In this article I will keep documenting types of cyber threats out there and how you can protect your small business.
In today's digital age, businesses of all sizes are increasingly reliant on technology. This reliance makes them vulnerable to cyber threats, which are constantly evolving and can have a devastating impact. Understanding the different types of cyber threats and the risks they pose is crucial for any small business owner or operator.
Let's learn the current set of them - and this list will grow.
List of categories
What is a cyber threat?
What is a cyberthreat? It's the possibility of a malicious attempt to damage or disrupt a computer network or system or devices or software.
A cyber threat is any potential malicious activity that aims to damage, disrupt, or gain unauthorized access to computer systems, networks, devices, or software. These threats can compromise the confidentiality, integrity, and availability of data and digital assets, putting individuals, businesses, and even nations at risk.
Cyber threats can originate from various sources, including cybercriminals, hackers, insiders, or nation-states, and they can take many forms, from sophisticated hacking attacks to simple social engineering tricks. The growing reliance on technology and the interconnectedness of systems make cyber threats an ever-present and evolving challenge that requires constant vigilance and robust security measures.
Let's dig in deeper into the common ones.
Malware
Malware is a broad term that encompasses any software designed to harm a computer system. This includes viruses, worms, Trojan horses, spyware, and ransomware. Malware can steal data, corrupt files, or even take control of your entire system. Software that is specifically designed to disrupt, damage, or gain unauthorized access to a computer system. Types of malware is a worm, virus, trojan. There are other types:
Ransomware: Ransomware encrypts a victim’s data or locks them out of their device, demanding a ransom to restore access. It has become one of the most financially damaging types of malware. Example: You receive a message on your screen demanding payment in Bitcoin to unlock your encrypted files. Here are the various types:
Ransomware-as-a-Service (RaaS): This is a subscription-based model where criminals lease out ransomware to other attackers. RaaS operators provide the malware, and the affiliates perform the attacks, splitting the profits from the ransom payments. Example: A criminal with little technical expertise uses a RaaS platform to distribute ransomware and demand payment from victims. Another example: Various platforms that allow users to customize and deploy ransomware campaigns for a fee, such as Sodinokibi.
Crypto Ransomware: This type encrypts files on the victim's system, making them inaccessible until a ransom is paid for the decryption key. Example: WannaCry is a well-known crypto ransomware that affected thousands of computers globally, encrypting files and demanding Bitcoin as ransom.
Locker Ransomware: Description: Instead of encrypting files, locker ransomware locks users out of their devices, preventing access to the operating system or applications. Users are then asked to pay a ransom to regain access. Example: Police-themed locker ransomware that displays a message claiming to be from law enforcement, alleging illegal activity and demanding payment.
Scareware: This type of ransomware often masquerades as legitimate security software, claiming that the user's computer is infected and demanding payment to remove the threats. It doesn’t necessarily encrypt files. Example: Software that displays fake alerts about viruses and requires payment for a "full scan" or "cleaning."
Double Extortion Ransomware: This method involves both encrypting files and stealing sensitive data. Attackers threaten to publish or leak the stolen data if the ransom is not paid. Example: Maze ransomware not only encrypts files but also exfiltrates sensitive information and threatens to release it if the ransom isn’t paid.
GandCrab: Once one of the most prolific ransomware variants, GandCrab encrypts files and demands ransom in various cryptocurrencies. It has been distributed through various methods, including exploit kits and phishing emails. Example: GandCrab was known for its rapid evolution and frequent updates to avoid detection.
Ryuk: Description: A targeted ransomware that is often associated with large-scale attacks on enterprises. Ryuk encrypts files and demands significant ransoms, often targeting critical infrastructure and businesses. Example: Ryuk was used in various high-profile attacks, including those on hospitals and municipalities.
REvil (Sodinokibi): This ransomware variant encrypts files and also involves double extortion tactics by stealing data. It gained notoriety for high-profile attacks and is offered as a RaaS model. Example: The attack on JBS Foods in 2021 that led to a substantial ransom payment.
DarkSide: Known for its double extortion method, DarkSide targets large organizations and is associated with high-profile attacks, including the Colonial Pipeline attack that disrupted fuel supplies in the U.S. Example: DarkSide is known for its professionalism in handling negotiations with victims, often providing a customer support portal for ransom negotiations.
Conti: This is another ransomware that uses double extortion tactics, encrypting files and stealing data. It is known for its speed and efficiency in carrying out attacks. Example: Conti attacks have targeted hospitals and other critical infrastructure, causing significant disruption.
Netwalker: This ransomware is often spread through phishing and exploits vulnerabilities in software. It employs double extortion tactics, threatening to leak sensitive data if the ransom is not paid. Example: Netwalker has targeted various sectors, including healthcare and education, demanding high ransoms.
