cybersecurity unit 5 basics of cybersecurity

UNIT5
CYBER SECURITY
This Photo by Unknown author is licensed under CC BY-SA-NC.

Unit-5
Tools and Methods in Cybercrime: Proxy
Servers and Anonymizers, Password Cracking,
Key loggers and Spyware, virus and worms,
Trojan Horses, Backdoors, DoS and DDoS
Attacks , Buffer and Overflow, Attack on
Wireless Networks,
Phishing : Method of Phishing, Phishing
Techniques.
This Photo by Unknown author is licensed under CC BY-SA.

Proxy Server
Proxy server refers to a server that acts as an intermediary between the request made
by clients, and a particular server for some services or requests for some resources.
There are different types of proxy servers available that are put into use according to
the purpose of a request made by the clients to the servers.
The basic purpose of Proxy servers is to protect the direct connection of Internet
clients and internet resources.
The proxy server also prevents the identification of the client’s IP address when the
client makes any request is made to any other servers

Need of Proxy
Server
• It reduces the chances of data
breaches.
• It adds a subsidiary layer of security
between server and outside traffic.
• It also protects from hackers.
• It filters the requests.

Proxy Server Mechanism
The proxy server accepts the request from the client and produces a response
based on the following conditions
If the requested data or page already exists in the local cache, the proxy server
itself provides the required retrieval to the client.
If the requested data or page does not exist in the local cache, the proxy server
forwards that request to the destination server.
The proxy servers transfer the replies to the client and also being cached to them.

Proxy Server
• Internet Client and Internet resources: For internet clients, Proxy servers
also act as a shield for an internal network against the request coming from
a client to access the data stored on the server. It makes the original IP
address of the node remains hidden while accessing data from that server.
• Protects true host identity: In this method, outgoing traffic appears to
come from the proxy server rather than internet navigation. It must be
configured to the specific application such as HTTPs or FTP.
• For example, organizations can use a proxy to observe the traffic of its
employees to get the work efficiently done. It can also be used to keep a
check on any kind of highly confidential data leakage. Some can also use it
to increase their websites rank

Working of Proxy Server
The proxy server has its own IP address and it works as a gateway between the client and the
internet.
The client's computer knows the IP address of the proxy server.
When the client sends a request on the internet, the request is re-routed to the proxy. After
that, the proxy server gets the response from the destination or targeted server/site and
forwards the data from the page to the client's browser (Chrome, Safari, etc.).

Working of Proxy
Server
• Overall, it can be said that the proxy server
accesses the targeted site, on behalf of the
client, and collects all the requested
information, and forwards them to the user
(client).

Proxy Server
Working
• Every computer has its unique IP address which it uses to
communicate with another node.
• Similarly, the proxy server has its IP address that your computer
knows. When a web request is sent, your request goes to the proxy
server first.
• The Proxy sends a request on your behalf to the internet and then
collect the data and make it available to you.
• A proxy can change your IP address So, the webserver will be
unable to fetch your location in the world.
• It protects data from getting hacked too. Moreover, it can block
some web pages also.

Advantages of
Proxy Server
• It improves the security and enhances
the privacy of the user.
• It hides the identity (IP address) of the
user.
• It controls the traffic and prevents
crashes.
• Also, saves bandwidth by caching files and
compressing incoming traffic.
• Protect our network from malware.
• Allows access to the restricted content

Disadvantages of Proxy Servers
1. Proxy Server Risks: Free installation does not invest much in backend hardware
or encryption. It will result in performance issues and potential data security
issues. If you install a “free” proxy server, treat very carefully, some of those
might steal your credit card numbers.
2. Browsing history log: The proxy server stores your original IP address and web
request information is possibly unencrypted form and saved locally. Always
check if your proxy server logs and saves that data – and what kind of retention
or law enforcement cooperation policies they follow while saving data.
3. No encryption: No encryption means you are sending your requests as plain
text. Anyone will be able to pull usernames and passwords and account
information easily. Keep a check that proxy provides full encryption whenever
you use it.

Types of Proxy
Server
• Reverse Proxy Server: The job of a reverse proxy server to listen to the
request made by the client and redirect to the particular web server
which is present on different servers.
• Web Proxy Server: Web Proxy forwards the HTTP requests, only URL is
passed instead of a path. The request is sent to particular the proxy
server responds. Examples, Apache, HAP Proxy.
• Anonymous Proxy Server: This type of proxy server does not make an
original IP address instead these servers are detectable still provides
rational anonymity to the client device.

Types of Proxy
Server
• Transparent Proxy: This type of proxy server is unable to provide any
anonymity to the client, instead, the original IP address can be easily
detected using this proxy. But it is put into use to act as a cache for the
websites.
• A transparent proxy when combined with gateway results in a proxy
server where the connection requests are sent by the client , then IP are
redirected. Redirection will occurs without the client IP address
configuration. HTTP headers present on the server-side can easily detect
its redirection .

