What are cy­ber­at­tacks and how to prevent them

When it comes to cy­ber­at­tacks, criminals tend to use the internet to enrich them­selves or harm others. Cy­ber­at­tacks draw on different attack patterns that tend to be adapted to the mo­ti­va­tion behind an attack. However, users aren’t entirely de­fense­less. With the right security strate­gies, you can secure and defend yourself.

What is a cy­ber­at­tack?

A cy­ber­at­tack is a targeted assault on IT systems or networks aimed at stealing data, sab­o­tag­ing systems, or causing other forms of damage. Criminals de­lib­er­ate­ly target specific in­di­vid­u­als, busi­ness­es, or­ga­ni­za­tions, or gov­ern­ment agencies. Every attack is driven by a motive—though these motives can vary widely:

• Theft: As with most criminal acts, cy­ber­crimes are often motivated by greed. Often cy­ber­at­tacks are all about stealing data that can be resold or used to access in­di­vid­ual bank accounts.
• Blackmail: Criminals may infect company or private user systems so that these can no longer be used, at least not by those with limited IT knowledge. They can then extort con­sid­er­able sums promising to release the IT in­fra­struc­ture upon payment.
• Sabotage: Attacks aren’t always motivated by money. Some attacks are financed by com­peti­tors. For example, one company may want to damage a com­peti­tor to be more suc­cess­ful.
• Activism: Hack­tivism continues to grow in pop­u­lar­i­ty. Here, po­lit­i­cal­ly motivated cy­ber­crim­i­nals use their skills to damage the rep­u­ta­tion of those they disagree with or to generate attention for political goals through attacks.
• Espionage: In­dus­tri­al espionage and espionage of gov­ern­ment continues to shift online. The focus of these attacks is on accessing knowledge.

What are the various types of cy­ber­at­tacks?

Types of cy­ber­at­tacks tend to vary as much as the mo­ti­va­tion for them. In many cases, attack patterns are combined in order to inflict damage as ef­fec­tive­ly and broadly as possible.

Phishing

Phishing emails use social en­gi­neer­ing tactics to ma­nip­u­late people into ignoring security concerns, down­load­ing disguised malware, or revealing sensitive in­for­ma­tion. Variants of this method include smishing (via SMS) and vishing (via phone).

Man-in-the-Middle (MITM)

In a Man-in-the-Middle attack, the attacker positions them­selves between two internet par­tic­i­pants—such as a client and a server. This allows cy­ber­crim­i­nals to intercept and steal sensitive data like passwords. These attacks often exploit malware or unsecured Wi-Fi con­nec­tions, and commonly involve fake cer­tifi­cates or various spoofing tech­niques.

Denial-of-Service (DoS)

If the sole purpose of an attack is to take down a web service, Denial-of-Service attacks (DoS) are often used. In these cases, a server is flooded with so many requests that it becomes un­re­spon­sive. Larger-scale attacks are carried out through Dis­trib­uted Denial-of-Service attacks (DDoS). To do this, cy­ber­crim­i­nals often rely on botnets—networks of hundreds of computers infected with malware. Without the owners’ knowledge, these devices are used to par­tic­i­pate in the cy­ber­at­tack.

SQL Injection

In an SQL injection, attackers exploit SQL in­ter­ac­tions in a web ap­pli­ca­tion where user inputs are not properly filtered—such as insecure input fields. Through comment sections or search forms, cy­ber­crim­i­nals can ma­nip­u­late the SQL database to access, alter, or delete sensitive data.

Zero-day exploits

Zero-day exploits are security vul­ner­a­bil­i­ties in software or hardware that attackers exploit before the man­u­fac­tur­er or de­vel­op­ment community becomes aware of them and can release a patch. The term “zero day” refers to the fact that there is no warning time. These exploits pose a serious threat, as tra­di­tion­al security measures typically cannot detect them. Attacks can occur via infected email at­tach­ments, com­pro­mised websites, or directly through vul­ner­a­bil­i­ties in operating systems and ap­pli­ca­tions.

Well-known cy­ber­at­tacks

In recent years, big cy­ber­at­tacks on companies and public au­thor­i­ties have become in­creas­ing­ly common. On one hand, this is due to large-scale, high-profile cy­ber­at­tacks carried out by groups like the hacker col­lec­tive Anonymous. On the other hand, there are also wide­spread reports of major data breaches that have impacted not only the targeted companies but also thousands of users.

WannaCry

One well-known cy­ber­at­tack happened in 2017 using the WannaCry ran­somware. Although the attacks were not targeted, they were or­ches­trat­ed in such a way that hundreds of thousands of PCs got infected in a short time. The cy­ber­crim­i­nals used a backdoor in older Windows systems to this end. This was orig­i­nal­ly dis­cov­ered by the US in­tel­li­gence agency NSA but not im­me­di­ate­ly disclosed. Computers not running an in­stal­la­tion of a recently published security patch were affected.

The attackers used this exploit to inject malware, which encrypted all data. Users could no longer use their systems. Instead, they were shown a message asking them to pay $300 in bitcoin. Although numerous security experts advised against paying the ransom, the criminals managed to extort over $130,000 in cryp­tocur­ren­cy.

Project Chanology

In recent years, hacker group Anonymous has re­peat­ed­ly caused a stir. One attack by the group concerned Sci­en­tol­ogy. In 2007, the or­ga­ni­za­tion banned an interview with famous member Tom Cruise. Anonymous activists con­sid­ered this a form of cen­sor­ship and announced re­tal­ia­to­ry strikes via video message.