Egregor: Egregor uses a combination of ransomware and data theft. It targets businesses by exploiting vulnerabilities and is known for its involvement in double extortion schemes. Example: Egregor has been linked to various data breaches and ransom demands across different industries.
Fileless Malware: Malicious software that operates in-memory without writing files to disk, making it harder for traditional antivirus solutions to detect.
Malvertising: Malware is distributed through online ads, even on legitimate websites, where users can get infected by simply viewing or clicking on the ad.
Rootkits: Rootkits are designed to provide attackers with administrator-level control over a system. They hide themselves deep within the operating system to avoid detection, allowing continuous and unauthorized access. Example: An attacker installs a rootkit on a victim's computer to monitor keystrokes and steal sensitive information without being detected by security software.
Adware: Adware generates unwanted advertisements on a user's system, often in the form of pop-ups or banners. While not always malicious, adware can be a gateway for other malware or expose users to risky ads. Example: Constant pop-up ads that appear while browsing the internet, even when not visiting ad-heavy websites.
Spyware: Spyware secretly monitors a user's activities, gathering information such as browsing history, login credentials, or financial details. Spyware is often used to collect personal data without consent. Example: A program that tracks every keystroke you make, sending this data back to the attacker to gather passwords or other confidential information.
Rogue Security Software: Also known as scareware, rogue security software tricks users into believing their system is infected and that they need to purchase or install a fake security product, which often installs further malware. Example: A pop-up warning that your system has a virus and offering to clean it, but the provided software is malicious.
Botnet Malware: Botnet malware turns infected devices into “bots” that are controlled by an attacker. These botnets can be used to launch large-scale attacks, such as Distributed Denial-of-Service (DDoS) attacks. Example: Your computer becomes part of a botnet and is used along with thousands of other infected machines to flood a website with traffic and cause it to crash.
Keyloggers: Keyloggers are a type of malware that records every keystroke made on a device. This information is sent to the attacker, often to steal login credentials, personal information, or credit card numbers. Example: A keylogger records your bank login details and sends them to an attacker without your knowledge.
Cryptojacking Malware: Cryptojacking malware infects a device and uses its resources (CPU and GPU power) to mine cryptocurrency without the user's knowledge or consent. Example: A computer suddenly slows down, and the fan runs constantly as malware secretly uses the system's power to mine Bitcoin for an attacker.
Browser Hijackers: Browser hijackers alter web browser settings, redirecting users to malicious or unwanted websites. These can also change the default search engine or homepage. Example: Every time you open your browser, you're taken to a sketchy website instead of your usual homepage.
Mobile Malware: Mobile malware specifically targets smartphones and tablets, often through malicious apps. It can steal personal data, track the user, or even make fraudulent in-app purchases. Example: A malicious app downloaded from a third-party store steals your contacts and messages or uses your phone to send premium-rate SMS texts.
Polymorphic Malware: Polymorphic malware modifies its code each time it infects a new system, making it harder for traditional antivirus software to recognize and detect. Example: A virus that changes its signature with each infection, evading detection by antivirus software that relies on static signatures.
Logic Bomb: Logic bombs remain dormant within a system until a specific condition is met (such as a date or action), at which point the malware activates and performs its attack, often destroying or corrupting data. Example: A disgruntled employee leaves a logic bomb set to go off if they are removed from the company’s payroll system.
RAT (Remote Access Trojans): RATs provide attackers with remote access to a victim's system, enabling them to control the system as though they were the user. They can steal data, install other malware, or spy on users. Example: A RAT allows an attacker to turn on your webcam or monitor your emails and passwords without your knowledge.
Wiper Malware: Wiper malware is designed to erase data from a system rather than steal or encrypt it. Often used in politically motivated attacks, wipers can cause irreparable damage to organizations or governments.
Example: An organization finds all its critical data erased and systems rendered useless after a targeted malware attack.
APT (Advanced Persistent Threats): APT malware is used in long-term cyber espionage attacks, where attackers infiltrate a system and remain undetected for extended periods. The goal is to steal sensitive information or monitor activities over time. Example: A corporate network is breached by attackers who slowly exfiltrate trade secrets over the course of several months.
Phishing
Phishing attacks are attempts to trick you into revealing personal information, such as your credit card number or login credentials. Phishing emails often appear to be from legitimate sources, such as your bank or a social media platform. They may contain links that, when clicked, will take you to a fake website that looks real. Once you enter your information on the fake website, the attacker can steal it. Here are a few types:
Spear Phishing: Targeted Phishing Attack aimed at a specific individual or organization. Attackers craft personalized messages using information they've gathered about the target, making the email appear more legitimate and difficult to spot as phishing.
