What is a cyber-attack? Top 10 common types of cyber-attacks

No matter how small your company is, every year, organizations are more exposed to losing millions of dollars because of cyber-attacks. There are different types of cyber-attacks, and often the employees of organizations don’t know how to identify them. According to the National Cyber Security Alliance, about 95% of all business security breaches are due to human errors.

In response, our UTMStack team has listed the ten most common types of cyber-attacks to help employees recognize and prevent them.

What is a cyber-attack?

A cyber-attack is dangerous software launched by cybercriminals aiming to disrupt, harm, and exploit computer systems, networks, or electronic devices. Hackers can steal, modify, delete data, extortion, or damage the victims’ reputations through an attack.

Cyber-attacks Classification

1. Cyber-warfare. Cyberwarfare is an act of attacking one country’s information system and infrastructure by another country. Its main goal is crippling or otherwise disrupting communications or services. Organizations like NATO, CIA, NSA designated different types of cyber-attacks as acts of war that could trigger a military response by the targeted governments.
2. Cyber-crime. Cybercrime is a malicious act involving computers and Internet connections to spread viruses, unlawful information, or illegitimate content.
3. Cyber terrorism. Cyber terrorism describes illegal attacks and threats against computers, networks, and information. Cyberterrorists frequently target military, government, and corporate networks. It happens to instill terror in the civilian population and coax the government.

Top 10 common types of cyber-attacks

1. Denial-of-Service (DOS) attack
2. Malware (Ransomware, Spyware, Virus, Worms, Trojan horse, Rootkit, Keylogger, Adware, Logic bombs)
3. Phishing attack
4. Structured Query Language (SQL) Injection attack
5. Password cracking attack
6. Man-in-the-middle (MITM) attack
7. DNS Spoofing attack
8. Eavesdropping attack
9. XSS attack
10. Birthday attack

Denial-of-Service (DOS) attack

A DoS attack floods systems, servers, and/or networks with constant requests to overload resources, preventing legitimate requests by intended users. DoS attacks saturate a system’s resources to impede response to service requests.

In turn, there are also distributed denial-of-service (DDoS) attacks launched from several infected host machines. Their goal is to deny the service, take the system offline, and facilitate other network attacks.

The most common DoS and DDoS attacks are botnets, ping-of-death, TCP SYN flood attacks, smurf attacks, and teardrop attacks.

In this article, you can increase your knowledge about Preventing DDoS attacks to protect organizations.

Malware

Malware takes advantage of a vulnerability to penetrate a network when a user clicks a dangerous link or suspicious email attachment. This type of cyber-attacks installs malicious software inside the system to deny access to essential network components. Also, the software allows retrieving data from the hard drive, disrupting systems, or useless them.

There are different types of Malware attacks and they are:

• Ransomware– This type of malware encrypts the user or organization data to deny access to files. At the same time, the attacker demands a ransom payment to decrypt data and not publish or delete the information. Often, the ransom payment is the easy way to regain data access; however, it can break an organization’s economy.
• Spyware– The program captures information about users, their systems, and visited websites to send the data to a remote user. It can also install other malicious programs from the web.
• Virus- A virus is a malicious code attached to file, applications, or master boot records to infect computers, disks, and app. There are different types of viruses such as File infectors, Macro viruses, Boot-record infectors, and others. Anti-viruses software can detect these types of cyber-attacks viruses for the following behavior:
  • Displays fake messages or opens pop-up windows.
  • Changes the device’s settings to download more viruses into the computer.
  • Attaches to an application’s initialization sequence, and when the user opens it, the virus executes instructions before transferring control to the app.
  • Associating itself with a file creates a virus file with the same name but a .exe extension. Therefore, the virus code will execute when the user opens the wrong file.
  • When the user starts the system, loads the virus hosted in the boot sector into memory and expands it to other disks and computers.
• Worms- The worms attacks are self-contained programs that reproduce across networks and computers. Unlike viruses, they do not attach to a host file. They are spread through email attachments. Then, when the user opens the attachment, it activates the worm program. A worm attack sends a copy of itself to all email contacts that the infected computer store. Its goal is to conduct malicious activities, overload an email server, and achieve DOS attacks.
• Trojan horse– A Trojan Horse is a type of Malware that downloads onto a computer disguised as a legitimate program. The hacker hides the malicious code within legitimate software to access users’ systems. Unlike viruses, a trojan doesn’t replicate itself; it’s programmed to establish a backdoor that attackers exploit for malicious activities.
• Rootkit– Generally, they spread through email attachments and downloads from insecure websites where they stay hidden in legitimate software. This type of malware gives hackers remote administrative access to control the target device. A Rootkit can affect the software, the operating system, the computer’s hardware, and firmware.
• Keylogger– A Keylogger is software that records the keystrokes made on the keyboard to store them in a file or send them over the internet. Cybercriminals use it to discover users’ credentials and their browser habit information. However, some Keyloggers are devices embedded within an internal PC hardware. In essence, both types of Keyloggers do not harm the host.
• Adware– Adware is software that commonly comes in freeware programs to display advertisements. When the user downloads the program from the Internet, Adware secretly installs itself onto the device without user knowledge. The hacker makes money every time the user clicks on one advertising. A piece of good advice to avoid this annoying malware is to be cautious and only download programs from trusted, reputable sources.
• Logic bombs– A logic bomb is a malicious code appended to an application and executes itself after meeting a logical condition. Usually, the logical condition depends on a specific date and time.

