Cyber Security
An attack occurs when an unauthorized individual or group of individuals attempt to access, modify, disrupt or damage systems.
Typically they try to accomplish one or more goal:
- Someone wants to access your resources.
- Wants to modify information.
- Is attempting to disrupt your network and services.
Common Attacks
Dumpster diving (Security)
Dumpster diving is a technique used to retrieve information that could be used to carry out an attack on a computer network.
Link to originalShoulder Surfing
Shoulder surfing is the practice of spying on the user of a cash-dispensing machine or other electronic device in order to obtain their personal identification number, password, or other confidential PII.
Link to originalTailgating (Security)
Tailgating is where a bad actor follows an authorized person through a security checkpoint or door to gain access.
Link to originalImpersonation
Impersonation involves an attack masquerading as a valid network user, usually someone with higher privileges.
Link to originalPhishing
Phishing is sending fradulent communciations which appear to come from a reputable source.
Link to originalBackdoor attacks
Backdoor attacks where malicious attackers either introduce a hook into a system or takes advantage of troubleshooting procedures. Usually used to bypass authentication. Most common strategies include: Exposed administration interfaces, redundnt interfaces, hidden parameters, redundant users, authorization for 3rd parties, old users in systems, and exposed configuration data.
Link to originalMan-in-the-middle attacks
Man-in-the-middle attack is an access attack but it can be used to modify data.
IP spoofing
IP spoofing: Making data look as if it came from a trusted hosted when it actually didn’t.
Link to originalDNS spoofing
DNS spoofing: Redirecting a user to a fake website rather than the real one they intended to visit.
Link to originalHTTPS spoofing
HTTPS spoofing: Trying to make a victim believe they are visiting a trusted website.
Link to originalARP spoofing
ARP spoofing: With ARP poisoning, an attacker sends ARP messages onto a local area network, this can be used to trick devices to connect to different devices.
Link to originalSSL hijacking
SSL hijacking: Attacker forges SSL handshake and intercepts information between victim and target. Typically they try to downgrade the connection.
Link to originalEmail hijacking
Email hijacking: Hacker compromises and gains access to a victim’s email account.
Link to originalWi-Fi eavesdropping
Wi-Fi eavesdropping: Setting up Wi-Fi networks with purpose of redirecting traffic through them.
Link to originalSession hijacking
Session hijacking: Stealing browser cookies or data that authenticates a user with a website.
Link to original
Brute-force attacks
Brute-force attacks are where the attacker tries every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained.
Link to originalSQL injection
SQL injection: Injecting malicious code into a server that uses SQL and forcing it to reveal or execute malicious code.
Link to originalDenial-of-service attack
Denial-of-service attack: Flooding systems or servers with traffic to exhaust resources and bandwidth.
- Volume-based attacks:
UDP flood
A UDP flood is a form of volumetric DoS attack where the attacker targets and overwhelms random ports on the host with UDP packets.
Link to originalICMP flood
ICMP flood is a flood of ping requests. (ICMP echo request packets)
Link to original
- Application attacks:
HTTP flood
A HTTP flood is a Layer-7 application attack that uses botnets, attacker spams HTTP requests to host.
Link to originalSlow Loris
Slow Loris sends small portions of a HTTP request to a server. These are sent in timed intervals so the request does not time out, the server runs out of available connections.
Link to original
- Protocol attacks:
TCP SYN flood
TCP SYN flood is where an attacker sends seemingly normal SYN requests to a server which cause it to respond with SYN-ACK packets. This causes the target machine to slowly run out of memory as it waits for ACK packets from the attacker.
Link to originalPing of Death
A Ping of Death is where an attacker tries to crash or freeze a server by sending a normal ping request that is either fragmented or oversized.
Link to original
- Volume-based attacks:
Zero-day exploit
Zero-day Exploit: An exploit of this kind is usually either found by attackers and quickly patched or found by security researchers, either way as soon as people find out about it there is a window of opportunity where systems are still unpatched and vulnerable.
Link to original