Security Threats and Vulnerabilities
What is Threat?
A threat, in the context of computer security, refers to
anything that has the potential to cause serious harm to a computer system. A
threat is something that may or may not happen, but has the potential to cause
serious damage. Threats can lead to attacks on computer systems, networks and
more. What is Vulnerability?
In computer security, vulnerability is a weakness which
allows an attacker to reduce a system's information assurance. (i.e., insecure
system)
Computer Threat:-
In computer security a threat is a possible danger that
might exploit a vulnerability to breach security and thus cause possible harm.
A threat can be either "intentional" (i.e., intelligent; e.g., an
individual cracker or a criminal organization) or "accidental" (e.g.,
the possibility of a computer malfunctioning, or the possibility of a natural
disaster such as an earthquake, a fire, or a tornado) or otherwise a
circumstance, capability, action, or event. Here are many types of computer
security threats in this world. Some are pretty harmful while some are totally
harmless although annoying.
The types of computer security threats:
1. Trojan
Trojan is one of the most complicated threats among all.
Most of the popular banking threats come from the Trojan family such as Zeus
and SpyEye. It has the ability to hide itself from antivirus detection and
steal important banking data to compromise your bank account. If the Trojan is
really powerful, it can take over your entire security system as well. As a
result, a Trojan can cause many types of damage starting from your own computer
to your online account.
2. Virus
Looking at the technology 10 years back, Virus is something
really popular. It is a malicious program where it replicates itself and aim to
only destroy a computer. The ultimate goal of a virus is to ensure that the
victim’s computer will never be able to operate properly or even at all. It is
not so popular today because Malware today is designed to earn money over destruction.
As a result, Virus is only available for people who want to use it for some
sort of revenge purpose.
3. Worms
One of the most harmless threats where it is program
designed only to spread. It does not alter your system to cause you to have a
nightmare with your computer, but it can spread from one computer to another
computer within a network or even the internet. The computer security risk here
is, it will use up your computer hard disk space due to the replication and
took up most of your bandwidth due to the spread.
4. Spyware
Is a Malware which is
designed to spy on the victim’s computer? If you are infected with it, probably
your daily activity or certain activity will be spied by the spyware and it
will find itself a way to contact the host of this malware. Mostly, the use of
this spyware is to know what your daily activity is so that the attacker can
make use of your information. Such as if you browse on sex toys for a week
every day, the attacker will try to come out with a sex toy scam to cheat on
your money.
5. Scareware
Scareware is something that plant into your system and
immediately inform you that you have hundreds of infections which you don’t
have. The idea here is to trick you into purchasing a bogus anti-malware where
it claims to remove those threats. It is all about cheating your money but the
approach is a little different here because it scares you so that you will buy.
6. Keylogger
Something that keeps a record of every keystroke you made on
your keyboard. Keylogger is a very powerful threat to steal people’s login
credential such as username and password. It is also usually a sub-function of
a powerful Trojan.
7. Adware
Is a form of threat where your computer will start popping
out a lot of advertisement? It can be from non-adult materials to adult
materials because any ads will make the host some money. It is not really
harmful threat but can be pretty annoying.
8. Phishing
A fake website which is designed to look almost like the
actual website is a form of phishing attack. The idea of this attack is to
trick the user into entering their username and password into the fake login
form which serves the purpose of stealing the identity of the victim. Every
form sent out from the phishing site will not go to the actual server, but the
attacker controlled server.
9. Bluesnarfing
Bluesnarfing is all about having an unauthorized access to a
specific mobile phones, laptop, or PDA via Bluetooth connection. By having such
unauthorized access, personal stuff such as photos, calendar, contacts and SMS
will all be revealed and probably even stolen.
10. DDoS
One of the most famous thing done by Anonymous, which is to
send millions of traffic to a single server to cause the system to down with
certain security feature disable so that they can do their data stealing. This
kind of trick which is to send a lot of traffic to a machine is known as
Distributed Denial of Service, also known as DDoS.
11. Social Engineering
Tricking computer users into revealing computer security or
private information, e.g. passwords, email addresses, etc. by exploiting the natural tendency of a person
to trust and/or by exploiting a person's emotional response.
What is password?
A password is a word or string of characters used for user
authentication to prove identity or access approval to gain access to a
resource (example: an access code is a type of password), which should be kept
secret from those not allowed access.
Why are passwords needed?