Types of Proxy
Server
• CGI Proxy: CGI proxy server developed to make the websites more
accessible. It accepts the requests to target URLs using a web form and
after processing its result will be returned to the web browser.
• Suffix Proxy: Suffix proxy server basically appends the name of the proxy
to the URL. This type of proxy doesn’t preserve any higher level of
anonymity. It is used for bypassing the web filters. It is easy to use and
can be easily implemented but is used less due to the more number of
web filter present in it.

Types of Proxy
Server
• Distorting Proxy: Proxy servers are preferred to generate an incorrect original IP
address of clients once being detected as a proxy server. To maintain the confidentiality
of the Client IP address HTTP headers are used.
• Tor Onion Proxy: This server aims at online anonymity to the user’s personal
information. It is used to route the traffic through various networks present worldwide
to arise difficulty in tracking the users’ address and prevent the attack of any
anonymous activities.
• It makes it difficult for any person who is trying to track the original address. In this type
of routing, the information is encrypted in a multi-folds layer. At the destination, each
layer is decrypted one by one to prevent the information to scramble and receive
original content. This software is open-source and free of cost to use.

Types of Proxy
Server
• 12P Anonymous Proxy: It uses encryption to hide all the communications
at various levels. This encrypted data is then relayed through various
network routers present at different locations and thus I2P is a fully
distributed proxy. This software is free of cost and open source to use, It
also resists the censorship.
• DNS Proxy: DNS proxy take requests in the form of DNS queries and
forward them to the Domain server where it can also be cached, moreover
flow of request can also be redirected.

Anonymizer

Anonymizers
Anonymizer is a name given to a proxy server that limits the amount of data its
user reveals while browsing the internet.
Despite its name, it does not make the user anonymous online.
It will simply hide the device’s IP address from the website they’re connecting to
and replace it with a different one. This makes it appear as if the user is browsing
from a different location.

Anonymizers
An Anonymizers or an anonymous proxy is a tool that attempts to make activity on
the Internet untraceable.
It is a proxy server computer that acts as an intermediary and privacy shield between
a client computer and the rest of the Internet.
It accesses the Internet on the user's behalf, protecting personal information by
hiding the client computer's identifying information
Anonymizers can be used for legitimate purposes, such as maintaining online privacy
or bypassing internet censorship, but they can also be misused for illicit activities.

Types of Anonymizers in Cybersecurity
VPN (Virtual Private Network): A VPN routes your internet traffic through an
encrypted tunnel to a remote server, making it appear as though you're
accessing the internet from the location of that server. This helps mask your IP
address and provides anonymity, as your true location and identity are hidden.
Proxy Servers: Proxy servers act as intermediaries between your device and
the internet. They can hide your IP address and location, making it more
challenging for websites or online services to trace your online activity back to
you.

Tor (The Onion Router): The Tor network routes your internet traffic through a
series of volunteer-operated nodes, making it extremely difficult for anyone to
trace your online activity back to your real IP address. It's often used for
anonymous browsing and accessing the dark web.
Anonymous Browsers: Some web browsers, like the Tor Browser or Brave, are
designed with privacy in mind. They often include features that block
trackers, cookies, and other tools that can be used to identify and monitor your
online behavior.

Proxies and Anonymizing Networks: These services and networks are used to
obscure a user's identity and location. They can be utilized for legitimate purposes,
but they are also commonly associated with cyberattacks and malicious activities.
Secure Messaging and Email Services: Some messaging and email services, like
Signal or ProtonMail, offer end-to-end encryption and other privacy features to
ensure the anonymity of their users.

Uses of Anonymizers
• Privacy Protection: Anonymizers are often used to protect personal privacy
by concealing the user's identity and online activities from websites,
advertisers, and even internet service providers.
• Bypassing Censorship: In regions with strict internet censorship, people
use anonymizers to access blocked content and communicate more freely
online.
• Whistleblowing: Whistleblowers and activists may use anonymizers to
share sensitive information without revealing their identities.

Working of Anonymizers
• User Request: When you connect to an anonymizer service (e.g., a VPN or
proxy), your internet traffic is redirected through that service. In the case of the
Tor network, it's a bit different as it routes your traffic through a series of
volunteer-operated nodes.
• Encryption (in VPNs): With VPNs, your data is encrypted before it leaves your
device. This means that any information you send over the internet is first
encrypted, making it much more difficult for third parties to intercept and
decipher.
• Routing: In the case of VPNs and proxy servers, your request is then sent to a
remote server in a different location. This server acts as an intermediary
between you and the destination website or service. The request to the website
appears to come from the server's location, not your own.

• Destination: The VPN or proxy or the first node in the Tor network then forwards
your request to the desired website or service. The website sees the request as
coming from the server's location (e.g., the VPN server's IP address) rather than your
own.
• Response: When the website or service responds, it sends the data back to the
intermediary server (VPN, proxy, or Tor node).
• Decryption and Forwarding (in VPNs): If you're using a VPN, the server decrypts the
response and sends it back to your device in an encrypted form. Your device decrypts
the data to display the content.