Shortly there­after, the hackers began over­load­ing Sci­en­tol­ogy’s servers with DDoS attacks. This allowed the attackers to paralyze the website for a short time to disrupt the or­ga­ni­za­tion’s ac­tiv­i­ties. They also sent countless faxes and made prank calls. After the initial illegal digital attacks on Sci­en­tol­ogy, activism shifted to legal protests outside the or­ga­ni­za­tion’s branches.

So­lar­Winds hack

One of the most serious cy­ber­at­tacks in recent years was uncovered in 2020. The So­lar­Winds hack involved a supply chain attack that com­pro­mised the software delivery process of the company So­lar­Winds. So­lar­Winds provides network man­age­ment software used by many busi­ness­es and gov­ern­ment agencies around the world. Hackers gained access to So­lar­Winds’ internal systems and ma­nip­u­lat­ed an update of its Orion software, which was then installed by thousands of customers.

This backdoor gave the attackers access to sensitive networks of U.S. gov­ern­ment agencies, IT firms, and major cor­po­ra­tions. Affected or­ga­ni­za­tions included the U.S. De­part­ment of the Treasury, the De­part­ment of Commerce, Microsoft, and FireEye. What made the attack par­tic­u­lar­ly alarming was that it went un­de­tect­ed for months, as the per­pe­tra­tors acted with extreme caution and covered their tracks. It was only after cy­ber­se­cu­ri­ty firm FireEye dis­cov­ered unusual activity in its own systems that the full extent of the breach became clear.

Yahoo! Hack

In 2013 and 2014, the Yahoo! group suffered several attacks on its databases. The attackers stole several billions of data records, including poorly encrypted passwords or com­plete­ly un­en­crypt­ed answers to security questions. These were offered on illegal mar­ket­places across the Dark Web. Buyers on these platforms hoped that the stolen passwords were also being used on other sites or for online banking, allowing them to profit from the data.

In response to the attacks, Yahoo! required its users to reset their passwords and choose new answers to security questions, which were then more securely encrypted. Ad­di­tion­al­ly, Yahoo! had to pay over $100 million in damages to affected users.

How to protect yourself from a cy­ber­at­tack

Cy­ber­crim­i­nals are con­stant­ly de­vel­op­ing more complex ways to breach systems and steal data. Even cy­ber­se­cu­ri­ty experts are often a step behind. However, that doesn’t mean you’re de­fense­less against cy­ber­at­tacks. With the following tips on cy­ber­se­cu­ri­ty, you’ll be well prepared to face potential threats.

How can you prevent cy­ber­at­tacks?

Attackers tend to exploit security vul­ner­a­bil­i­ties in outdated systems. One of the best pre­ven­ta­tive measures users can take is to regularly update their operating system and software. To find out about updates or patches, simply activate the automatic update function. This also applies to antivirus programs.

Criminals don’t always use malware for cy­ber­at­tacks. Password-protected areas tend to be attacked more directly. Brute Force attacks (trying out password com­bi­na­tions), Rainbow Tables (tables with hash values) or password dic­tio­nar­ies (col­lec­tions of typical passwords) can be used to crack weak passwords. Strong passwords and two-factor au­then­ti­ca­tion are among the most effective pre­ven­tive measures against cy­ber­at­tacks.

How can you spot a cy­ber­at­tack?

Many attacks succeed simply because they go un­rec­og­nized. This is es­pe­cial­ly true with phishing, where you should be cautious with emails from unknown senders. Never download or open at­tach­ments or click on links in messages like these. The same level of caution applies when browsing the web: even seemingly harmless websites can pose threats. Avoid down­load­ing software from sites you don’t fully trust. A missing SSL cer­tifi­cate can be a strong indicator of an un­trust­wor­thy source.

System admins also have ad­di­tion­al ways to detect cy­ber­at­tacks. Servers keep log files by default which track sus­pi­cious ac­tiv­i­ties. For example, an increased number of un­suc­cess­ful password entries indicates a brute force attack. In addition, you can monitor your IT in­fra­struc­ture. Malware produces side effects such as a slowed network con­nec­tion which may be a sign of a cy­ber­at­tack.

How can you do during an attack?

Es­pe­cial­ly in the case of DDoS attacks, there are ways to keep your online presence ac­ces­si­ble despite the attack. Using a Content Delivery Network (CDN) makes it nearly im­pos­si­ble for cy­ber­crim­i­nals to com­plete­ly take down a website. Even if your own server is over­whelmed, the site can still be accessed through the network of mirrored content.

If you’re facing a cy­ber­at­tack, there are official resources in the U.S. that can assist you. Agencies like the Federal Bureau of In­ves­ti­ga­tion (FBI) and the Cy­ber­se­cu­ri­ty and In­fra­struc­ture Security Agency (CISA) have spe­cial­ized units focused on cy­ber­crime and cy­ber­se­cu­ri­ty. You can report cyber incidents and get support through the FBI’s Internet Crime Complaint Center (IC3) or visit CISA’s website for guidance and tools to help mitigate attacks.

What pro­tec­tion is available in a worst-case scenario?

There’s no such thing as 100% pro­tec­tion against cy­ber­at­tacks, which is why it’s essential to prepare for the worst-case scenario. One key step is to use strong en­cryp­tion methods to ensure that sensitive data is rendered useless to unau­tho­rized in­di­vid­u­als even if it gets stolen.

A solid backup strategy is equally important. Ran­somware attacks, for example, lose their impact if you’ve stored your critical data securely elsewhere. The 3-2-1 backup rule helps ensure your files are always protected.