Introduction
In today's digital world most of activities rely on the internet. Tons of data and sensitive information is shared over internet each millisecond. Internet is having high risk of intrusion by hackers, frauds and cybercriminals, internet security is a top priority for individuals and businesses alike.
Internet Security is the branch of Computer Security. Internet Security consists of a range of security tactics for protecting activities and transactions conducted online over the internet.
Today we will see some of the threats and tactics to secure. To start lets see who are the Threat Actors.
Threat Actors
Figure 1: Threat Actors
A threat actor or malicious actor is either a person or a group of people that take part in an action that is intended to cause harm to the cyber realm including: computers, devices, systems, or networks.
Open Source Intelligence
Information from websites, such as CEO of the company
Similarly many post information from social media such as Facebook and Twitter
Script Kiddie
Uses existing computer scripts or code to launch attacks
Motivations vary, but typically boredom
Organised Crime
Cyber criminals have two main objectives. First, they want to take infiltrate a system to access valuable data or items.
Second, they want to ensure that they avoid legal consequence after infiltrating a system.
Cyber criminal can be broken down into three sub-groups: mass scammers/automated hackers, criminal infrastructure providers, and big game hunters
Hactivist
Launches attacks as part of activist movement or a further cause, usually not for own benefit but instead increase the awareness
Insider
Anyone who is legitimate to access an organisation's internal resource. Issues, loss of confidentiality, internal resource, availability of organisation's assets
Competitors
Outside organisations seeking to commit corporate espionage for financial or market gain
Example - APT10
About
APT10 is a Chinese group that has been around since early 2009. Their primary mission seems to be targeting defence contractors around the world. Some other names they go by are Potassium and Red Apollo.
Techniques
Some techniques used for recon and initial compromise include advanced spear phishing from a known email domain (spoofed), and creating fake video game advertising emails as well.
Tools
Popular tools used by APT10 include Haymaker backdoor, Sungridge, and the Bug Juice backdoor
Targets
Main targets for APT 10 are any government entities, defence contractors, healthcare and U.S. Lobby groups, agencies or groups in major countries including the US, France and Germany being of the largest.
Below are some of the Malware Types explained.
Virus
Figure 2: Virus
- Virus is a malicious code that attach itself to the host application, when the application runs the malicious code also runs
- Virus is abbreviation of Vital Information Resources Under Siege
Virus are named after human, as it propagates device to device
It doesn't needs who click anywhere but it needs to be executed as a program
Virus won't show up or cause damage immediately, because it takes time to replicate first
The user often executes the virus though its not intentional, but often times OS system will automatically execute after user interaction, eg: usb drive
Virus types:
Program virus
Boot Sector virus
Script virus
Macro virus
Though anti-virus is very common, thousands of new virus is released every week
Have anti-virus updated always to be secure.
Worms
Figure 3: Worms
Worms is a self replication malware that travels throughout the network without any assistance of a host application or user interaction
A worm reside in memory and can use different transport protocols to travel over the network
Each infected systems tries to locate and infect other systems on the network, and network performance can slow to crawl
Devices infected with worms will show symptoms of erratic behaviour and slow response times.
Any code designed to do more than spread the worm is typically referred to as the "payload". Typical malicious payloads might delete files on a host system (e.g., the ExploreZip worm)
If the worms are well known we can remove it from the the firewalls and IDS | ISP (Intrusion Prevention/Detection System) can mitigate many worms infections, but doesn't help much once the worms get inside
As said getting rid of worms isn’t impossible, but may result in a clean wipe of the device and its files.
Trojan
Figure 4: Trojan
Software that pretends to be something else, so it can conquer your computer
Trojan doesn't really cares about replication
Circumvents your existing security
Once its inside it has free reign, and it opens back door
Trojan horse can come as pirated software, as useful utility, game or something else the user wants to download
Another method of Trojan is Rogueware
Rogueware masquerades as a free antivirus program
When a user visits a site, a message on the web page or a pop-up appears indicating it detected malware on the user's system
The user is encouraged to download and install the free antivirus software
Never download or install software from a source you don't trust completely.
Never open an attachment or run a program sent to you in an email from someone you don't know.
Keep all software on your computer up to date with the latest patches.
Ransomware
Figure 5: Ransomware
A specific type of Trojan is Ransomware, attackers encrypt the users data or take control of the computer and lock out the user
Then they demand that the user pays a ransom to regain access to the data or the computer
Criminals often deliver ransomware via drive by downloads or embedded in other software delivered via email
Attackers originally targeted the individuals with ransomware
However they have increasing been targeting organisations demanding larger and larger ransom
Crypto Malware, new generation ransomware
After the pandemic the increased trend of cyber attacks that began in 2020 showed no signs of slowing down.
Example – JBS Foods:
High-profile ransomware attack took place this May on JBS Foods, one of the biggest meat processing companies in the world.
The same Russia-based hacking group that attacked Acer, REvil, is thought to be behind the attack.
Although there weren't any major food shortages as a result of the attack, government officials told consumers not to panic buy meat in response.
On June 10th 2021, it was confirmed that JSB paid the $11 million ransom demand after consulting with cybersecurity experts.