• Privacy and Anonymity: The end result is that the website or service you interact
with doesn't have direct knowledge of your real IP address or location. It sees the
IP address and location of the intermediary server (VPN or proxy) or the last Tor
node.
• Chaining (in Tor): The Tor network takes privacy to a higher level by routing your
traffic through multiple volunteer-operated nodes, encrypting it multiple times.
This makes it extremely difficult for anyone to trace the source of the request back
to your IP address.

Drawback
• Cybercrime: Anonymizers can be misused for various cybercrimes,
including hacking, distributed denial of service (DDoS) attacks, and
distributing malicious content.
• Dark Web: Anonymizers like Tor can provide access to the dark web, where
illegal activities are prevalent.
• Malware Distribution: Cybercriminals can use anonymizers to hide the
source of malware distribution or command and control servers.

Other Considerations while using Anonymizers
• Legal and Ethical Considerations:
• The use of anonymizers should always adhere to local laws and regulations.
• Ethical considerations should guide the use of anonymizers to ensure that they are not
used for harmful or malicious purposes.
• Performance Considerations:
• Anonymizers can introduce latency due to the additional routing of traffic through
intermediary servers.
• Some online services may block or limit access to users utilizing anonymizers.
• Anonymity Levels:
• Anonymity provided by these tools can vary. Tor, for example, offers a high level of
anonymity, while some VPN services may log user activity and can potentially reveal user
identities under legal pressure.

Other Considerations
• VPN and Proxy Logging:
• Be aware that some VPN providers may keep logs of user activity, which can
potentially be used to trace users if legal authorities request this information.
• Defense Mechanisms:
• Organizations and websites may employ security measures to detect and block
anonymized traffic. This can include the use of CAPTCHAs, IP blacklists, and
behavior analysis.
• Multi-Layered Security:
• Anonymizers are just one component of online security and privacy. Users
should also employ strong passwords, keep software up to date, and be
cautious when sharing personal information online.

Password
Cracking
-

Password Cracking
Password cracking refers to the process of attempting to gain unauthorized
access to a computer system or an account by systematically trying to guess
or decipher the password.
It is often used by hackers with malicious intent, but it can also be employed
by security professionals and system administrators to test the security of
their own systems and identify vulnerabilities.

Methods & Tools used for Password Cracking
• Brute Force Attack: In a brute force attack, an attacker systematically tries all possible
combinations of characters until the correct password is found. This method can be
very time-consuming and resource-intensive, especially for complex passwords.
• Dictionary Attack: A dictionary attack involves using a predefined list of words,
phrases, or commonly used passwords to guess the target password. This method is
more efficient than brute force and is successful if the target password is weak or
commonly used.
• Rainbow Table Attack: Rainbow tables are precomputed tables of possible password
hashes. Attackers use these tables to look up the corresponding plaintext password for
a given hash, significantly speeding up the process of password cracking.

Methods & Tools used for Password Cracking
• Hybrid Attack: Hybrid attacks combine elements of brute force and
dictionary attacks. They start with dictionary words and then append
or prepend characters to them in an attempt to guess the password.
• Phishing and Social Engineering: In some cases, attackers may not
directly crack passwords but use social engineering or phishing
techniques to trick individuals into revealing their passwords.
• Password Guessing: Attackers may use information they know about
the target, such as their name, birthdate, or common patterns, to
guess the password.

Password Cracking Tools
Cain and Abel. This password recovery software can recover passwords for Microsoft Windows user
accounts and Microsoft Access passwords. Cain and Abel uses a graphical user interface, making it more
user-friendly than comparable tools. The software uses dictionary lists and brute-force attack methods.
Ophcrack. This password cracker uses rainbow tables and brute-force attacks to crack passwords. It runs
on Windows, macOS and Linux.
John the Ripper. This tool uses a dictionary list approach and is available primarily for macOS and Linux
systems. The program has a command prompt to crack passwords, making it more difficult to use than
software like Cain and Abel.

Working
• Password Hashing: When you create a password for an account, it's not stored in plain text. Instead, it's
typically converted into a one-way cryptographic hash using algorithms like MD5, SHA-1, or more secure
options like bcrypt or Argon2. This hash is what's stored on the server.
• Salting: To make password cracking more challenging, many systems use a technique
called "salting." A unique random value (the salt) is added to the password before
hashing, making it so that even if two users have the same password, their hashes will
be different due to the unique salt. This makes precomputed tables like rainbow tables
less effective.
• Iterative Hashing: To make brute force and dictionary attacks slower, systems may use
multiple rounds of hashing. For example, a password may be hashed 1,000 times before
being stored. This increases the time required for each guess.

How to create strong Passwords?
• Be at least 12 characters long. The shorter a password is, the easier and faster it will be cracked.
• Combine letters and a variety of characters. Using numbers and special characters, such as periods and
commas, increases the number of possible combinations.
• Avoid reusing a password. If a password is cracked, then a person with malicious intent could use that same
password to easily access other password-protected accounts the victim owns.
• Pay attention to password strength indicators. Some password-protected systems include a password
strength meter, which is a scale that tells users when they have created a strong password.
• Avoid easy-to-guess phrases and common passwords. Weak passwords can be a name, a pet's name or
a birthdate -- something personally identifiable. Short and easily predictable patterns, like 123456, password or
qwerty, also are weak passwords.
• Use encryption. Passwords stored in a database should be encrypted.
• Take advantage of password creation tools and managers. Some smartphones will automatically create
long, hard-to-guess passwords. For example, Apple iPhones will create strong website passwords for users.
An iPhone stores the passwords in its password manager, iCloud Keychain and automatically fills the
password into the correct field so the user doesn't have to remember the complicated password.

