If all the people moved to the city, what would the thieves do in village?
With increasing digitisation, cyber attacks have seen a rise in the graph too. Studies show that every 14 seconds, one ransomware attack happens in the world. Digital crimes devour anyone and everyone, from Fortune 500 companies to your clueless neighbours. It is high time that you know what these attacks are made of and how they are carried out.
1. Denial of service:
How would you feel if someone denied you entry into your own house? This is what DoS looks like. It can be of 3 types:
-
Ping of Death
A web server can be ق€˜pingedق€™ by sending an ICMP packet that would generate a response. But your web server can only handle so much. If someone overloads it by sending oversized packets then it will crash, freeze or be rendered useless.
-
TCP SYN attack
It is similar to ping of death. The only difference: attacker sends continuous TCP (not ICMP) requests to overwhelm and time out the server.
-
Smurf attack
Imagine getting bombarded with parcels you didnق€™t ask for. Soon, youق€™ll run out of space in your living room. Similarly, the attacker sends a large number of ICMP requests to your server and tricks it into thinking that YOU are the one who requested them. So guess who is gonna get bombarded with the responses now?
-
Botnet (Distributed Denial of Service attack)
A DoS attack could be used to prepare you for another attack like turning you into a robot for the attacker. Now a group of these victims-turned-puppets make up the botnet which could be used for carrying out other DoS attacks.
2. Man in the middle:
How would you feel if someone eavesdrops on you and your friend talking about your anxiety for desserts? Well, this is how MITM works. Computers communicate like this:
You:
Hey, I want to access my account.
Facebook server:
Give me your credentials, will you?
You:
Ofcourse, it is ****
Getting the gist? MITM attack is of two types:
-
Session hijacking
Imagine the attacker eavesdrops on this communication and then has the guts to disconnect YOU from the equation (using DoS etc.). And the poor Facebook server is tricked into believing that it is still talking to you because the attacker is now wearing your mask (using your IP address).
-
Session replay
It is similar to hijacking. The difference is that here the attacker eavesdrop and gets your authentication tokens and then later uses those to start a conversation with the server.
3. Phishing:
Phishing is simple. You get lured by a bait. And end up sharing your sensitive data.
4. Drive by attack:
Ah, the drive by! Have you ever opened a website or a mail which either led you to another website or downloaded something without your permission?
Thatق€™s how drive by attacks take place. Attackers take advantage of faulty websites or outdated OS and use them to download a malware on your device.
5. Password attack:
Not gonna waste your time explaining this. It is of two types:
6. SQL injection:
Letق€™s continue the previous conversation:
You:
Hey, I want to access my account.
Facebook server:
Give me your credentials, will you?
You:
Ofcourse, it is admin and password is admin.
Facebook server:
Thanks. Iق€™ll get back to you in a second.
Facebook server:
Hey DB, can you pull out the data for user= ق€˜adminق€™ whose password is also= ق€˜admin?
Facebook DataBase:
Sure can!
This is an SQL query. Only when these two conditions are fulfilled, the DB will return with the data (*).
An attacker can insert a command here that fulfils the conditions for example, 1=1 and retrieve data about you from the database.
Authentication Bypass example:
SQL injection can be union based, error based or blind based(time and boolean).
7. Cross site scripting (XSS):
This is best explained step by step.
1.
An attacker finds a vulnerable web page.
2.
(S)he injects the payload (part of malware) in the webpageق€™s Java script.
3.
You open the webpage.
4.
You receive the payload with it.
5.
Your browser executes the script.
6.
It sends your cookies to the attacker.
7.
He uses your cookies to session hijack you.
It is of three types:
-
Reflected
When the injection is entered in the userق€™s request to get a response from the server.
-
Stored
When the injection is permanently stored in the websiteق€™s database and makes its way to the victimق€™s system.
-
DOM based
DOM is a special case of Reflected XSS where the injection is stored in the Document Object Model of victimق€™s browser.
8. Malware:
Malicious+software that gets downloaded to damage your system. Duh!
Malware can be of following types:
9. Eavesdropping:
When someone is listening to you transferring information over the network, like your credit card details or your passwords, it is called eavesdropping attack. Two types of this are:
Now that you have a working understanding of all the major cyber attacks, you can go one step further and try ethically hacking your system to find out loopholes.
Tell us if you would like us to cover any other attacks in the comments below. We will get back to you ASAP!
Read more. Know more. Grow more.
