Cybersecurity attacks

Question 1

Past cyberattacks:
Give 2 examples of early malware attacks

Answer 1

Brain virus
Morris worm.

Question 2

Explain the Brain Virus

Answer 2

1986- Alvi Brothers
Intention:- To track illegal copies of medical software & pirated licenses.

Operation: Once a person used a pirated copy of the software, the virus infected that computer. Then, any disk that was inserted into the computer was also infected. The virus spread to a new computer every time someone used one of the infected disks.

Effect:- Undetected, the virus spread globally within a couple of months. Although the intention was not to destroy data or hardware, the virus slowed down productivity and significantly impacted business operations.

Result:- Altered the computer industry highlighting the need for security and productivity maintenance planning.

Question 3

Explain the Morris Worm

Answer 3

1988- Robert Morris
Intention:- A program to assess the size of the internet.

Operation: The program crawled the web and installed itself onto other computers to tally the number of computers that were connected to the internet.

Effect:- The program was flawed and failed to keep track of the computers it had already compromised and continued to re-install itself until the computers ran out of memory and crashed.
About 6,000 computers were affected, representing 10% of the internet at the time. This attack cost millions of dollars in damages due to business disruptions and the efforts required to remove the worm.

Result:- Computer Emergency Response Teams, known as CERTs®, were established to respond to computer security incidents.
CERTs Computer Emergency Response Teams still exist today, but their place in the security industry has expanded to include more responsibilities

Question 4

What does ‘CERTs’ stand for?

Answer 4

Computer Emergency Response Teams, known as CERTs®

Question 5

What was the Loveletter attack?

Answer 5

2000 - Onel De Guzman
Intention:- To steal internet login credentials

Operation: Spread rapidly and took advantage of people who had not developed a healthy suspicion for unsolicited emails.

Users received an email with the subject line, “I Love You.” Each email contained an attachment labeled, “Love Letter For You.”
When the attachment was opened, the malware scanned a user’s address book. Then, it automatically sent itself to each person on the list and installed a program to collect user information and passwords. Recipients would think they were receiving an email from a friend, but it was actually malware.

Effect:- Infected 45 million computers globally and is believed to have caused over $10 billion dollars in damages.
The LoveLetter attack is the first example of social engineering.

Result:- Attackers understood the power of social engineering and the number of social engineering attacks is increasing with every new social media application that allows public access to people’s data. Many people are now prioritizing convenience over privacy. The trade-off of this evolving shift is that these tools may lead to increased vulnerability, if people do not use them appropriately

Question 6

What is Social Engineering?

Answer 6

Social engineering is a manipulation technique that exploits human error to gain private information, access, or valuables.

Question 7

What was the Equifax Breach?

Answer 7

2017- Not named
Intention:- To steal Equifax customer records (PII). Equifax is a credit report agency

Operation: Infiltration data breach

Effect:- Over 143 million customer records were stolen, and the breach affected approximately 40% of all Americans. The records included personally identifiable information including social security numbers, birth dates, driver’s license numbers, home addresses, and credit card numbers. From a security standpoint, the breach occurred due to multiple failures on Equifax’s part. It wasn’t just one vulnerability that the attackers took advantage of, there were several. The company failed to take the actions needed to fix multiple known vulnerabilities in the months leading up to the data breach. In the end, Equifax settled with the U.S. government and paid over $575 million dollars to resolve customer complaints and cover required fines.

Result:- companies to the financial impact of a breach and the need to implement preventative measures. Due to other data breaches before and after the Equifax breach resulting in the large settlement with the U.S. government.

Question 8

What is Phishing?

Answer 8

The use of digital communications to trick people into revealing sensitive data or deploying malicious software.

Question 9

Name some common types of phishing attacks today?

Answer 9

Business Email Compromise (BEC): A threat actor sends an email message that seems to be from a known source to make a seemingly legitimate request for information, in order to obtain a financial advantage.
Spear phishing: A malicious email attack that targets a specific user or group of users. Seemingly to originate from a trusted source.
Whaling: A form of spear phishing. Threat actors target company executives to gain access to sensitive data.
Vishing: The exploitation of electronic voice communication to obtain sensitive information or to impersonate a known source.
Smishing: The use of text messages to trick users, in order to obtain sensitive information or to impersonate a known source.

Question 10

What is smishing?

Answer 10

The use of text messages to trick users, in order to obtain sensitive information or to impersonate a known source.

Question 11

What is BEC?

Answer 11

Business Email Compromise (BEC):
A threat actor sends an email message that seems to be from a known source to make a seemingly legitimate request for information, in order to obtain a financial advantage

Question 12

What is vishing?

Answer 12

The exploitation of electronic voice communication to obtain sensitive information or to impersonate a known source.

Question 13

What is Spear phishing?

Answer 13

A malicious email attack that targets a specific user or group of users. Seemingly to originate from a trusted source.

Question 14

What is Whaling?

Answer 14

A form of spear phishing. Threat actors target company executives to gain access to sensitive data.

Question 15

What is Malware?