KeyLoggers -
This Photo by Unknown author is licensed under CC BY-SA.

Keyloggers
• Keyloggers, short for "keystroke loggers,"
are software or hardware tools designed
to record the keystrokes made on a
computer or other input devices, such as a
keyboard.
• They are often used for various purposes,
but in the context of cybersecurity, they
are primarily discussed in terms of their
malicious or potentially malicious
applications.
This Photo by Unknown author is licensed under CC BY-ND.

Keyloggers
• Mainly key-loggers are used to steal
password or confidential details such
as bank information etc.
• First key-logger was invented in
1970’s and was a hardware key logger
and first software key-logger was
developed in 1983

Types of Keyloggers
1. Software key-loggers are the computer programs which are developed to steal
password from the victims computer.
• Microsoft windows 10 also has key-logger installed in it.
• JavaScript based key logger – It is a malicious script which is installed into a web page,
and listens for key to press such as oneKeyUp(). These scripts can be sent by various
methods, like sharing through social media, sending as a mail file, or RAT file.
• Form Based Key loggers – These are key-loggers which activates when a person fills a
form online and when click the button submit all the data or the words written is sent
via file on a computer. Some key-loggers works as a API in running application it looks
like a simple application and whenever a key is pressed it records it.

Types of Keyloggers
2. Hardware Key-loggers : These are not dependent on any software as these are hardware key-
loggers. keyboard hardware is a circuit which is attached in a keyboard itself that whenever the key of
that keyboard pressed it gets recorded.
• USB keylogger – There are USB connector key-loggers which has to be connected to a computer
and steals the data. Also some circuits are built into a keyboard so no external wire i used or shows
on the keyboard.
• Smartphone sensors – Some cool android tricks are also used as key loggers such as android
accelerometer sensor which when placed near to the keyboard can sense the vibrations and the
graph then used to convert it to sentences, this technique accuracy is about 80%. Now a days
crackers are using keystroke logging Trojan, it is a malware which is sent to a victims computer to
steal the data and login details.

Keyloggers
So key-loggers are the software
malware or a hardware which is
used to steal , or snatch our
login details, credentials , bank
information and many more.
Some keylogger application
used in 2020 are:
1. Kidlogger
2. Best Free Keylogger
3. Windows Keylogger
4. Refog Personal Monitor
5. All In One Keylogger

Prevention
• Anti-Key-logger – As the name suggest these are the software which are anti / against key loggers and
main task is to detect key-logger from a computer system.
• Anti-Virus – Many anti-virus software also detect key loggers and delete them from the computer
system. These are software anti-software so these can not get rid from the hardware key-loggers.
• Automatic form filler – This technique can be used by the user to not fill forms on regular bases instead
use automatic form filler which will give a shield against key-loggers as keys will not be pressed .
• One-Time-Passwords – Using OTP’s as password may be safe as every time we login we have to use a
new password.
• Patterns or mouse-recognition – On android devices used pattern as a password of applications and on
PC use mouse recognition, mouse program uses mouse gestures instead of stylus.
• Voice to Text Converter – This software helps to prevent Keylogging which targets a specific part of our
keyboard.

This Photo by Unknown author is licensed under CC BY.
Spyware
-

Spyware
Spyware refers to software that is installed on a computer or device without the
user's knowledge or consent and is designed to collect information about the
user's activities, often for malicious purposes.
This information can include browsing habits, keystrokes, personal information,
and more.
Spyware is typically hidden from the user and can operate in the background,
making it difficult to detect.

History of Spyware
• The term "spyware" first emerged in online discussions in the 1990s,
but only in the early 2000s did cybersecurity firms use it to describe
unwanted software that spied on their user and computer activity.
• The first anti-spyware software was released in June 2000, then four
years later, scans showed that around 80% of internet users had their
systems affected by spyware, according to research by America
Online and the National Cyber Security Alliance.

Types of Spyware
1.Adware: This sits on a device and monitors users’ activity then sells their data to
advertisers and malicious actors or serves up malicious ads.
2.Infostealer: This is a type of spyware that collects information from devices. It scans them
for specific data and instant messaging conversations.
3.Keyloggers: Also known as keystroke loggers, keyloggers are a type of info stealer spyware.
They record the keystrokes that a user makes on their infected device, then save the data
into an encrypted log file. This spyware method collects all of the information that the user
types into their devices, such as email data, passwords, text messages, and usernames.
4.Rootkits: These enable attackers to deeply infiltrate devices by exploiting security
vulnerabilities or logging into machines as an administrator. Rootkits are often difficult and
even impossible to detect.