Example: An email addressed to you specifically, mentioning your job title or company, and pretending to be from your boss, asking for confidential data.
Whaling: Phishing Attack targeting high-level executives such as CEOs, CFOs, or other high-ranking officials in an organization. These emails are carefully tailored to seem highly relevant to the target, using corporate lingo or referring to sensitive business matters. Example: An email that appears to be from a lawyer or business partner requesting an executive to approve a large payment or provide financial information.
Vishing (Voice Phishing): Phishing conducted over the phone rather than through email. Attackers impersonate trusted entities (such as a bank or government agency) and attempt to extract personal or financial information through deceptive phone calls. Example: A phone call claiming to be from your bank, asking you to verify account details or reset your password.
Smishing (SMS Phishing): Phishing via SMS text messages, where attackers send messages containing malicious links or ask for sensitive information. These messages often create a sense of urgency, such as claiming that your account will be locked unless you act immediately. Example: A text message claiming to be from your bank, asking you to verify your account by clicking a link.
Clone Phishing: In clone phishing, attackers clone a legitimate email that the recipient has previously received and send an identical one, except with malicious links or attachments. The cloned email looks like a genuine follow-up or continuation of a prior conversation. Example: Receiving what appears to be a legitimate email thread from your company or service provider, but the attached file or links have been altered to install malware.
HTTPS Phishing: Attackers create fake websites that use "https://" in the URL and display the lock icon to appear secure. Users are fooled into thinking the site is trustworthy and legitimate because they see the SSL certificate, even though it’s a fake or malicious site. Example: A phishing email sends you to a website with a green padlock symbol and "https://" in the URL, tricking you into entering login details or financial information.
CEO Fraud: This type of phishing attack targets lower-level employees by impersonating a CEO or high-level executive and requesting sensitive data or urgent transfers of money. The message typically creates a sense of urgency or confidentiality to prevent the employee from verifying the request. Example: An urgent email from the "CEO" asking a finance officer to wire money to a specific account for an important deal.
Pharming: Attackers redirect users to a fake website by manipulating DNS settings or through malware, even if the victim enters the correct URL. Once on the malicious site, users unknowingly submit their sensitive information. Example: Typing in your bank's URL and being redirected to a fake site that looks identical to the legitimate one.
Evil Twin Phishing: Attackers set up a fraudulent Wi-Fi network that appears to be a legitimate public Wi-Fi hotspot. Once users connect to the evil twin, attackers can intercept any information they send, including login credentials and financial information. Example: Connecting to "Free Airport Wi-Fi" and unknowingly allowing attackers to intercept your data.
Social Media Phishing: Attackers send malicious messages through social media platforms, either impersonating trusted contacts or sending direct messages with links that lead to phishing sites. Social media phishing can also involve fake profiles posing as legitimate individuals or businesses. Example: A Facebook message from a friend asking you to check out a link, which actually takes you to a phishing site designed to steal your account credentials.
Man-in-the-Middle Phishing: Attackers insert themselves between a legitimate entity and the victim to intercept communication and steal credentials or other information. This is often done using compromised networks or fake Wi-Fi hotspots. Example: Connecting to an unsecured Wi-Fi network where an attacker captures the information you enter into your banking or email account.
Dropbox/Google Drive Phishing: Attackers send phishing emails with links to fake file-sharing platforms like Dropbox or Google Drive, claiming that a document is ready for viewing. Once users click on the link and enter their credentials, attackers steal them. Example: An email pretending to be from a colleague saying a document is shared on Google Drive, but the link leads to a fake login page.
Network Based Attacks
Network-based attacks target the infrastructure, devices, and services of a network, often aiming to disrupt, intercept, or manipulate network traffic. These network-based attacks highlight the need for strong security practices, including encryption, monitoring, and proper configuration, to protect against attackers exploiting vulnerabilities within a network. Below are several common network-based attacks:
DNS Hijacking: DNS hijacking, also known as DNS redirection, is a cyberattack where malicious actors manipulate the Domain Name System (DNS) to redirect internet traffic to fraudulent websites. This can be achieved by compromising DNS servers, installing malware on user devices, or intercepting DNS communication. When a user tries to access a legitimate website, they are instead unknowingly routed to a malicious site designed to steal sensitive information or install malware. This attack can have severe consequences for individuals and organizations, leading to financial losses, identity theft, and reputational damage.
DNS Spoofing (DNS Cache Poisoning): Attackers corrupt DNS records, redirecting users to fraudulent websites without their knowledge. Example: A user attempting to access a bank website is redirected to a fake site where attackers steal login credentials.
