Cyber Security (Part5): Cyber Threat

Types of Cyber Threats

Photo by Peter Conrad on Unsplash

Malware

Malware is an all‑encompassing term for a variety of cyberattacks, including Trojans, viruses, and worms. Malware is simply defined as code with malicious intent that typically steals data or destroys something on a computer. How malware causes damage is useful for categorizing what type of malware you’re dealing with. Let’s discuss the main types:

• Viruses Like their biological namesakes, viruses attach themselves to clean files and infect other clean files. They can spread uncontrollably, damage a system’s core functionality, and delete or corrupt files. They usually appear as executable files that might be downloaded from the internet.
• Trojans Trojans disguise themselves as legitimate software or hide inside legitimate software that has been tampered with. They tend to act discreetly and create backdoors in your security to let other malware in.
• Worms Worms propagate across networks (local or the Internet) by using network interfaces. Each infected machine is used to infect more machines, allowing worms to spread rapidly.
• Botnets Botnets are networks of infected computers controlled by an attacker. The infected machines (bots) are made to work together under a central controller.

You can encounter malware if you have unpatched vulnerabilities, download illegitimate software, or open a compromised email attachment.

How to remove / defend against malware

Each form of malware infects and damages systems differently, so removal methods differ. Preventive measures include:

• Avoid clicking links or downloading attachments from unknown senders.
• Deploy a robust, updated firewall to limit suspicious network transfers.
• Keep your operating system (Windows, macOS, Linux) and applications fully updated — developers regularly release patches to close security holes.
• Use reputable, up‑to‑date antivirus/anti‑malware tools and perform regular scans.

Phishing

Phishing is an attack that impersonates a trusted party (often via email) and asks users to click a link and enter personal data. Phishing messages have become more sophisticated and harder to distinguish from legitimate requests.

Phishing often resembles spam but is far more harmful. Commonly targeted brands include banks, credit-card companies, and major online services (Amazon, eBay, Facebook, etc.). Phishing is not limited to email — web pages, pop-ups, SMS, and messaging apps can also be used.

Typical phishing process (five steps)

1. Planning — The phisher chooses which organization to impersonate and finds methods to obtain potential victims’ contact addresses.
2. Setup — The attacker prepares delivery and data-collection methods (spoofed email templates, fake websites, etc.).
3. Execution — The attacker sends a phony message that appears to come from a reputable source.
4. Collection — The attacker records information victims enter into the fake pages or pop-ups.
5. Fraud — The attacker uses the harvested data to commit identity theft, make illegal purchases, or other fraud. Many victims never fully recover.

How to spot and prevent phishing

• Phishing emails often use generalized salutations like “Dear customer” instead of your name.
• Inspect the sender’s email address — display name may say “Amazon,” but the actual address may be unrelated or suspicious
• Hover over links to see the real destination URL (for example, www.fake‑amazon.com).
• Report suspected phishing emails to your IT/security team or administrators.

Aawareness only: An attacker can copy a legitimate login page (e.g., Facebook), host it on a fake site, and log any credentials entered into a backend file. The page may then redirect to the real site so the victim doesn’t notice anything wrong. This technique is illegal and discussed here only to raise awareness.

Password Attacks

A password attack is any attempt to obtain or decrypt a user’s password for unauthorized use. Attackers use cracking programs, dictionary attacks, and password sniffers.

Common methods

• Brute-force attack: A program tries many possible password combinations until it finds the correct one. Attackers often start with easily guessed passwords.
• Dictionary attack: The attacker cycles through a list of common words and likely variations (this works because many users choose short, easily guessed passwords).
• Keylogger: Malware records keystrokes so the attacker captures everything typed, including login IDs and passwords. This method is different from brute-force/dictionary attacks because it requires the keylogger malware to be present on the device; strong passwords don’t protect against keyloggers.

Password cracking is often used to gain unauthorized access to accounts, financial data, or other sensitive resources.

Defense and best practices

• Use long, complex passwords that combine letters (upper and lower), numbers, and symbols.
• Avoid single dictionary words or common phrases — use passphrases or generated “garbage” strings that make no semantic sense.
• Change passwords regularly and do not reuse them across multiple services.
• Enable multi‑factor authentication (MFA) wherever possible — MFA mitigates risks from stolen passwords and keyloggers.
• Use a reputable password manager to create and safely store unique passwords for each account.

DDoS Attacks

What is a DDoS or DoS attack?

A DoS attack focuses on disrupting access to a network or service by overwhelming it with traffic. Attackers send a high volume of data through the network until it becomes overloaded and can no longer function.

• The distributed version (DDoS) uses multiple computers to send traffic simultaneously, making it harder to block.
• Many times, users don’t realize their computers have been hijacked and are unknowingly contributing to the attack.

Why is it serious?