Passwords are used for authentication. Authentication can be thought of as the act of
linking yourself to your electronic identity within the system you are
connecting to your password is used to verify to the system that you are the
legitimate owner of the user/account identifier commonly referred to as
“logging in”
Weak password:-
Weak password are based on
common dictionary words
Including dictionary words that
have been altered:
-Reversed (e.g., “terces”)
-Mixed case (e.g., SeCreT)
-Character/Symbol replacement
(e.g., “$ecret”)
-Words with vowels removed
(e.g., “scrt”)
-based on common names -based on user/account identifier
-short (under 6 characters)
-based on keyboard patterns (e.g., “qwerty”)
-composed of single symbol type (e.g., all characters)
Strong password:-
-contain at least one of each of the following:
Digit (0...9)
Letter (a...Z)
Punctuation symbol
Control character (e.g., ^s, Ctrl-s)
-are based on a verse (e.g., passphrase) from an obscure work where The
password is formed from the characters in the verse e.g., “ypyiyp” derived from
the title of this module Sometimes referred to as a virtual password
-are easily remembered by you
but very difficult (preferably impossible) for others to guess
Password cracking:-
Password cracking is the process of recovering passwords from data that
have been stored in or transmitted by a computer system. A common approach
(brute-force attack) is to repeatedly try guesses for the password.
Password Cracking Techniques:
1.
Brute Force Attack –
Any password can be cracked using Brute-force attack. Brute-force attacks try every possible combination of numbers, letters and special characters until the right password is match. Brute[1]force attacks can take very long time depending upon the complexity of the password. The cracking time is determined by the speed of computer and complexity of the password.
Use long and complex passwords. Try to use
combination of upper and lowercase letters along with numbers. Brute-force
attack will take hundreds or even thousands of years to crack such complex and
long passwords. Example: Passwords like "iloveu" or
"password" can be cracked easily whereas computer will take years to
crack passwords like "aN34lL00"
2.
Social Engineering
Social engineering is process of
manipulating someone to trust you and get information from them. For example,
if the hacker was trying to get the password of a co-workers or friends
computer, he could call him pretending to be from the IT department and simply
ask for his login details. Sometime hackers call the victim pretending to be
from bank and ask for their credit cards details. Social Engineering can be
used to get someone password, to get bank credentials or any personal
information.
Solution-If someone tries to get
your personal or bank details ask them few questions. Make sure the person
calling you is legit. Never ever give your credit card details on phone.
3.
Rats and Keyloggers
In keylogging or RATing the
hacker sends keylogger or rat to the victim. This allows hacker to monitor
everything victim does on his computer. Every keystroke is logged including
passwords. Moreover hacker can even control the victim’s computer.
Solution: Never login to your
bank account from cyber cafe or someone else computer. If it’s important use
on-screen or virtual keyboard while tying the login. Use latest anti-virus
software and keep them updated. Check out below article to know more about Rats
and Keyloggers.
4.
Phishing
Phishing is the easiest and
popular hacking method used by hackers to get someone account details. In
Phishing attack hacker send fake page of real website like facebook, Gmail to
victim. When someone login through that fake page his details is send to the
hacker. These fake pages can be easily created and hosted on free web-hosting
sites.
solution: Phishing attacks are
very easy to avoid. The URL of this phishing pages are different from the real
one. For example URL of phishing page of facebook might look like facbbook.com
(As you can see there are two "b"). Always make sure that websites
URL is correct. Check out below article to know more about phishing.
5.
Rainbow Table
A Rainbow table is a huge
pre-computed list of hashes for every possible combination of characters. A
password hash is a password that has gone through a mathematical algorithm such
as md5 and is transformed into something which is not recognizable. A hash is a
one way encryption so once a password is hashed there is no way to get the
original string from the hashed string. A very commonly used hashing algorithm
to store passwords in website databases is MD5. It is almost similar to
dictionary attack, the only difference is, in rainbow tables attack hashed
characters are used as passwords whereas in dictionary attack normal characters
are used as passwords. Example: ‘hello’ in md5 is
5d41402abc4b2a76b9719d911017c592 and zero length string ("") is
d41d8cd98f00b204e9800998ecf8427e
Solution: Make sure you choose
password that is long and complex. Creating tables for long and complex
password takes a very long time and a lot of resources.
6.
Guessing
This seems silly but this can
easily help you to get someone’s password within seconds. If hacker knows you,
he can use information he knows about you to guess your password. Hacker can
also use combination of Social Engineering and Guessing to acquire your
password.
Solution: Don't use your name,
surname, phone number or birth date as your password. Try to avoid creating
password that relates to you. Create complex and long password with combination
of letters and numbers.
• Unsecure Network connections :
Let’s look at what an unsecured network is. Generally you can call a
network “unsecure” if there are no password or login credentials needed to
access it. You just get on and surf the internet. These types of networks can
still be found in many places, but in recent years the trend has been towards
security.
There are generally two
types of WiFi networks you can access: ad-hoc networks and traditional access
point networks. Ad-hoc networks connect devices directly to one another, while
traditional networks connect devices to a central router. So, for example, you
can connect two laptops or your laptop and your phone together without the need
for a router or any other hardware. This would create an ad-hoc network. This
is different from a traditional access point network where each device connects
to a router.