Types of Spyware
5. Red Shell: This spyware installs itself onto a device while a user is installing specific
PC games, then tracks their online activity. It is generally used by developers to
enhance their games and improve their marketing campaigns.
6. System monitors: These also track user activity on their computer, capturing
information like emails sent, social media and other sites visited, and keystrokes.
7. Tracking cookies: Tracking cookies are dropped onto a device by a website and then
used to follow the user’s online activity.
8. Trojan Horse Virus: This brand of spyware enters a device through Trojan malware,
which is responsible for delivering the spyware program.

How Spyware
Works
• All types of spyware sit on a user’s device
and spy on their activity, the sites they
visit, and the data they amass or share.
• They do this with the objective of
monitoring user activity, tracking login and
password details, and detecting sensitive
data.
• Other spyware strands are also capable of
installing further software on the user’s
device, which enables the attacker to
make changes to the device

How Spyware Works
spyware typically follows a three-step process from being installed on a device to sending
or selling the information it has stolen.
• Step 1—Infiltrate: Spyware is installed onto a device through the use of an application
installation package, a malicious website, or as a file attachment.
• Step 2—Monitor and capture: Once installed, the spyware gets to work following the
user around the internet, capturing the data they use, and stealing their credentials,
login information, and passwords. It does this through screen captures, keystroke
technology, and tracking codes.

How Spyware Works
• Step 3—Send or sell: With data and information captured, the attacker will
either use the data amassed or sell it to a third party.
• If they use the data, they could take the user credentials to spoof their
identity or use them as part of a larger cyberattack on a business.
• If they sell, they could use the data for a profit with data organizations,
other hackers, or put it on the dark web.

How Mobile Spyware attacks?
Mobile spyware typically attacks mobile devices through three methods:
• Flaws in operating systems: Attackers can exploit flaws in mobile operating systems
that are typically opened up by holes in updates.
• Malicious applications: These typically lurk within legitimate applications that users
download from websites rather than app stores.
• Unsecured free Wi-Fi networks: Wi-Fi networks in public places like airports and
cafes are often free and simple to sign in to, which makes them a serious security
risk. Attackers can use these networks to spy on what connected users are doing.

Prevention
1. Use Antivirus and Anti-Spyware Software: Regularly update and
run antivirus and anti-spyware software to detect and remove
spyware.
2. Be Cautious When Downloading Software: Only download
software from trusted sources, and be wary of free software that
may come bundled with spyware.
3. Keep Your Operating System and Software Updated: Security
updates can patch vulnerabilities that spyware may exploit.
4. Use a Firewall: A firewall can help block unauthorized access to
your computer and prevent spyware from communicating with its
remote server.
5. Exercise Safe Browsing Habits: Avoid clicking on suspicious links,
opening email attachments from unknown sources, and visiting
untrustworthy websites.
6. Regularly Back Up Your Data: In case your system gets
compromised by spyware, having backups of your data can help
you recover without losing important files.

Virus
-

What is a Virus?
• A virus is a fragment of code
embedded in a legitimate program.
Viruses are self-replicating and are
designed to infect other programs.
• On reaching the target machine a virus
dropper(usually a trojan horse) inserts
the virus into the system.

Types of Virus
• File Virus:
This type of virus infects the system by appending itself to the end of a file. It
changes the start of a program so that the control jumps to its code. After the
execution of its code, the control returns back to the main program. Its execution is
not even noticed. It is also called a Parasitic virus because it leaves no file intact but
also leaves the host functional.
• Boot sector Virus:
It infects the boot sector of the system, executing every time system is booted and
before the operating system is loaded. It infects other bootable media like floppy
disks. These are also known as memory viruses as they do not infect the file
systems.

Types of Virus
• Macro Virus:
Unlike most viruses which are written in a low-level language(like C or
assembly language), these are written in a high-level language like Visual
Basic. These viruses are triggered when a program capable of executing a
macro is run. For example, the macro viruses can be contained in
spreadsheet files.
• Source code Virus:
It looks for source code and modifies it to include virus and to help spread it.

Types of Virus
• Polymorphic Virus:
A virus signature is a pattern that can identify a virus(a series of bytes that
make up virus code). So in order to avoid detection by antivirus a
polymorphic virus changes each time it is installed. The functionality of the
virus remains the same but its signature is changed.
• Encrypted Virus:
In order to avoid detection by antivirus, this type of virus exists in encrypted
form. It carries a decryption algorithm along with it. So the virus first
decrypts and then executes.

Types of Virus
• Stealth Virus:
It is a very tricky virus as it changes the code that can be used to detect it. Hence, the detection of
viruses becomes very difficult. For example, it can change the read system call such that whenever
the user asks to read a code modified by a virus, the original form of code is shown rather than
infected code.
• Browser Hijacker:
As the name suggests this virus is coded to target the user’s browser and can alter the browser
settings. It is also called the browser redirect virus because it redirects your browser to other
malicious sites that can harm your computer system.
• Memory Resident Virus: Resident viruses installation store for your RAM and meddle together along
with your device operations. They behave in a very secret and dishonest way that they can even
connect themselves for the anti-virus software program files.