Disrupting services can have severe consequences, impacting security and online access. Large-scale DDoS attacks have sometimes been used as a form of protest against governments or individuals, leading to major legal punishments including jail time.

How to prevent DDoS attacks?

• Unless your company is very large or high-profile, you’re unlikely to be targeted directly.
• However, your network could still be affected if another organization on your network is attacked.
• To reduce risk: keep your systems secure with regular updates, monitor online security, and watch for unusual spikes in network traffic.
• Physical security matters too — disrupting physical connections (like unplugging cables) can also cause denial of service. So, monitor physical network infrastructure.

Man-in-the-Middle (MitM) Attacks

What is a MitM attack?

A MitM attacker impersonates the two communicating parties to intercept information. For example, when banking online, the attacker pretends to be your bank when communicating with you, and pretends to be you when communicating with the bank, capturing sensitive data like account info and passwords.

How does it work?

• Usually happens via a non-encrypted wireless access point (no WPA/WPA2 security).
• The attacker spoofs the Address Resolution Protocol (ARP), which maps your computer to the gateway, allowing them to intercept your data.

How to prevent MitM attacks?

• Use encrypted wireless access points (WPA2 or WPA3).
• Always check for secure connections — the URL should start with https:// and show a lock symbol. If HTTPS is missing or stripped away, your connection is insecure.
• Use a Virtual Private Network (VPN) to encrypt your internet traffic and mask your IP address.

Drive-by Downloads

What is it?

Gone are the days when you had to click “accept” to download malicious software. Now, just visiting a compromised webpage can silently download dangerous code onto your device without your knowledge.

• Drive-by downloads exploit outdated browsers, apps, or operating systems with security flaws.
• The initial downloaded code is often small and contacts another server to download the full malware payload.
• Webpages often contain multiple types of malicious code to increase the chance of infection.

How does it work?

• When you visit a malicious site, during the TCP three-way handshake, a backend script triggers a download as soon as the connection is established.
• Malware is injected into your system silently.

How to avoid drive-by downloads?

• Avoid visiting risky websites, such as adult content, file-sharing sites, or suspicious offers (e.g., “free trip to the Bahamas”).
• Keep your browser and operating system fully updated.
• Use safe browsing tools that warn about malicious sites.
• Install comprehensive security software like McAfee All Access and keep it updated.

Malvertising (Malicious Advertising)

What is malvertising?

Malvertising refers to criminally controlled ads designed to infect users’ devices. These ads appear on legitimate websites and look normal but contain hidden code that redirects your browser to criminal servers to deliver malware.

• The malware catalogues details about your computer and location before deciding which malware to send.
• Infection happens without opening new windows or obvious signs — you won’t know it’s happening.

How to stop malvertising?

• Use an ad blocker extension on your browser (Chrome, Safari, Firefox).
• Keep your browser and related software updated.
• Practice common sense: never click ads promising lottery wins, free money, or anything too good to be true — they’re usually scams that inject malware.

Rogue Security Software

What is Rogue Security Software?

Rogue security software is a type of malicious software and internet fraud that misleads users into believing their computer is infected with viruses or malware. It then manipulates them into paying money for a fake malware removal tool.

This is a type of scareware — software designed to frighten the user — and sometimes acts like ransomware, locking certain features until payment is made. Rogue security software has been a serious threat in desktop computing since as early as 2008.

How does Rogue Security Software work?

Attackers use several tactics to trick users into downloading the rogue software:

• Fake Ads or Free Trials Pop-up ads or banners offering “free” or “trial” versions of antivirus tools. These often lead to aggressive upselling or fake “premium” versions.
• Scare Pop-Ups Sudden pop-ups warn the user: “Your computer is infected!” and prompt the user to click to remove the supposed threats, which downloads the rogue program.
• Manipulated Search Engine Rankings (SEO) Attackers may artificially boost infected websites to appear as top search results. When users click these links, they are redirected to a landing page claiming their machine is infected and urging them to download the rogue tool.

Once installed, rogue security software can:

• Steal personal information
• Slow down your system
• Corrupt or delete files
• Disable legitimate antivirus software updates
• Block access to trusted security vendor websites

How to Prevent Rogue Software Infections

“The best defense is a good offense.”

Here’s how you can protect yourself and your organization:

Use a robust, updated firewall Ensure your system or office network has a properly configured firewall to block suspicious activity and downloads.

Install trusted antivirus/anti-spyware tools Use well-known, up-to-date security software that can detect and block rogue programs.

Stay skeptical online Don’t trust every warning or pop-up that appears. Be cautious with unfamiliar ads or download prompts. If something claims your system is infected, verify it through your actual security software — not a pop-up.

Keep your OS and browser updated Software updates often patch the very vulnerabilities that rogue software exploits.