So
that “free public WiFi” network you encounter at the airport is actually an
ad-hoc network that was probably started as a prank long ago but still persists
to this day. Basically, when you try to connect to this network, you are
actually connecting to another computer.
Why You Shouldn’t Connect to Unsecure Networks
Say you’re sitting in a coffee shop and decide you
want to check your Facebook page and your email to kill some time. You scan the
available networks and see one that’s open and unsecured. You connect and start
surfing. Coffee and free WiFi, what could be better, right? Wrong! A hacker is
also fond of coffee shops and he is located within range of the router you
connected to. He’s waiting for one or more people to connect to the network so
he can start a man in the middle attack. Within a few minutes, he could gain
access to all your passwords, including bank accounts, emails, and anything
else.
• Malicious code:
Malicious code
is code causing damage to a computer or system. It is code not easily or solely
controlled through the use of anti-virus tools. Malicious code can either
activate itself or be like a virus requiring a user to perform an action, such
as clicking on something or opening an email attachment.
• Programming
Bugs :
A software bug is an error, flaw, failure, or fault in
a computer program or system that causes it to produce an incorrect or unexpected
result, or to behave in unintended ways.
• Cyber crime:
Cyber crime encompasses any criminal act dealing with
computers and networks (called hacking). Additionally, cyber crime also
includes traditional crimes conducted through the Internet. For example; hate
crimes, telemarketing and Internet fraud, identity theft, and credit card
account thefts are considered to be cyber crimes when the illegal activities
are committed through the use of a computer and the Internet.
The growing
list of cybercrimes includes crimes that have been made possible by computers,
such as network intrusions and the dissemination of computer viruses, as well
as computer-based variations of existing crimes, such as identity theft,
stalking, bullying and terrorism.
Example:
1)
Identify Theft:
Some criminals use the Internet to break into victims'
online financial accounts, taking passwords, money and sensitive information.
Others create online centres for trafficking stolen identity information. With
more and more people conducting business online and using the Internet to pay
bills, the number of identity theft victims has risen. People that use
birthdays, their children’s names and pet names as passwords are typically more
at risk for identity theft.
2)
Storing Illegal Information
Criminals use the
Internet to obtain and transfer illegal images, such as child pornography. Even
storing or saving these types of images on a computer is illegal. Other
criminals use their computer databases to store illegal information, including
confidential intellectual property.
3)
Computer Viruses
Computer hackers are digital age criminals that can bring
down large infrastructures with a single keystroke emitting a computer virus.
These types of viruses are macro or binary. Macro viruses attack a specific
program, while binary viruses attack data or attach to program files. Hacking
into a business’s intranet and uploading viruses to the code are examples of
these types of crimes. Private Citizens are targets of computer viruses when
visiting websites with encrypted viruses or opening emails infected with
viruses. One of the most famous computer viruses is the Trojan virus.
4)
Fraud
In the digital age,
many criminals easily commit fraud against unsuspecting victims by
misrepresenting the facts. For example, an employee intentionally inputs false
information into the company database or intranet. Or consider the
"Nigerian prince email," where an online predator attempts to steal
money from targeted consumers by gaining access to a shared bank account
• Cyber terrorism:
Cyber terrorism is the use of Internet attacks in terrorist
activities, including acts of deliberate, large-scale disruption of computer
networks, especially of personal computers attached to the Internet, by the
means of tools such as computer viruses.
Preventing from Attack and Threats
• Recovering from Viruses, Worms, and Trojan Horses
• Avoiding Social Engineering and Networking Attacks
• Avoiding the Pitfalls of Online Trading
• Using Caution with USB Drives
• Securing Wireless Networks
Preventing from
Email and communication
• Using Caution with
Email Attachments
• Reducing Spam
• Using Caution With Digital Signatures
• Using Instant Messaging and Chat Rooms Safely
• Staying safe on social Network Sites
Use Safe Browsing
• Evaluating Your Web Browser's Security Settings
• Shopping Safely Online
• Web Site
Certificates
• Bluetooth Technology
• Reviewing End-User License Agreements
Privacy Control
• Protecting Your
Privacy
• Effectively Erasing Files
• Supplementing Passwords
Tips for securing the system attack
• Install and Use Anti-Virus Programs
• Use Care When
Reading Email with Attachments
• Install and Use a Firewall Program
• Make Backups of
Important Files and Folders
• Use Strong
Passwords
• Use Care When Downloading and Installing
• Install and Use a Hardware Firewall
• Install and Use a File Encryption Program and Access
Controls
• Safeguard your Data
• Real-World
Warnings keep you safe online.
• Keeping Children Safe Online