Answer 15

Software designed to harm devices or networks.

Question 16

Name some common types of Malware attacks

Answer 16

Viruses
Worms
Ransomware
Spyware

Question 17

What is Spyware?

Answer 17

Malware that’s used to gather and sell information without consent. Spyware can be used to access devices. This allows threat actors to collect personal data, such as private emails, texts, voice and image recordings, and locations.

Question 18

What is a virus?

Answer 18

Malicious code written to interfere with computer operations and cause damage to data and software. A virus needs to be initiated by a user (i.e., a threat actor), who transmits the virus via a malicious attachment or file download. When someone opens the malicious attachment or download, the virus hides itself in other files in the now infected system. When the infected files are opened, it allows the virus to insert its own code to damage and/or destroy data in the system.
Example of Malware

Question 19

What is a worm?

Answer 19

Malware that can duplicate and spread itself across systems on its own. In contrast to a virus, a worm does not need to be downloaded by a user. Instead, it self-replicates and spreads from an already infected computer to other devices on the same network.

Question 20

What is Ransomware?

Answer 20

A malicious attack where threat actors encrypt an organization’s data and demand payment to restore access.
Example of malware

Question 21

Name some common types of Social Engineering attacks

Answer 21

Social media phishing
Watering hole attack
USB baiting
Physical social Engineering

Question 22

What is USB baiting?

Answer 22

A threat actor strategically leaves a malware USB stick for an employee to find and install, to unknowingly infect a network.
Physical social engineering: A threat actor impersonates an employee, customer, or vendor to obtain unauthorized access to a physical location.

Question 23

What is Social Media Phishing?

Answer 23

A threat actor collects detailed information about their target from social media sites. Then, they initiate an attack.

Question 24

What is a Watering hole attack?

Answer 24

A threat actor attacks a website frequently visited by a specific group of users.

Question 25

What is Physical Social Engineering?

Answer 25

A threat actor impersonates an employee, customer, or vendor to obtain unauthorized access to a physical location.

Question 26

Why are social engineering attacks effective?

Answer 26

People are generally trusting and conditioned to respect authority.
Attacks are increasing with every new social media application that allows public access to people’s data.

Reasons why social engineering attacks are effective include:
*Authority: Threat actors impersonate individuals with power. This is because people, in general, have been conditioned to respect and follow authority figures.

*Intimidation: Threat actors use bullying tactics. This includes persuading and intimidating victims into doing what they’re told.

*Consensus/Social proof: Because people sometimes do things that they believe many others are doing, threat actors use others’ trust to pretend they are legitimate. For example, a threat actor might try to gain access to private data by telling an employee that other people at the company have given them access to that data in the past.

*Scarcity: A tactic used to imply that goods or services are in limited supply.

*Familiarity: Threat actors establish a fake emotional connection with users that can be exploited.

*Trust: Threat actors establish an emotional relationship with users that can be exploited over time. They use this relationship to develop trust and gain personal information.

*Urgency: A threat actor persuades others to respond quickly and without questioning.

Question 27

Threat actor types

Answer 27

APT Advanced Persistent Threats
Insider threats
Hacktivists

Question 28

APT Advanced Persistent Threats

Answer 28

Threat actors that have significant expertise in accessing an organisation’s network without authorisation.
Research their targets in advance and can remain undetected for an extended period of time.

Intentions and motivations can include:
*Damaging critical infrastructure:
i.e. the power grid and natural resources
*Gaining access to intellectual property:
i.e. trade secrets or patents

Question 29

Insider threats

Answer 29

Threat actors that abuse their authorised access to obtain data that may harm an organisation.

Intentions and motivations can include:
*Sabotage
*Corruption
*Espionage
*Unauthorized data access or leaks

Question 30

Hacktivists

Answer 30

Threat actors, driven by political agenda. Abuse technology to accomplish their goals, which may include:
*Demonstrations
*Propaganda
*Social change campaigns
*Fame

Question 31

What is a Hacker?

Answer 31

A hacker is: any person who uses computers to gain access to computer systems, networks, or data.
They can be beginner or advanced technology professionals who use their skills for a variety of reasons.

Question 32

What are the 3 main types of hackers?

Answer 32

There are three main categories of hackers:
Authorized hackers, also called ethical hackers.

Semi-authorised hackers-also called researchers.

Unauthorized hackers, also called unethical hackers.

Note: There are multiple hacker types that fall into one or more of these three categories.

Question 33

What is an Authorized hacker?

Answer 33

Also called ethical hackers.
They follow a code of ethics and adhere to the law to conduct organizational risk evaluations.

They are motivated to safeguard people and organizations from malicious threat actors.

Question 34

What is a Semi-authorised hacker?

Answer 34

Semi-authorized hackers are considered researchers.
They search for vulnerabilities but don’t take advantage of the vulnerabilities they find.

Question 35

What is an Unauthorized hacker?

Answer 35

Also called unethical hackers.
They are malicious threat actors who do not follow or respect the law.
Their goal is to collect and sell confidential data for financial gain.