Rogue Access Points: Unauthorized wireless access points are set up to mimic legitimate networks, allowing attackers to intercept or manipulate network traffic. Example: An attacker sets up a Wi-Fi network called "Free Wi-Fi" in a public area to capture users' data.
Man-in-the-Middle (MitM) Attacks: Attackers secretly intercept and relay communications between two parties, often altering or stealing data.
Example: An attacker intercepts traffic between a user and a banking website, capturing login credentials.
Packet Sniffing (Eavesdropping): Attackers use packet sniffers to capture and analyze network traffic, potentially exposing sensitive data like passwords and emails. Example: An attacker on a shared network captures unencrypted traffic to steal sensitive information.
Denial-of-Service (DoS) Attacks: Attackers flood a network or server with traffic, overwhelming resources and causing a shutdown or slowdown of services. Example: A website is overwhelmed with traffic, making it unavailable to legitimate users.
Distributed Denial-of-Service (DDoS) Attacks: Similar to DoS but involves multiple compromised systems (usually part of a botnet) attacking a target simultaneously, making it harder to mitigate. Example: Thousands of infected devices are used to flood a network server, causing service outages.
IP Spoofing: Attackers disguise their identity by falsifying the source IP address of packets to make them appear to come from a trusted source. Example: An attacker sends malicious packets to a target while pretending to be a trusted server.
ARP Spoofing: Attackers send falsified ARP (Address Resolution Protocol) messages to associate their MAC address with the IP address of a legitimate host, enabling interception of traffic. Example: An attacker on a local network reroutes traffic intended for the gateway to their machine.
MAC Flooding: Attackers flood a switch with numerous fake MAC addresses, causing it to fail open and broadcast traffic to all ports, making it easier to capture sensitive information. Example: An attacker overwhelms a switch, forcing it to broadcast traffic, which can then be captured by the attacker.
Port Scanning: Attackers scan a network or device to identify open ports and services, gathering information to exploit vulnerabilities. Example: An attacker scans a server to find open ports that can be used to launch further attacks.
Session Hijacking: Attackers take control of a legitimate session by stealing session cookies or session IDs, allowing unauthorized access to resources. Example: An attacker captures a user's session token from an insecure web application and uses it to impersonate the user.
Evil Twin Attack: Attackers set up a fake Wi-Fi network with a name similar to a legitimate network, tricking users into connecting and giving the attacker access to their data. Example: A hacker sets up a network named "CoffeeShop_WiFi_Free" near a café to capture data from users who connect.
SSL Stripping: Attackers downgrade a secure HTTPS connection to an unencrypted HTTP connection, allowing them to intercept or modify data sent between the user and the website. Example: An attacker intercepts an HTTPS connection and strips it down to HTTP, stealing sensitive information transmitted over the connection.
Network Tapping: Attackers physically tap into the network cables or use hardware to intercept data traveling through the network. Example: Someone installs a hardware tap on a network cable to capture all traffic passing through.
VLAN Hopping: Attackers exploit vulnerabilities in a VLAN (Virtual Local Area Network) configuration to move from one VLAN to another and access restricted network segments. Example: A user on one VLAN gains unauthorized access to another VLAN holding sensitive data.
Smurf Attack: A type of DDoS attack where the attacker sends ICMP requests (pings) to a network, with the source IP address spoofed to the victim's address, causing a flood of ICMP responses. Example: The victim’s network is overwhelmed by reply messages from various devices in response to the attacker’s spoofed requests.
Broadcast Storm Attack: Attackers send excessive broadcast traffic on a network, causing severe network congestion and performance degradation. Example: Multiple devices on a network continually broadcast messages, resulting in a traffic overload.
RIP Route Poisoning: Attackers manipulate the Routing Information Protocol (RIP) by injecting false route updates into the network, redirecting traffic or causing network disruptions. Example: An attacker sends false routing information to a router, misdirecting traffic to a compromised route.
Wormhole Attack: Attackers create a fast communication channel between two points in a wireless network, allowing them to capture packets and replay them later. Example: A malicious node in a wireless sensor network forwards data packets from one point to another, disrupting routing protocols.
Botnets: A network of compromised computers or devices (often called zombies) controlled by a hacker to launch large-scale attacks such as DDoS or spam campaigns. Example: A botnet of thousands of devices is used to launch a DDoS attack on a corporate network.
Social Engineering
Social engineering is the art of tricking people into giving up personal information or clicking on malicious links. Social engineering attacks can be very effective, as they prey on human trust and emotions.
Business Email Compromise (BEC): Scams where attackers impersonate executives or vendors to trick employees into transferring funds or sensitive data. A BEC is a form of social engineering.
Zero-Day Attacks
Zero-day attacks are attacks that exploit vulnerabilities in software that the software vendor is not aware of. Zero-day attacks are dangerous because there is no patch available to protect against them.
