper input handling attack
Data inputted by a user that is not properly validated can affect the data flow of a program and cause critical
vulnerabilities in systems and applications that result in buffer overflow or SQL injection attacks. 4. Error
handling attack
Attackers can use error messages to extract specific information such as the hostnames of internal systems
and directories or files that exist on a given web server — as well as database, table and field names that can
be used to craft SQL injection attacks.
5. Application programming interface (API) attack
An API delivers a user response to a system and sends the system’s response back to the user. An API attack
occurs when a cybercriminal abuses an API endpoint.
6. Replay attack
This describes a situation where a valid data transmission is maliciously or fraudulently repeated or delayed by
an attacker, who intercepts, amends and resubmits the data to get the receiver to do whatever they want.

7. Directory traversal attack

Directory traversal occurs when an attacker is able to read files on the webserver outside of the directory of the
website. An attacker can then use this information to download server configuration files containing sensitive
information, potentially expose more server vulnerabilities or even take control of the server! 8. Resource
exhaustion attacks
These attacks are computer security exploits that crash, hang or otherwise interfere with a targeted program or
system. Rather than overwhelming network bandwidth like a DoS attack, resource exhaustion attacks
overwhelm the hardware resources available on the target’s server instead.

Defending Against Application Attacks

There are several actions that you can take to defend against an application attack. You will find some of them
outlined here.
• The first line of defense against an application attack is to write solid code.
• Prudent programming practice involves treating and validating all input from outside of a function as if it is
hostile.
• Keep all software, including operating systems and applications, up to date and do not ignore update
prompts. Remember that not all programs update automatically.

Email and browser attacks

Spam
Spam, also known as junk mail, is simply unsolicited email. In most cases, it is a method of advertising.
However, a lot of spam is sent in bulk by computers infected by viruses or worms — and often contains
malicious links, malware or deceptive content that aims to trick recipients into disclosing sensitive information,
such as a social security number or bank account information.
Almost all email providers filter spam, but it still consumes bandwidth. And even if you have security features
implemented, some spam might still get through to you. Look out for the following indicators of spam: • The
email has no subject line.
• The email asks you to update your account details.
• The email text contains misspelled words or strange punctuation.
• Links within the email are long and/or cryptic.
• The email looks like correspondence from a legitimate business, but there are tiny differences — or it
contains information that does not seem relevant to you.
• The email asks you to open an attachment, often urgently.
• If you receive an email that contains one or more of these indicators, you should not open the email or
any attachments. Many organizations have an email policy that requires employees to report receipt of this
type of email to their cybersecurity team for further investigation. If in doubt, always report. Phishing
Phishing is a form of fraudulent activity often used to steal personal information.
Phishing occurs when a user is contacted by email or instant message — or in any other way — by someone
masquerading as a legitimate person or organization. The intent is to trick the recipient into installing malware
on their device or into sharing personal information, such as login credentials or financial information.

Page 10 of 11
Spear phishing
A highly targeted attack, spear phishing sends customized emails to a specific person based on information the
attacker knows about them — which could be their interests, preferences, activities and work projects. Vishing
Often referred to as voice phishing, this type of attack sees criminals use voice communication technology to
encourage users to divulge information, such as their credit card details.
Criminals can spoof phone calls using voice over Internet protocol (VoIP), or leave recorded messages to give
the impression that they are legitimate callers.
Pharming
This type of attack deliberately misdirects users to a fake version of an official website. Tricked into believing
that they are connected to a legitimate site, users enter their credentials into the fraudulent website. Whaling
Whaling is a phishing attack that targets high profile individuals, such as senior executives within an
organization, politicians and celebrities.
Defending Against Email and Browser Attacks
There are many actions that you can take to defend against email and browser attacks. Some of the most
important ones are outlined here.
1. It is difficult to stop spam, but there are ways to reduce its effects:
• Most Internet service providers (ISPs) filter spam before it reaches the user’s inbox. • Many antivirus and
email software programs automatically detect and remove dangerous spam from an email inbox.
• Organizations should educate employees about the dangers of unsolicited emails and make them aware
of the dangers of opening attachments.
• Never assume that email attachments are safe, even when they come from a trusted contact. Always
scan attachments before opening them.
2. Become a member of the Anti-Phishing Working Group (APWG). It is an international association of
companies focused on eliminating identity theft and fraud resulting from phishing and email spoofing. 3. All
software should be kept up-to-date, with the latest security patches applied to protect against any known
security vulnerabilities.

Other attacks
some other common attacks that cybercriminals can launch:
Physical Attacks
Physical attacks are intentional, offensive actions used to destroy, expose, alter, disable, steal or gain
unauthorized access to an organization’s infrastructure or hardware.
Adversarial artificial intelligence attacks
Machine learning is a method of automation that allows devices to carry out analysis and perform tasks without
specifically being programmed to do so. It powers many of the applications we use today, such as web
searching, photo tagging, spam detection, video surveillance, fraud detection and security automation.
Machine learning uses mathematical models to predict outcomes. However, these models are dependent on
the data that is inputted. If the data is tainted, it can have a negative impact on the predicted outcome.
Attackers can take advantage of this to perpetrate attacks against machine learning algorithms. For example,
using tainted data to trick an autonomous vehicle into misinterpreting street signs.
Supply chain attacks
Many organizations interface with a third party for their systems management or to purchase components and
software. Organizations may even rely on parts or components from a foreign source. Attackers often find ways
to intercept these supply chains. For example, software can be based on specific support agreements and
subject to an end-of-life (EOL) date. Changing this date could mean that an organization is no longer eligible
for service and maintenance support.
Cloud-based attacks
Rather than developing systems on their own premises, more and more organizations are making the move
toward cloud-based computing.
The advantage is that the cloud provider will maintain the equipment but this also opens up an organization to a
host of potential threats. Attackers are constantly leveraging ways to exploit sensitive data stored on the cloud,
as well as applications, platforms and infrastructure that is cloud-based, as we saw with SaaS, PaaS and IaaS.

Source: https://skillsforall.com/

Page 11 of 11