Worm
• "worm" is a type of malicious software (malware) that is
designed to self-replicate and spread from one computer or
network to another.
• Unlike viruses, worms do not need to attach themselves to a host
program in order to propagate.
• They can independently move across networks and systems,
exploiting vulnerabilities and spreading rapidly.
This Photo by Unknown author is licensed under CC BY-NC-ND.

Worm Characteristics
Self-replication: Worms are self-replicating and can create copies of themselves without
user intervention. This replication is what allows them to spread quickly.
Network-based transmission: Worms typically spread through network connections, such
as the internet, local area networks (LANs), or email systems. They can exploit
vulnerabilities in software or hardware to gain access to new systems.
Exploiting vulnerabilities: Worms often take advantage of security flaws and
vulnerabilities in operating systems, software applications, or network protocols. They can
enter a system without requiring user interaction, making them a potent threat.

Worm Characteristics
Payload: Worms can carry a payload, which is a malicious component that performs specific actions on
infected systems. This payload can range from data theft and system control to launching additional
attacks.
Worms vs. viruses: Worms are different from viruses, which require a host program to spread. Viruses
attach themselves to executable files, and their spread is dependent on users executing infected files.
Worms, on the other hand, do not need a host program and can spread independently.
Propagation speed: Worms are known for their rapid spread, as they can infect multiple systems within a
short period of time. This ability to propagate quickly can lead to widespread and disruptive cyberattacks.
Mitigation: Protecting against worms involves keeping software and systems up to date with security
patches, using firewalls and intrusion detection systems, implementing network segmentation, and
employing antivirus software that can detect and block worm infections.

How Worm Works?
• To get a worm in a computer, the worm is often transmitted
through vulnerabilities in software.
• They could also be sent through email attachments or within
instant messages or spam emails.
• After a file is opened, it may link the user to a malicious website
or it could download the worm to the user’s device automatically.
After the worm is on the device, it infects it without the user
being able to tell.

How Worm Works?
• Worms have the ability to delete and modify files.
• They can also inject more malicious software into a
workstation or other device.
• Sometimes, the worm’s primary mission is to replicate itself
again and again—simply to waste system resources, like
bandwidth or hard drive space.
• Worms can also steal sensitive data and pave a way for a
hacker to get into the computer by installing a backdoor they
can access.

Trojan Horse
A Trojan horse, often referred to simply as a
"Trojan," is a type of malicious software or
malware that disguises itself as a legitimate or
benign program or file to gain access to a
computer system or network.

Type of Attacks done by Trojan Horse
Data theft: Trojans can be used to steal sensitive information such as passwords,
financial data, and personal documents from the victim's computer.
Remote access: Some Trojans provide attackers with remote access to the infected
system, allowing them to control it, execute commands, or install additional malware.
Botnets: Trojans can be used to create botnets, which are networks of compromised
computers under the control of a single entity. These botnets can be used for various
purposes, including launching distributed denial-of-service (DDoS) attacks.

Type of
Attacks done
by Trojan
Horse
• Keylogging: Trojans with keyloggers can record
keystrokes on the victim's computer, capturing
sensitive information like login credentials and
credit card numbers.
• Ransomware delivery: Some Trojans act as a
delivery mechanism for ransomware, which
encrypts the victim's data and demands a
ransom for its decryption.
• Banking Trojans: These specialized Trojans are
designed to target online banking users,
capturing login credentials and other financial
information.

How Trojan Horse Work?
Unlike computer viruses, a Trojan horse cannot manifest by itself, so it needs a user to download the server side of the
application for it to work. This means the executable (.exe) file should be implemented and the program installed for
the Trojan to attack a device’s system.
A Trojan virus spreads through legitimate-looking emails and files attached to emails, which are spammed to reach the
inboxes of as many people as possible. When the email is opened and the malicious attachment is downloaded, the
Trojan server will install and automatically run every time the infected device is turned on.
Devices can also be infected by a Trojan through social engineering tactics, which cyber criminals use to coerce users
into downloading a malicious application. The malicious file could be hidden in banner advertisements, pop-up
advertisements, or links on websites.
A computer infected by Trojan malware can also spread it to other computers. A cyber criminal turns the device into a
zombie computer, which means they have remote control of it without the user knowing. Hackers can then use the
zombie computer to continue sharing malware across a network of devices, known as a botnet.

Types of Trojan
• Backdoor Trojan: A backdoor Trojan enables an attacker to gain remote access to a computer and take
control of it using a backdoor. This enables the malicious actor to do whatever they want on the device,
such as deleting files, rebooting the computer, stealing data, or uploading malware. A backdoor Trojan is
frequently used to create a botnet through a network of zombie computers.
• Banker Trojan: A banker Trojan is designed to target users’ banking accounts and financial information.
It attempts to steal account data for credit and debit cards, e-payment systems, and online banking
systems.
• Distributed denial-of-service (DDoS) Trojan: These Trojan programs carry out attacks that overload a
network with traffic. It will send multiple requests from a computer or a group of computers to
overwhelm a target web address and cause a denial of service.
• Downloader Trojan: A downloader Trojan targets a computer that has already been infected by
malware, then downloads and installs more malicious programs to it. This could be additional Trojans or
other types of malware like adware.