Internet of Things (IoT) Threats
Exploiting weak security in connected devices, such as cameras or smart systems, to gain network access.
AI-Powered Attacks
Attackers are increasingly using AI and machine learning to craft more sophisticated phishing emails, penetrate networks, or find vulnerabilities faster than ever before.
Deepfake & Synthetic Media Attacks: Fraudsters are also using deepfakes or synthetic audio to impersonate business leaders is a growing threat, especially in small businesses where verification protocols may not be strong. They are now even testing live video AI face skins and voices to impersonate your staff or loved ones.
Supply Chain Attacks
Hackers target vendors or partners to infiltrate larger networks. This can be particularly harmful to small businesses relying on third-party services.
Credential Stuffing Attacks
Automated attacks using stolen credentials from one breach to try accessing multiple systems, exploiting the common practice of reusing passwords.
Data Breaches
Unauthorized access to sensitive data, leading to information being stolen or exposed, typically affecting personal, financial, or business information. Each type of data breach requires different prevention and mitigation strategies. Effective cybersecurity practices, including encryption, strong access controls, regular audits, and employee training, are essential to protect sensitive data. Here are a few types:
Accidental Data Breach
Description: Sensitive information is accidentally disclosed or shared due to human error.
Example: An employee mistakenly sends an email containing sensitive customer data to the wrong recipient.
Insider Threat Breach
Description: A trusted individual within an organization, such as an employee or contractor, deliberately or accidentally exposes data. Employees or contractors with malicious intent or those who unintentionally cause security breaches. Some employees or contractors could be bribed by hackers or other maliciously in inclined organisations to plant malicious devices or software or steel data.
Example: An employee with access to sensitive information intentionally leaks it or unknowingly clicks on a phishing link, allowing attackers access.
Hacking/IT Incident Breach
Description: Unauthorized individuals gain access to systems, networks, or databases through vulnerabilities or sophisticated cyberattacks.
Example: Hackers exploit vulnerabilities in a company's system to steal customer data, such as passwords or credit card details.
Physical Theft of Devices
Description: Physical devices containing sensitive data (laptops, USB drives, smartphones) are stolen or lost.
Example: A stolen company laptop contains unencrypted personal data, resulting in a data breach.
Social Engineering Breach
Description: Attackers manipulate individuals into providing confidential information or access to systems.
Example: A phishing email tricks employees into revealing their login credentials, which are then used to access sensitive data.
Ransomware Breach
Description: Attackers encrypt an organization’s data, demanding ransom for the decryption key. During the attack, data can be exfiltrated or stolen.
Example: A company’s customer data is held hostage by ransomware, and the attackers threaten to release it if a ransom is not paid.
Third-Party Vendor Breach
Description: A data breach occurs due to vulnerabilities or security failures in a third-party vendor or partner’s system, compromising your organization’s data.
Example: A payroll service provider is hacked, exposing the employee data of a client company.
Cloud Storage Misconfiguration
Description: Misconfigured cloud services, like databases or file storage, expose sensitive data to the internet unintentionally.
Example: A company leaves an Amazon S3 bucket containing customer information publicly accessible without proper authentication.
Malware-Based Breach
Description: Malware infects systems and facilitates unauthorized access to data, including keylogging, spyware, or other types of malware.
Example: A Trojan horse is installed on a company's network, collecting and transmitting sensitive data to attackers.
Card Skimming Breach
Description: Attackers install skimming devices on point-of-sale systems or ATMs to capture credit or debit card data.
Example: A skimmer placed on an ATM reads card details as customers use the machine, leading to theft of card information.
Mobile Device Breach
Description: Mobile phones or tablets containing sensitive data are compromised through malware, insecure apps, or theft.
Example: An employee’s phone infected with malware exposes company emails and documents stored on the device.
Denial-of-Service (DoS) Attack Data Breach
Description: While the primary purpose of DoS attacks is service disruption, attackers sometimes use these attacks as a distraction to exfiltrate data.
Example: During a DDoS attack, hackers use the chaos to infiltrate a network and steal confidential data unnoticed.
SQL Injection Breach
Description: Attackers exploit vulnerabilities in web applications to execute malicious SQL queries, allowing them to access sensitive data in a database.
Example: An insecure login form is exploited using SQL injection to extract usernames and passwords from a database.
Unsecured Network Breach
Description: Attackers exploit unsecured or poorly configured Wi-Fi networks to gain unauthorized access to sensitive data.
Example: Data is intercepted on an unsecured public Wi-Fi network through a Man-in-the-Middle (MitM) attack.
