What are cy­ber­at­tacks and how to prevent them

When it comes to cy­ber­at­tacks, criminals tend to use the internet to enrich them­selves or harm others. Cy­ber­at­tacks draw on different attack patterns that tend to be adapted to the mo­tiv­a­tion behind an attack. However, users aren’t entirely de­fense­less. With the right security strategies, you can secure and defend yourself.

What is a cy­ber­at­tack?

A cy­ber­at­tack is a targeted assault on IT systems or networks aimed at stealing data, sab­ot­aging systems, or causing other forms of damage. Criminals de­lib­er­ately target specific in­di­vidu­als, busi­nesses, or­gan­isa­tions, or gov­ern­ment agencies. Every attack is driven by a motive—though these motives can vary widely:

• Theft: As with most criminal acts, cy­ber­crimes are often motivated by greed. Often cy­ber­at­tacks are all about stealing data that can be resold or used to access in­di­vidu­al bank accounts.
• Blackmail: Criminals may infect company or private user systems so that these can no longer be used, at least not by those with limited IT knowledge. They can then extort con­sid­er­able sums promising to release the IT in­fra­struc­ture upon payment.
• Sabotage: Attacks aren’t always motivated by money. Some attacks are financed by com­pet­it­ors. For example, one company may want to damage a com­pet­it­or to be more suc­cess­ful.
• Activism: Hackt­iv­ism continues to grow in pop­ular­ity. Here, polit­ic­ally motivated cy­ber­crim­in­als use their skills to damage the repu­ta­tion of those they disagree with or to generate attention for political goals through attacks.
• Espionage: In­dus­tri­al espionage and espionage of gov­ern­ment continues to shift online. The focus of these attacks is on accessing knowledge.

What are the various types of cy­ber­at­tacks?

Types of cy­ber­at­tacks tend to vary as much as the mo­tiv­a­tion for them. In many cases, attack patterns are combined in order to inflict damage as ef­fect­ively and broadly as possible.

Phishing

Phishing emails use social en­gin­eer­ing tactics to ma­nip­u­late people into ignoring security concerns, down­load­ing disguised malware, or revealing sensitive in­form­a­tion. Variants of this method include smishing (via SMS) and vishing (via phone).

Man-in-the-Middle (MITM)

In a Man-in-the-Middle attack, the attacker positions them­selves between two internet par­ti­cipants—such as a client and a server. This allows cy­ber­crim­in­als to intercept and steal sensitive data like passwords. These attacks often exploit malware or unsecured Wi-Fi con­nec­tions, and commonly involve fake cer­ti­fic­ates or various spoofing tech­niques.

Denial-of-Service (DoS)

If the sole purpose of an attack is to take down a web service, Denial-of-Service attacks (DoS) are often used. In these cases, a server is flooded with so many requests that it becomes un­re­spons­ive. Larger-scale attacks are carried out through Dis­trib­uted Denial-of-Service attacks (DDoS). To do this, cy­ber­crim­in­als often rely on botnets—networks of hundreds of computers infected with malware. Without the owners’ knowledge, these devices are used to par­ti­cip­ate in the cy­ber­at­tack.

SQL Injection

In an SQL injection, attackers exploit SQL in­ter­ac­tions in a web ap­plic­a­tion where user inputs are not properly filtered—such as insecure input fields. Through comment sections or search forms, cy­ber­crim­in­als can ma­nip­u­late the SQL database to access, alter, or delete sensitive data.

Zero-day exploits

Zero-day exploits are security vul­ner­ab­il­it­ies in software or hardware that attackers exploit before the man­u­fac­turer or de­vel­op­ment community becomes aware of them and can release a patch. The term ‘zero day’ refers to the fact that there is no warning time. These exploits pose a serious threat, as tra­di­tion­al security measures typically cannot detect them. Attacks can occur via infected email at­tach­ments, com­prom­ised websites, or directly through vul­ner­ab­il­it­ies in operating systems and ap­plic­a­tions.

Well-known cy­ber­at­tacks

In recent years, big cy­ber­at­tacks on companies and public au­thor­it­ies have become in­creas­ingly common. On one hand, this is due to large-scale, high-profile cy­ber­at­tacks carried out by groups like the hacker col­lect­ive Anonymous. On the other hand, there are also wide­spread reports of major data breaches that have impacted not only the targeted companies but also thousands of users.

WannaCry

One well-known cy­ber­at­tack happened in 2017 using the WannaCry ransom­ware. Although the attacks were not targeted, they were or­ches­trated in such a way that hundreds of thousands of PCs got infected in a short time. The cy­ber­crim­in­als used a backdoor in older Windows systems to this end. This was ori­gin­ally dis­covered by the US in­tel­li­gence agency NSA but not im­me­di­ately disclosed. Computers not running an in­stall­a­tion of a recently published security patch were affected.

The attackers used this exploit to inject malware, which encrypted all data. Users could no longer use their systems. Instead, they were shown a message asking them to pay $300 (around £240) in bitcoin. Although numerous security experts advised against paying the ransom, the criminals managed to extort over $130,000 (around £100,000)in crypto­cur­rency.

Project Chanology

In recent years, hacker group Anonymous has re­peatedly caused a stir. One attack by the group concerned Sci­ento­logy. In 2007, the or­gan­isa­tion banned an interview with famous member Tom Cruise. Anonymous activists con­sidered this a form of cen­sor­ship and announced re­tali­at­ory strikes via video message.