Types of Trojan
• Exploit Trojan: An exploit malware program contains code or data that takes advantage of specific vulnerabilities within
an application or computer system. The cyber criminal will target users through a method like a phishing attack, then
use the code in the program to exploit a known vulnerability.
• Fake antivirus Trojan: A fake antivirus Trojan simulates the actions of legitimate antivirus software. The Trojan is
designed to detect and remove threats like a regular antivirus program, then extort money from users for removing
threats that may be nonexistent.
• Game-thief Trojan: A game-thief Trojan is specifically designed to steal user account information from people playing
online games.
• Instant messaging (IM) Trojan: This type of Trojan targets IM services to steal users’ logins and passwords. It targets
popular messaging platforms such as AOL Instant Messenger, ICQ, MSN Messenger, Skype, and Yahoo Pager.
• Infostealer Trojan: This malware can either be used to install Trojans or prevent the user from detecting the existence of
a malicious program. The components of infostealer Trojans can make it difficult for antivirus systems to discover them
in scans.
• Mailfinder Trojan: A mailfinder Trojan aims to harvest and steal email addresses that have been stored on a computer.
• Ransom Trojan: Ransom Trojans seek to impair a computer’s performance or block data on the device so that the user
can no longer access or use it. The attacker will then hold the user or organization ransom until they pay a ransom fee to
undo the device damage or unlock the affected data.

Denial of Service Attack
• A Denial-of-Service (DoS) attack is an attack meant
to shut down a machine or network, making it
inaccessible to its intended users.
• DoS attacks accomplish this by flooding the target
with traffic, or sending it information that triggers a
crash.
• In both instances, the DoS attack deprives
legitimate users (i.e. employees, members, or
account holders) of the service or resource they
expected.

Denial of
Service Attack
• Victims of DoS attacks often target web servers of
high-profile organizations such as banking,
commerce, and media companies, or
government and trade organizations.
• Though DoS attacks do not typically result in the
theft or loss of significant information or other
assets, they can cost the victim a great deal of
time and money to handle.

How DOS Work?
DoS attacks typically exploit vulnerabilities in a target’s network or computer systems. Attackers can
use a variety of methods to generate overwhelming traffic or requests, including:
Flooding the target with a massive amount of data
Sending repeated requests to a specific part of the system
Exploiting software vulnerabilities to crash the system

Prevention
Cloud Mitigation Provider – Cloud mitigation providers are experts at providing DDoS mitigation from the cloud. This means
they have built out massive amounts of network bandwidth and DDoS mitigation capacity at multiple sites around the Internet
that can take in any type of network traffic, whether you use multiple ISP’s, your own data center, or any number of cloud
providers. They can scrub the traffic for you and only send “clean” traffic to your data center.
Firewall – This is the simplest and least effective method. Python scripts are often written to filter out malicious traffic, or
existing firewalls can be utilized by enterprises to block such traffic.
Internet Service Provider (ISP) – Some enterprises use their ISP to provide DDoS mitigation. These ISPs have more bandwidth
than an enterprise would, which can help with large volumetric attacks.

Prevention
Network Segmentation: Segmenting the network can help prevent a DoS attack
from spreading throughout the entire network. This limits the impact of an attack
and helps to isolate the affected systems.
Use Intrusion Detection and Prevention Systems: Intrusion Detection and
Prevention Systems (IDS/IPS) can help to detect and block DoS attacks by
analyzing network traffic and blocking malicious traffic.
Develop a Response Plan: Having a DoS response plan in place can help minimize
the impact of an attack. This plan should include steps for identifying the attack,
isolating affected systems, and restoring normal operations.

Prevention
Limit Bandwidth: Implementing bandwidth limitations on incoming traffic can help prevent a DoS attack from
overwhelming the network or server.
Implement Content Delivery Network (CDN): A CDN can help to distribute traffic and reduce the impact of a DoS attack
by distributing the load across multiple servers.
Use Anti-Malware Software: Anti-malware software can help to detect and prevent malware from being used in a DoS
attack, such as botnets.
Perform Regular Network Scans: Regular network scans can help identify vulnerabilities and misconfigurations that can
be exploited in a DoS attack. Patching these vulnerabilities can prevent a DoS attack from being successful.

DDoS
• A Distributed Denial of Service (DDoS) attack is designed to force a website, computer, or online service offline. This is accomplished by
flooding the target with many requests, consuming its capacity and rendering it unable to respond to legitimate requests.
• A DDoS attack differs from a Denial of Service (DoS) attack because it is distributed. The malicious traffic comes from a variety of different IP
addresses, often the members of a botnet. This makes the attack more difficult to defend against and enables the attackers to generate a
larger volume of malicious traffic than a single system can generate on its own.

Working
• A DDoS attack is essentially the legitimate use of an online service taken
too far. For example, a website may be capable of handling a certain
number of requests per minute. If that number is exceeded, then the
website’s performance is degraded, or it may be rendered completely
inaccessible.
• This overload may be caused by an attack or even legitimate use, such as
an e-commerce site being overwhelmed on Black Friday or a ticket sales
platform going down when sales for a popular event are opened.