Denial-of-Service (DoS) Attack Data Breach
Description: DoS attacks are primarily intended to disrupt service, but in some cases, attackers use these to cover for data exfiltration.
Example: A company hit by a DoS attack also suffers a simultaneous data theft as attention is diverted to restoring services.
Data on the Move Breach
Description: Sensitive data in transit, such as during transfers between systems or devices, is intercepted or compromised.
Example: An unsecured email containing customer payment information is intercepted by an attacker while being transmitted.
Dumpster Diving Breach
Description: Attackers physically search through discarded materials (like paper records) to find sensitive information.
Example: Discarded documents in a company’s trash contain customer records, which are retrieved by attackers.
Business Email Compromise (BEC)
Description: Attackers impersonate an executive or trusted entity through email, convincing employees to transfer sensitive information or funds.
Example: A fake email from the CFO instructs an employee to transfer sensitive client data to an external party.
Shadow IT Threats
Unapproved software or hardware used by employees that bypasses IT oversight, creating security vulnerabilities.
Telephony Signaling Attacks
These telecom signaling attacks or telephony network vulnerabilities exploit weaknesses in the signaling protocols that mobile networks use to route calls and messages. Some of the common attack vectors in this category include:
SS7 Attacks: Exploiting weaknesses in the Signaling System 7 (SS7) protocol, allowing hackers to intercept communications, track locations, and redirect calls and texts.
Diameter Attacks: Diameter is a newer protocol used in 4G and 5G networks but is still vulnerable to certain attacks similar to those in SS7.
SIP Attacks: The Session Initiation Protocol (SIP) is used for managing voice over IP (VoIP) calls and can be targeted for call interception or session hijacking.
SMS Spoofing: Attackers send fake messages that appear to come from trusted sources, often for phishing or scamming purposes.
SIM Swap Attacks: Hackers transfer a victim's phone number to their own SIM card by exploiting weaknesses in mobile carrier security processes, allowing them to intercept two-factor authentication (2FA) codes and access accounts.
Vishing: A form of phishing conducted over the phone, where attackers use social engineering to trick victims into revealing sensitive information.
Database Attacks
Each of these database attacks highlights how attackers can exploit weaknesses beyond simple SQL Injection, especially in modern databases and applications:
SQL Injection: attackers manipulate queries to a database to gain unauthorized access or corrupt data by injecting malicious SQL code.
NoSQL Injection similar to SQL Injection, but targets NoSQL databases (e.g., MongoDB, Couchbase). Attackers inject malicious queries into applications using untrusted input to manipulate or expose data.
XML External Entity (XXE) attacks: uploading or inputting malicious XML content that can exploit vulnerabilities in the XML parser, allowing attackers to access files or execute remote code on the database server.
Privilege Escalation: attackers exploit flaws in the database's access control mechanisms to gain higher-level privileges, giving them unauthorized access to sensitive data or administrative capabilities.
Database Misconfiguration Attacks: poorly configured databases (e.g., default passwords, open ports) can be exploited by attackers to gain access, modify data, or delete databases without needing advanced technical skills.
Database Dump Attacks: attackers use tools or exploits to extract a full copy of the database. This often happens when database backups are not properly secured, or if the database is not encrypted.
Buffer Overflow Attacks: attackers exploit software bugs in the database server, such as buffer overflows, to execute arbitrary code or crash the database, compromising its integrity and availability.
Timing Attacks: attackers observe how long a database takes to respond to certain queries, allowing them to infer sensitive information based on response times, such as whether a query returned true or false.
Data Exfiltration via Out-of-Band Channels: attackers leverage vulnerabilities to send data from a compromised database to an external source, bypassing regular data exfiltration monitoring systems.
Stored Procedure Attacks: vulnerabilities in stored procedures (pre-written SQL code) can be exploited if these procedures are insecurely written, allowing attackers to manipulate data or execute unauthorized actions.
LDAP Injection is similar to SQL Injection but targets LDAP (Lightweight Directory Access Protocol) queries. Attackers can modify LDAP queries to bypass authentication mechanisms or access unauthorized data.
Database Backdoor Attacks: attackers plant backdoors within the database or the database management system (DBMS), allowing persistent and undetected access for future exploitation.
Script Attacks
All these attacks rely on injecting or manipulating scripts in some form, making them highly dangerous in web applications where security vulnerabilities allow for code execution in the user's browser or server:
Cross-Site Scripting (XSS): malicious scripts are injected into trusted websites, allowing attackers to steal session cookies, user data, or take over user accounts.
Cross-Site Request Forgery (CSRF): attackers trick users into performing unintended actions on a web application where they're authenticated, like transferring money or changing account details. This happens without the user’s knowledge by exploiting their active session.
