Cyber attacks have exploded in recent years
With so many cyberattacks occurring around the world every day, it can be difficult to determine which threats are real and which are hype and sensationalism.
Cyberattacks are on the rise, becoming the second most common cause of loss after accidents, resulting in an estimated average annual cost of between $400 million and $1 billion per organization. According to Gartner’s 2016 Global Information Security Survey, 81 percent of organizations experiencing cybersecurity breaches go out of business within 18 months. The survey also reveals that the success rate is very low when it comes to fighting cyberattacks: less than 1% of all attacks are stopped by their firewalls alone.
The most common types of cyberattacks are computer viruses, denial-of-service (DoS) attacks and social engineering. These attacks have become more common than ever as the number of Internet users increases every day.
However, let’s examine and understand the 10 most common types of cyber attacks to develop and improve your organization’s cyber defense to strengthen its security.
1: Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacks
A Denial of Service attack (DoS attack) is a computer attack aimed at making a service unavailable, preventing legitimate users of a service from using it.
It can be :
-
- flooding a network in order to prevent it from functioning;
- disruption of connections between two machines, preventing access to a particular service
- obstructing access to a service for a particular person;
- sending billions of bytes to an Internet box.
The denial of service attack can block a file server, make it impossible to access a web server or prevent the distribution of email in a company.
2 : Malware attack
Malware is software designed to harm the user. It not only affects the computer or device it infects first, but potentially all devices it communicates with.
Malware can be :
-
- A virus: a program that inserts itself into the files of other programs and self-propagates to run on a device without the user’s knowledge or consent. The virus can act as a Trojan horse and cause damage directly on the infected device, or it can function as a backdoor that allows hackers to remotely access the device.
- Worm: A program that, like a virus, replicates and spreads across a network without human intervention. A worm can also install malware on infected devices.
- Trojan horse: software that looks like useful code but hides its true purpose until it is executed by the user (who is then prompted to activate the malware). The Trojan horse can send sensitive information back to its creator.
- Ransomware: software that encrypts the data on your computer or device to block access until you pay for its release (usually in bitcoins).
3: Phishing and spear phishing
Spear phishing attacks are very common forms of email attacks designed to trick you into performing a specific action, usually by clicking on a malicious link or attachment. The difference between these two types of attacks is mainly in the targeting:
Phishing emails are sent to a very large number of recipients, more or less at random, in the hope that a small percentage will respond. This information could then be sold on the black market or used for fraud or identity theft. The attacker can only know that this percentage is small, but he does not know exactly how many people respond to the attack.
Spear phishing emails are carefully designed to target a single recipient. Criminals choose a target within a company, using social networks and other public information, then craft a fake email specifically for that person.
4 : “Man-in-the-Middle” attack
A man-in-the-middle attack refers to a type of cyber attack in which a cybercriminal physically or logically installs a controlled system between the victim’s system and an Internet resource it uses. The attacker’s goal is to intercept, read or manipulate any communication between the victim and its resource without being noticed.
The most common form of man-in-the-middle attack is IP spoofing. The attacker replaces the IP address of a communication request with his own address and sends it to the server. The server then sends its response back to the cybercriminal who can either read the data or modify it before sending it to the recipient.
5: SQL Injection
SQL injection attacks are a particularly dangerous threat to database security. When an application interacts with a database, it uses SQL queries to perform functions such as searching and retrieving data. The query is used as the basis for the interaction.
When an attacker uses SQL attack methods, he or she first modifies an existing query to add malicious content. This content can be injected through a form or other means of accessing the system. Once injected, it can allow the attacker to access the database and modify its contents in many different ways that compromise the security of the system.
6: Zero-day exploits
Zero-day exploits are the latest security vulnerabilities detected that cybercriminals can use to gain access to computer systems. The term “zero-day” refers to the fact that security vendors and developers are unaware of these vulnerabilities and have “zero days” to fix them, making them extremely dangerous. If a cybercriminal launches an exploit before developers are able to patch it, it is a zero-day attack.
7: Drive-by attack
The drive-by download is a method to infect a computer through the Internet.
This attack has a particularity: it does not require any interaction from the victim, who only has to visit a web page for his system to be infected.
This is possible because many Internet users use software that is not up-to-date and still has vulnerabilities that are exploited by this type of attack.
Every software must be up to date to prevent vulnerabilities from being exploited by attackers. It is therefore important to check for updates regularly and install them as soon as possible.
8: Cookie theft
A cookie is an alphanumeric identifier that is stored in your browser. This means that every time you access a website, the server sends your browser data about your actions on that site. This data does not identify you by name, but it does identify the device you are using and can be used to track your activity on multiple sites and log in for you.
Cookie theft occurs when a third party copies unencrypted session data and uses it to impersonate the actual user. Cookie theft most often occurs when a user accesses trusted sites via a public or unprotected Wi-Fi network. Although the username and password for a given site are encrypted, the session data is not.
9: Cross-site scripting (XSS) attack
Cross-site scripting, commonly known as XSS, is a cyber attack that uses security holes in websites to inject code into their pages. This code then triggers actions on the user’s browser that can harm them or the site they are visiting.
However, there are many other types of XSS attacks that you should be aware of, as attackers can use any language supported by the browser.
10: Eavesdropping attack
Eavesdropping attacks are a form of network intrusion in which an attacker obtains sensitive information by intercepting network traffic, to obtain passwords, credit card numbers and other confidential information that users send over the network.
Eavesdropping can be either passive or active:
-
- Passive eavesdropping is when an attacker detects information by listening to the transmission of messages on the network.
- Active eavesdropping is when an attacker actively captures information by pretending to be a friendly unit and sending requests to the senders.
As you can see, there are several categories and types of cyberattacks. In addition, attackers have a wide variety of motivations for launching these attacks, including: a desire to destroy data, a desire to steal information or other digital files, a desire to disrupt operations, a desire to steal money or other valuables stored on a network. Unfortunately, many people do not take the threat of cyber attacks seriously enough!
Our expert web & mobile development teams constantly stay on top of trends to offer you the best service, if you want to know more from our experts, contact us.
Discover other articles on our blog about innovation and technology news.