Phishing attack

A Phishing attack is an act of sending emails that appears to be from a trusted source. However, it contains an attachment or link to an illegitimate website where includes the malicious program. Phishing aims to get users to provide personal information or prompt the user to do something convenient for the attacker.

You can identify a bad link when moving the mouse over the link without clicking it. If the URL takes you to a suspicious website, don’t open it.

Structured Query Language (SQL) Injection attack

SQL Injection is a cyber-attack that involves inserting a string of SQL code into a web application’s input data. The purpose is to exploit a security vulnerability in the web application’s SQL query. The injection is successful when the cybercriminal can access all data from the database. Specifically, usernames and passwords hashes. In some cases, attackers can use SQL injection to disclose sensitive data, destroy data or entire databases.

Web programmers need to know how their programming language interacts with databases to block malicious code injections. In this way, programmers will help prevent security breaches by keeping their programming secure.

Password cracking attack

Password cracking tries to recover a password from one or more hashes. Hackers use brute force through an automated program that guesses the user password. Most of the users register easy-to-remember passwords, which is a big problem for them.

Some systems limit the number of attempts to enter the password before access is denied, preventing password cracking attacks. ​Other systems add additional bits to each password before hashing it. In this way, even if two users selected the same password, they would not.

Man-in-the-middle (MITM) attack

MITM attacks allow attackers to eavesdrop on the communication between two network users or between a user and a service. Once the hacker is positioned in the middle of the two partier can:

• Spoofing user IP to convince the system that it’s communicating with a known and trusted entity, providing the attacker access to the system.

• Intercepting and saving messages sent between two users to modify them and then send them, impersonating one of the users.

Companies can protect themselves from MITM attacks by using strong encryption on access points or a virtual private network (VPN).

DNS Spoofing attack

With Domain Name System (DNS) spoofing, a hacker alters DNS records to send traffic to a fake or spoofed website. Once on the fraudulent site, the victim may enter sensitive information that the hacker can use or sell. The hacker may also construct a poor-quality site with derogatory content to make a competitor company look bad. In a DNS spoofing attack, the attacker takes advantage because the user thinks visiting the site is legitimate. Then the hacker is free to commit crimes in the name of an innocent company.

Attackers aim to exploit vulnerabilities in DNS servers. To prevent DNS spoofing cyber-attacks, companies should ensure those servers are kept up to date.

Eavesdropping attack

Hackers use an Eavesdropping attack to intercept sensitive data from the network. To do it, the attacker takes in a position where they can listen in on the communication between two parties. Eavesdropping attack is not easy to detect without specialized equipment to monitor what is happening on the network. Of course, it makes a complex problem for many organizations to tackle. However, data encryption remains the best protection against eavesdropping.

XSS attack

Cross-site scripting or XSS attack allows the attacker to inject malicious scripts in a website’s database with script injection vulnerabilities. Once the user loads the website in the browser, it executes the script, and the user’s cookies are sent to the attacker. In this way, the hacker can use the cookies for session hijacking. Sometimes, the hackers use XSS attacks to exploit additional vulnerabilities for:

• Capturing screenshots.
• Discovering and collecting network information.
• Log keystrokes.
• Accessing and controlling the user’s machine remotely.

Companies can prevent XSS attacks using a whitelist of allowable entities. This way, anything other than approved entries will not be accepted by the web application. Also, organizations can use a sanitizing technique. The technique examines the data being entered, checking to see if it contains anything that can be harmful.

Birthday attack

In a birthday attack, an attacker exploits the hash algorithms. They are a security feature used to verify the authenticity of messages. If a hacker can create an identical hash to what the sender has appended, the hacker can replace the message with its own. The receiving device will accept it because it has the correct hash.

The birthday paradox is based on the fact that in a room of 23 people, there is more than a 50% chance that two of them have the same birthday. Hence, the paradox proves that hashes like birthdays are not as unique as many think.

To prevent birthday attacks, use longer hashes for verification. Each extra digit added to the hash makes that the odds of creating a matching one decrease significantly.

How to prevent all types of cyber-attacks in organizations?

There is no one-size-fits-all solution to cyber-attack problems. Nevertheless, companies can take proactive measures to prevent the types of cyber-attacks and protect their data and networks.

1. Install security updates and keep your operating system up to date.
2. Implement a firewall that blocks traffic on unused ports.
3. Establish antivirus software on all workstations connected to your network.
4. Include specific protection systems like HIDS (IDS/IPS).
5. Use secure protocols for transferring sensitive data (TLS/SSL).
6. Set up password policies using long passwords with complex patterns.
7. Never click on links in emails or even social media posts that seem odd.
8. Use a Virtual Private Network (VPN) to create a more secure connection.
9. Implement cloud-managed endpoint protection to assist in advanced monitoring and remote remediation.
10. Use anti-spyware software with active scanning and regular updates.
11. Back up data regularly to avoid losing them in case of cyber-attacks.

Hackers are becoming more intelligent and sophisticated in their attacks, and traditional antivirus software is not enough to detect them. However, companies can implement SIEM tools like UTMStack with technologies to monitor, detect, prevent, and respond to all types of cyber-attacks in real-time. A SIEM can ease the companies protection because integrating IDS, IPS, cloud service, incident response, penetration testing, vulnerabilities assessment, and more. In addition, most SIEM tools offer SOC as a service to monitor the networks and respond immediately to an attack.