Shortly there­after, the hackers began over­load­ing Sci­ento­logy’s servers with DDoS attacks. This allowed the attackers to paralyse the website for a short time to disrupt the or­gan­isa­tion’s activ­it­ies. They also sent countless faxes and made prank calls. After the initial illegal digital attacks on Sci­ento­logy, activism shifted to legal protests outside the or­gan­isa­tion’s branches.

Sol­ar­Winds hack

One of the most serious cy­ber­at­tacks in recent years was uncovered in 2020. The Sol­ar­Winds hack involved a supply chain attack that com­prom­ised the software delivery process of the company Sol­ar­Winds. Sol­ar­Winds provides network man­age­ment software used by many busi­nesses and gov­ern­ment agencies around the world. Hackers gained access to Sol­ar­Winds’ internal systems and ma­nip­u­lated an update of its Orion software, which was then installed by thousands of customers.

This backdoor gave the attackers access to sensitive networks of U.S. gov­ern­ment agencies, IT firms, and major cor­por­a­tions. Affected or­gan­isa­tions included the U.S. De­part­ment of the Treasury, the De­part­ment of Commerce, Microsoft, and FireEye. What made the attack par­tic­u­larly alarming was that it went un­detec­ted for months, as the per­pet­rat­ors acted with extreme caution and covered their tracks. It was only after cy­ber­se­cur­ity firm FireEye dis­covered unusual activity in its own systems that the full extent of the breach became clear.

Yahoo! Hack

In 2013 and 2014, the Yahoo! group suffered several attacks on its databases. The attackers stole several billions of data records, including poorly encrypted passwords or com­pletely un­en­cryp­ted answers to security questions. These were offered on illegal mar­ket­places across the Dark Web. Buyers on these platforms hoped that the stolen passwords were also being used on other sites or for online banking, allowing them to profit from the data.

In response to the attacks, Yahoo! required its users to reset their passwords and choose new answers to security questions, which were then more securely encrypted. Ad­di­tion­ally, Yahoo! had to pay over $100 million (around £80 million) in damages to affected users.

How to protect yourself from a cy­ber­at­tack

Cy­ber­crim­in­als are con­stantly de­vel­op­ing more complex ways to breach systems and steal data. Even cy­ber­se­cur­ity experts are often a step behind. However, that doesn’t mean you’re de­fense­less against cy­ber­at­tacks. With the following tips on cy­ber­se­cur­ity, you’ll be well prepared to face potential threats.

How can you prevent cy­ber­at­tacks?

Attackers tend to exploit security vul­ner­ab­il­it­ies in outdated systems. One of the best pre­vent­at­ive measures users can take is to regularly update their operating system and software. To find out about updates or patches, simply activate the automatic update function. This also applies to antivirus programs.

Criminals don’t always use malware for cy­ber­at­tacks. Password-protected areas tend to be attacked more directly. Brute Force attacks (trying out password com­bin­a­tions), Rainbow Tables (tables with hash values) or password dic­tion­ar­ies (col­lec­tions of typical passwords) can be used to crack weak passwords. Strong passwords and two-factor au­then­tic­a­tion are among the most effective pre­vent­ive measures against cy­ber­at­tacks.

How can you spot a cy­ber­at­tack?

Many attacks succeed simply because they go un­re­cog­nised. This is es­pe­cially true with phishing, where you should be cautious with emails from unknown senders. Never download or open at­tach­ments or click on links in messages like these. The same level of caution applies when browsing the web: even seemingly harmless websites can pose threats. Avoid down­load­ing software from sites you don’t fully trust. A missing SSL cer­ti­fic­ate can be a strong indicator of an un­trust­worthy source.

System admins also have ad­di­tion­al ways to detect cy­ber­at­tacks. Servers keep log files by default which track sus­pi­cious activ­it­ies. For example, an increased number of un­suc­cess­ful password entries indicates a brute force attack. In addition, you can monitor your IT in­fra­struc­ture. Malware produces side effects such as a slowed network con­nec­tion which may be a sign of a cy­ber­at­tack.

How can you do during an attack?

Es­pe­cially in the case of DDoS attacks, there are ways to keep your online presence ac­cess­ible despite the attack. Using a Content Delivery Network (CDN) makes it nearly im­possible for cy­ber­crim­in­als to com­pletely take down a website. Even if your own server is over­whelmed, the site can still be accessed through the network of mirrored content.

If you’re facing a cy­ber­at­tack, there are official resources in the UK that can assist you. Agencies like the National Cyber Security Centre (NCSC) and Action Fraud have spe­cial­ised units focused on cy­ber­crime and cy­ber­se­cur­ity. You can report cyber incidents and get support through the Action Fraud website or visit the NCSC’s website for guidance and tools to help mitigate attacks.

What pro­tec­tion is available in a worst-case scenario?

There’s no such thing as 100% pro­tec­tion against cy­ber­at­tacks, which is why it’s essential to prepare for the worst-case scenario. One key step is to use strong en­cryp­tion methods to ensure that sensitive data is rendered useless to un­au­thor­ised in­di­vidu­als even if it gets stolen.

A solid backup strategy is equally important. Ransom­ware attacks, for example, lose their impact if you’ve stored your critical data securely elsewhere. The 3-2-1 backup rule helps ensure your files are always protected.