This massive payment in bitcoin is one of the largest ransomware payments of all time.
Reference: https://illinois.touro.edu/news/the-10-biggest-ransomware-attacks-of-2021.php
Keylogger
Figure 6: Keylogger
Keyloggers capture a user's keystrokes and stores them in a file
This file can be automatically sent to an attackers or manually retrieved depending on the keylogger
Keylogger is a software
Your key strokes are in a saved in a clear text
Other data logging, could be also done, such as clipboard, screen shot, instant messaging, search engine
Keylogger is usually installed with the any other malware
Recommended you to block unauthorised communication, through firewall and monitoring
Spyware
Figure 7: Spyware
Spyware monitors a user's computer and often includes a keylogger
Malware that spies on you, advertising, identity theft, affiliate fraud
Spyware is a software installed on the user's systems without their awareness or consent
Its purpose is often to monitor the user's computer and user's activity
Spyware takes user's computer information to third party, its private data, it would result in loss of confidentiality
Poor performance, installing additional software within the browser, changing the user's home page
Can trick you into installing, peer to peer, fake security software
Adware
Figure 8: Adware
Biggest ways to make money is through ads, the bad guys target's users by installing adware by making your computer
Showing popups after popups
May also cause performance issues
Internet marketers, have become very sophisticated and use a combination of web and user behaviour analytic, track users habits for the purpose of targeting advertisements
As this became more malicious by gathering more information of use that people starting calling as spyware
Removing of adware is very challenging as its difficult to trust who would remove, because the authors would have removal software but that would end up having more adware to be installed
Adware also applies to software that is free but includes ads, not like paid versions
Bot and Botnets
Figure 9: Botnet
Bots are software robots
Botnet combines the words robot and network
Both are often called zombies and they will do the bidding of whoever controls the botnet
Bot herders are criminals who manage botnets, they attempt to infect as many computer and control from one or many servers running command control software
A day of life of bot, sit around and wait for instructions
Most computer join a botnet through malware infection
Eample: Botnet – Mirai, 2016, launched an attack against DNS server, including simple devices such as digital cameras, printers that are connected to the internet, and the bot herders directed the device to repeatedly query DNS servers in protracted distributed denial of servers (DDOS) attack
Social Engineering
Figure 10: Social Engineering
Social engineering is the practice of using social tactics to gain information or performing actions they wouldn't normally take.
These attacks can occur in person, over the phone, while surfing the internet and via email
Using flatter and conning
Assuming a position of authority
Encouraging someone to perform a risky action
Encouraging someone to reveal sensitive information
Impersonating someone, such as an authorised technician
Tailgating or closely following authorised personnel without providing credentials
Impersonation
Figure 11: Impersonation
Some social engineers often attempt to impersonate others
The goal is to convince an authorised user to provide some information or help the attacker defeat a security control
Dumpster Diving
Figure 12: Dumpster Diving
Is a practice of searching through the trash to gain information from the discarded documents
Many organisation shred or burn instead of throwing to away
Shoulder Surfing
Figure 13: Shoulder Surfing
Shoulder surfing is simply looking over the shoulder of some to gain information
When a user is at computer or remotely using camera
Prevention, position of monitors to that unauthorised personal cannot see them
Screen Filters help to prevent by obscuring the view for people unless they are directly from of the monitors
Phishing
Figure 14: Phishing
Spam is unwanted email, phishing is malicious spam
Attackers attempt to trick users into revealing sensitive or personal info or clicking on a link
Beware of emails from friends, impersonating friends using social media
Phishing to install malware, attach email with malware and sent across
Could be to validate your email address
Phishing:
Emails are typically sent by a known contact or organisation including malware
Spear Phishing
Same goal, but the attackers first gather information is used to personalise the spear phishing attack
Whaling
Same personalised technique is used but to attack for specifically high profile targets
Vishing
Figure 15: Vishing
Vishing is the type of cyber attack in which voice communication is used for stealing the confidential data from group of people.
In vishing, attacker tricks the target to give the sensitive information through the voice call pretending to be an employee from the related and trusted firm.
Example –
Asking for bank transaction OTP from users.
Asking for UPI PIN from users.
Don't Share Personal Information Over the Phone
Don't Answer Calls From Unknown Numbers
Ask for Proof of Identity Report
Malware Spread
Figure 16: Malware Spread
So far we have seen many types of Malwares.
Malware spreads in computer when downloaded or install an infected software.
Could be through ad or suspicious popup ads.
They also enter your computer through an email or a link.
Once malware enters the computer, it attaches itself to different files and overwrites the data.
As malware travels within the network, it infects the computer it moves into.
Advisable to have anti-virus up to date, and configured required firewalls.
Security Measures
As said prevention better than cure, very much applies to cyber security. Below are few measures should aim to prevent risks from various sources.
Awareness
Education
Anti Virus
Backups
Patching
Strong Passwords
Spam Filters
Firewalls
Encryption
Hashing
Digital Signature
Monitoring
Reference:
Different links from https://en.wikipedia.org/
Credits to the different sources from there taken these images