Working
• DDoS attacks are capable of overwhelming a target at various levels. For
example, a web application may have a maximum number of requests that
it can handle.
• Alternatively, the server that it is running on may have a limit on the
amount of simultaneous connections that it can manage. A corporate
network likely has bandwidth restrictions that could be overwhelmed by an
attacker.
• Exceeding any of these thresholds will result in a DoS attack — or a DDoS
attack if the attack uses multiple IP addresses — against the system.

Types of DDoS Attack
• Amplification Attacks: Some services, such as DNS, have responses that are much larger
than the corresponding request. In DDoS amplification attacks, attackers will send a
request to a DNS server with their IP address spoofed to the IP address of the target,
causing the target to receive a large volume of unsolicited responses that eat up
resources.
• Bandwidth Saturation: All networks have a maximum bandwidth and throughput that
they can maintain. Bandwidth saturation attacks attempt to consume this bandwidth with
spam traffic.
• Cloud Resource Exploitation: Scalability is one of the hallmarks of cloud computing. By
exploiting this fact, DDoS attackers can perform large-scale attacks against a target
system.

Prevention
• Take quick action: Sooner the DDoS attack is identified, the quicker the harm can be resisted.
Companies should provide DDoS services or a certain kind of technology so that the heavy
traffic can be realized and worked upon as soon as possible.
• Configure firewalls and routers: Firewalls and routers should be configured in such a way that
they reject bogus traffic and you should keep your routers as well as firewalls updated with the
latest security patches.
• Consider artificial intelligence: While present defenses of advanced firewalls and intrusion
detection systems are very common, Artificial Intelligence is being used to develop new
systems.
• Secure your Internet of Things devices: To keep your devices from becoming a part of
a botnet, it’s smart to make sure your computers have trusted security software. It’s important
to keep it updated with the latest security patches.

Phishing Attack
Phishing is a type of cybersecurity attack that attempts to obtain data that are sensitive like Username, Password,
and more. It attacks the user through mail, text, or direct messages.
Now the attachment sends by the attacker is opened by the user because the user thinks that the email, text,
messages came from a trusted source. It is a type of Social Engineering Attack. For Example,
The user may find some messages like the lottery winner. When the user clicks on the attachment the malicious
code activates that can access sensitive information details. Or if the user clicks on the link that was sent in the
attachment they may be redirected to a different website that will ask for the login credentials of the bank.

Types of Phishing Attack
• Spear Phishing –
This attack is used to target any specific organization or an individual for unauthorized access.
These types of attacks are not initiated by any random hacker, but these attacks are initiated
by someone who seeks information related to financial gain or some important information.
Just like the phishing attack spear-phishing also comes from a trusted source. This type of
attack is much successful. It is considered to be one of the most successful methods as both
of the attacks(that is phishing and spear-phishing) is an online attack on users.
• Clone Phishing –
This attack is actually based on copying the email messages that were sent from a trusted
source. Now the hackers alter the information by adding a link that redirects the user to a
malicious or fake website. Now, this is sent to a large number of users and the person who
initiated it watches who clicks on the attachment that was sent as a mail. This spreads
through the contacts of the user who has clicked on the attachment.

Types of Phishing Attack
• Catphishing –
It is a type of social engineering attack that plays with the emotions of a person and exploits them
to gain money and information. They target them through dating sites. It is a type of engineering
threat.
• Voice Phishing –
Some attacks require to direct the user through fake websites, but some attacks do not require a
fake website. This type of attack is sometimes referred to as vishing. Someone who is using the
method of vishing, use modern caller id spoofing to convince the victim that the call is from a
trusted source. They also use IVR to make it difficult for the legal authorities to trace, block, monitor.
It is used to steal credit card numbers or some confidential data of the user. This type of phishing
can cause more harm.
• SMS phishing –
These attacks are used to make the user revealing account information. This attack is also similar to
the phishing attack used by cybercriminals to steal credit card details or sensitive information, by
making it look like it came from a trusted organization. Cybercriminals use text messages to get
personal information by trying to redirect them to a fake website. This fake website looks like that it
is an original website.

Symptoms of Phishing
• It may request the user to share personal details like the login credentials
related to the bank and more.
• It redirects to a website if the user clicks on the link that was sent in the
email.
• If they are redirected to a website it may want some information related to
the credit card or banking details of the user.

Preventions
• Do not try to open any suspicious email attachments.
• Do not try to open any link which may seem suspicious.
• Do not try to provide any sensitive information like personal information or banking
information via email, text, or messages.
• Always the user should have an antivirus to make sure the system is affected by the
system or not.

cybersecurity unit 5 basics of cybersecurity

Recommended

Recommended

More Related Content

Similar to cybersecurity unit 5 basics of cybersecurity

Similar to cybersecurity unit 5 basics of cybersecurity (20)

Recently uploaded

Recently uploaded (20)

cybersecurity unit 5 basics of cybersecurity