Understanding Attacker Profiles and Cybersecurity Threats, Slides of Cryptography and System Security

Download Understanding Attacker Profiles and Cybersecurity Threats and more Slides Cryptography and System Security in PDF only on Docsity!

Chapter 2: Attackers and

Their Attacks

Objectives

• Develop attacker profiles
• Describe basic attacks
• Describe identity attacks
• Identify denial of service attacks
• Define malicious code (malware)

Developing Attacker Profiles

(continued)

Hackers

• Person who uses advanced computer skills to attack computers, but not with a malicious intent
• Use their skills to expose security flaws

Script Kiddies

• Break into computers to create damage
• Are unskilled users
• Download automated hacking software from Web sites and use it to break into computers
• Tend to be young computer users with almost unlimited amounts of leisure time, which they can use to attack systems

Spies

• Person hired to break into a computer and steal information
• Do not randomly search for unsecured computers to attack
• Hired to attack a specific computer that contains sensitive information

Cyberterrorists

• Experts fear terrorists will attack the network and computer infrastructure to cause panic
• Cyberterrorists’ motivation may be defined as ideology, or attacking for the sake of their principles or beliefs
• One of the targets highest on the list of cyberterrorists is the Internet itself

Cyberterrorists (continued)

• Three goals of a cyberattack:
  • Deface electronic information to spread disinformation and propaganda
  • Deny service to legitimate computer users
  • Commit unauthorized intrusions into systems and networks that result in critical infrastructure outages and corruption of vital data

Social Engineering

• Easiest way to attack a computer system requires almost no technical ability and is usually highly successful
• Social engineering relies on tricking and deceiving someone to access a system
• Social engineering is not limited to telephone calls or dated credentials

Social Engineering (continued)

• Dumpster diving: digging through trash receptacles to find computer manuals, printouts, or password lists that have been thrown away
• Phishing: sending people electronic requests for information that appear to come from a valid source

Password Guessing

• Password: secret combination of letters and numbers that validates or authenticates a user
• Passwords are used with usernames to log on to a system using a dialog box
• Attackers attempt to exploit weak passwords by password guessing

Password Guessing (continued)

Password Guessing (continued)

• Brute force: attacker attempts to create every possible password combination by changing one character at a time, using each newly generated password to access the system
• Dictionary attack: takes each word from a dictionary and encodes it (hashing) in the same way the computer encodes a user’s password

Password Guessing (continued)

• Software exploitation: takes advantage of any weakness in software to bypass security requiring a password - Buffer overflow: occurs when a computer program attempts to stuff more data into a temporary storage area than it can hold