HTML Injection: Malicious HTML code is injected into a web page, altering its structure or behavior. Attackers can inject form fields, modify the content, or create fake login prompts to steal user data.
Script Injection: This involves injecting malicious scripts into web pages or web applications. An attacker could insert JavaScript or VBScript into input fields, which gets executed on the client-side.
Content Security Policy (CSP) Bypass: Attackers find ways to bypass Content Security Policies (CSPs) put in place to block malicious scripts from being executed on websites, leading to XSS-like effects or data leakage.
Browser Exploitation Framework (BeEF): This framework allows attackers to hook into the browsers of users who visit malicious or compromised sites, then use JavaScript payloads to exploit vulnerabilities, control sessions, or extract data.
Clickjacking: Users are tricked into clicking hidden buttons or links by overlaying malicious code on legitimate buttons. Attackers can execute unauthorized actions on behalf of the user, like changing security settings.
Remote File Inclusion (RFI): Attackers use file inclusion vulnerabilities to remotely execute malicious scripts from another server on the victim’s web application, gaining access to sensitive information or even full control over the server.
Scripted Botnet Attacks: Malicious scripts are deployed across multiple infected systems (botnets), allowing attackers to execute large-scale attacks like Distributed Denial-of-Service (DDoS) or perform web scraping, stealing data from websites.
JavaScript Keylogger Injection: Malicious JavaScript code is injected into web pages to log keystrokes entered by users. Attackers can capture login credentials, credit card information, or personal details this way.
DOM-Based XSS: A subtype of XSS, where the vulnerability exists in the client-side JavaScript (within the DOM structure). It doesn’t involve server interaction, making it harder to detect and prevent.
JavaScript-Based Cryptocurrency Mining (Cryptojacking): malicious JavaScript code is injected into a website that utilizes the user's CPU resources for cryptocurrency mining without their consent, slowing down their system and using their power.
Formjacking: malicious JavaScript is injected into web forms on e-commerce or other sites to steal users' inputted credit card details and other sensitive information.
Brute Force Attacks
Brute Force Attacks involve using automated tools to repeatedly attempt password guesses or encryption keys until the correct one is found. These attacks are simple but can be highly effective if proper security measures aren’t in place. There are various types of brute force attacks, each with its own method of execution:
Simple Brute Force Attack: This is the most basic form, where attackers try all possible combinations of a password or key manually or using automated software until the correct one is found. It can be very slow for strong passwords but effective against weak or short passwords. Example: An attacker tries every combination of a 4-digit PIN (0000 to 9999).
Dictionary Attack: Instead of trying every possible combination, attackers use a predefined list of common passwords (a "dictionary"). These lists often contain the most commonly used passwords, such as "password123" or "qwerty." It speeds up the process by focusing on commonly used or guessed passwords. Example: The attacker uses a dictionary of the top 1,000 most common passwords to crack a weak password like "123456."
Hybrid Brute Force Attack: A combination of dictionary attacks and brute force. The attacker first tries a dictionary of known or common passwords and then applies variations, such as adding numbers, special characters, or capitalization to improve chances of success. Example: An attacker tries "password123," "Password123!" or "Password@123" to increase the chance of guessing the right password.
Credential Stuffing: Attackers use username-password pairs obtained from previous data breaches to try on other websites, under the assumption that users often reuse passwords across different sites. This can be highly effective against users who don’t use unique passwords for different accounts. Example: An attacker tries the login credentials from a breached social media account on a bank website to gain unauthorized access.
Reverse Brute Force Attack: Instead of guessing the password for a specific username, attackers start with a known password or a set of commonly used passwords and try it across multiple usernames until they find a match. This attack exploits the fact that many users have weak passwords. Example: The attacker uses "password123" and tests it on various accounts in an organization until they find one that works.
Rainbow Table Attack: Attackers use precomputed hash values and their corresponding plaintext passwords to reverse the hashing process. Instead of hashing every guess during the attack, the attacker compares the target password’s hash to those in the rainbow table, speeding up the process significantly. Example: A hashed password (e.g., "5f4dcc3b5aa765d61d8327deb882cf99") is compared to a rainbow table to quickly find its plaintext value (in this case, "password").
Exhaustive Key Search (Key Brute Force Attack): Attackers systematically try all possible keys in an encryption system until the correct one is found. This is typically done against systems using cryptographic keys, such as encrypted databases or files. The length of the key determines how long the attack will take. Example: Trying all possible 128-bit encryption keys to decrypt a file.
Password Spraying: Unlike traditional brute force, where a single username is targeted, password spraying involves testing a few common passwords across a large number of accounts, often to avoid detection and account lockout mechanisms. Example: An attacker tries "Summer2024!" across many different user accounts within an organization, hoping to find a match without triggering too many lockouts.
