The corona pandemic had been putting the whole world in a state of emergency since March last year. Cybercriminals took advantage of this state of emergency and increased the number of their attacks even further. Would you like to understand what is happening in the field of cybercrime? The following blog post gives you, among other things, an overview of the essential types of cyberattacks.
Definition: Cyber Attack
First of all, the question arises: what exactly is meant by a cyber attack? The Federal Office for Information Security (BSI) defines a cyber attack as follows:
The central point in this definition is that cyber-attacks take place in or via virtual cyberspace. So there is no physical attack, such as breaking a door.
In addition, you should be aware of the following: Even if this definition aims to impair IT security, the motivation behind this aim can be different. A monetary or political cause is possible, for example.
Types Of Cyber Attacks
Now that the definition of the term cyber-attack has been clarified, some cyberattacks will be explained below.
Phishing And Spear Phishing
Phishing is an attempt at fraud, the intention of which is to trick the victim into disclosing personal or financial information using a genuine-looking email. This is not a targeted attack. Instead, many emails are sent, hoping that some people will find the email “real” and act accordingly.
An Example To Illustrate This
Imagine receiving an email that looks like it came from your bank. In this email, you will be asked to change your password as it was stolen due to a security vulnerability. A link then appears to take you to your bank’s website, which is, however, a fake, and you enter your data there. The fraudster can then use the collected information for identity theft.
In this type of attack, the perpetrators often use trust in an institution, such as a bank, or emotions, such as fear, to manipulate the victims.
A modified form of phishing is spear phishing. This is a targeted phishing attack on specific people or organizations. The attacker informs himself beforehand about the victim and the general conditions so that the credibility of the emails or social media messages is exceptionally high.
DoS And DDoS Attacks
The idea behind the term Denial of Service (DoS) is to make something inaccessible or put it out of service. This is precisely the goal of a so-called denial-of-service attack. But how exactly does the technical implementation in the background look like? In such an attack, a server is overwhelmed with so many requests that it can no longer process them and, in the worst case, “collapses” under the load.
A distributed denial of service attack, also known as a DDoS attack, is a “distributed” DoS attack. This means that not individual systems but many different systems carry out a jointly coordinated attack. For this type of attack, hundreds to thousands of unprotected computers are infected with the attack software. These attacks are often particularly effective due to the large number of “attacking” systems.
Malware
The term malicious software or malware summarizes software that was developed to cause harm to the attacked user. The forms of malware can be very different. Two known forms are explained below.
Viruses
A computer virus is based on a program code that attaches to a host file and reproduces independently. When the host file is called, which can also be a program or a boot sector, the computer virus code is also executed. The function of such a virus can take different forms. For example, files can be deleted, the operating system can be prevented from running, or the hardware can be damaged.
Ransomware
Ransomware restricts the victim’s access to the system or completely prevents it from demanding a ransom from the victim for re-enabling the system. Whether the system will be unlocked after paying the ransom is not guaranteed for the victim, making dealing with such an attack even more difficult.
Man-In-The-Middle Attacks
In a man-in-the-middle attack, the attacker tries to communicate between two or more parties unnoticed, for example, to read information or manipulate the transmitted data. He proceeds so that he goes “in the middle” of the communication and poses as the receiver to the sender and as the sender to the receiver.
Attacks On Passwords
It is often the case that attackers aim to determine the passwords of users for specific platforms. One form of these so-called password attacks is the brute force method.
With the brute force method, different username/password combinations are tried out – usually with the help of an automated tool – until the correct one is found by chance. Instead of using a particular strategy, “brute force” is used to find out the password and “crack” the account. However, it should be taken into account that this method can be very time-consuming, depending on the complexity and length of the password. Brute force attacks also take various forms. One form of brute force attack is the dictionary attack.
If an attacker uses a dictionary attack, all words in the specified dictionary are tried. These words can then be supplemented with numbers or special characters to map an even more extensive range of passwords.
Examples Of Successful Cyber Attacks
Two well-known and extensive cyberattacks are briefly explained below to get a feel for the forms such a cyberattack can take.
WannaCry
WannaCry is one of the most significant cyberattacks with ransomware. In May 2017, more than 130,000 computers were attacked and encrypted in this cyber attack via a Windows security hole (EternalBlue) to demand a ransom then. The victims included Telefónica, Renault, and Nissan, as well as hospitals and ministries.
Yahoo Data Breach
In 2013 and 2014, two hacker attacks stole data from over a billion users (other sources speak of 500 million users). The looted data included: names, email addresses, phone numbers, security questions and answers, years of birth, and passwords. However, public communication about the loss of this data did not take place until spring 2016. This cyber-attack had a substantial financial impact on Yahoo. The bid to acquire Yahoo was cut by $ 350 million following the incident.