Mask Attack: A more focused version of brute force where the attacker knows certain aspects of the password (like its length, specific characters, or format) and uses that information to narrow down the search space. This attack is often combined with brute force to make it more efficient. Example: If the attacker knows the password is 8 characters long and starts with "A," they will only try combinations that meet that pattern, significantly reducing the total number of guesses.
Distributed Brute Force Attack: Attackers use multiple machines or a botnet to divide the workload of a brute force attack, significantly speeding up the attack. This method is useful for attacking more complex or well-secured systems where a single machine might take too long to succeed. Example: A large botnet attempts to brute force multiple accounts simultaneously, with each bot trying a portion of the possible combinations.
Offline Brute Force Attack: In offline attacks, attackers obtain a file of hashed passwords (e.g., through a data breach) and use brute force on their own systems without any risk of detection by the target system. This is faster because the attacker doesn’t have to worry about account lockouts or rate-limiting. Example: An attacker uses a hash file from a compromised database to try all possible passwords offline until they find the correct one.
Watering Hole Attacks
Attackers compromise websites that a target group is known to frequent, delivering malware to anyone visiting the site. Watering hole attacks can take various forms based on the techniques and strategies employed by attackers. Here are some types of watering hole attacks:
Malicious Code Injection: Attackers exploit vulnerabilities in a legitimate website to inject malicious scripts or code. When users visit the compromised site, the malware is delivered to their devices. Example: A hacker finds a vulnerability in a popular industry news website and injects JavaScript that downloads malware onto visitors' devices.
Drive-By Downloads: This method involves placing malicious code on a website that automatically downloads malware onto a user's device without their consent when they visit. Example: Users visiting a compromised blog are unaware that malware is being silently downloaded and installed as soon as the page loads.
Compromised Third-Party Resources: Attackers may target third-party resources or plugins commonly used by a website (like ads, widgets, or analytics tools). When the third-party service is compromised, any site using it can also distribute malware. Example: A popular ad network is hacked, and all websites displaying ads from that network inadvertently deliver malware to their visitors.
Social Engineering Techniques for Websites: Attackers might create a fake website that mimics a legitimate site frequented by the target group. Users are tricked into visiting this malicious clone instead of the genuine site. Example: An attacker creates a fake version of a popular industry forum to lure users into providing their credentials or downloading malicious content.
Spear Phishing with Watering Hole Tactics: Attackers combine watering hole tactics with spear phishing, where they first send targeted emails to individuals containing links to compromised sites. Example: A targeted email is sent to an employee with a link to a compromised vendor's website, leading to malware installation when the link is clicked.
Malicious Redirects: Attackers can manipulate a legitimate site to redirect visitors to a malicious website that hosts malware. Example: A well-known industry website has its URL modified to redirect users to a fake site where malware is hosted.
Targeted Exploit Kits: Exploit kits are packages of malicious code that attackers use to target specific vulnerabilities in users' browsers or devices. When a user visits the compromised site, the exploit kit assesses the user's environment and delivers the appropriate malware. Example: A watering hole site is rigged with an exploit kit that can identify outdated software on the user's device and exploit vulnerabilities to install malware.
Session Hijacking: Attackers can compromise a legitimate site to steal session cookies or tokens, allowing them to hijack user sessions on other sites. Example: A compromised site collects session cookies from users logged into their bank accounts, enabling attackers to gain unauthorized access.
Credential Harvesting: Attackers create fake login forms on compromised sites to collect usernames and passwords from unsuspecting users. Example: Users are redirected to a login page that looks like their company's portal, and when they enter their credentials, those are sent directly to the attackers.
Phishing via Watering Hole: Attackers may use watering hole tactics to distribute phishing links, leading users to a site designed to capture sensitive information. Example: A compromised forum contains posts with links to phishing sites where users are tricked into entering personal information.
General cybersecurity advice for business
Cybersecurity is essential for businesses of all sizes. A strong cybersecurity posture can help to protect your business from data breaches, financial losses, and reputational damage.
Here are some tips for how small businesses can protect themselves from cyber threats:
Keep your software up to date.
Use strong passwords and enable two-factor authentication.
Be careful about what information you share online.
Train your employees on cybersecurity awareness.
Consider partnering with a IT service provider like Cyberkite that offers cybersecurity services.
Cyberkite offers comprehensive remote support services to help small businesses protect themselves from cyber threats.
Our team of security experts can help you to identify and address your vulnerabilities, develop a cybersecurity plan, and implement security controls.
Contact Cyberkite to learn more about how we can help you to keep your business safe: cyberkite.com.au/cybersecurity
There is a lot more folks. Stay tuned as we add them all in here.
