Now that we've considered who might carry out cyber attacks and why, we're going to look at how cyber attacks are carried out. At the end of this module, you should be able to identify and provide examples of different types of cyber attacks and understand the stages of a cyber attack. Cyber attacks usually fall into one of two categories, untargeted and targeted attacks. In untargeted attacks, attackers try to target as many devices, services or users as possible. They don't care about who the victim is, usually, they're just trying to work on the principle that if they target enough people, some of them will take the bait. To do this, they use techniques that take advantage of the openness of the internet, which include gathering public information from social media, which is then either used to specifically target other people or just using social media to identify the target audience. Next, they might wanna deliver malware, which is then used to steal data or block access to online systems. They may try phishing, which is sending emails to large numbers of people asking them for sensitive information such as bank details or encourage them to visit a fake website. They may try water-holing, which is setting up a fake website or compromising a legitimate one in order to exploit visiting users. They may try some sort of ransomware, where data's locked and then the criminals will demand a ransom to unlock it.

In untargeted attacks, criminals might use scanning tools to scan the internet for information or for vulnerable systems to identify the targets or it could simply be a case of theft, where criminals steal laptops, tablets and smartphones from unsuspecting victims, which they then sell on or use to steal the information that's stored on them. As its name implies, in a targeted attack, the attackers have a particular target in mind, such as an individual, a company or maybe some critical national infrastructure. Usually, targeted attacks are carried out by more skilled people and can extend over long periods of time. A targeted attack usually has a specific aim. Many of the techniques used in untargeted attacks can also be used in targeted attacks but they may be more directed. For example, a particular employee might be targeted with a phishing email and this is known as spear phishing or whaling, if it's directed at the senior executives. The attackers might target a specific technology that's being used by the organisation, such as a web server, or they may target something being supplied through the supply chain. They might attack other systems, with the aim to create a botnet, where hundreds or possibly thousands of compromised systems, maybe home routers or cameras, are used to carry out a denial of service attack. If employees have company-supplied equipment, that can be stolen form cars or from homes and in a more sophisticated attack, employees might be tracked or followed to find opportunities to steal their equipment. Another and more advanced type of cyber attack is an advanced persistent threat or APT.

An APT is a type of cyber attack where the attackers use sophisticated techniques to gain and then maintain access for long periods of time to steal information without being detected. Because of the level of effort needed to carry out these types of attacks, APTs are usually aimed at high-value targets, such as nation states and large corporations. One of the dangers of APT attacks is that even when they're discovered and the immediate threat appears to be gone, the hackers might've left back doors that allow them to return at a later date, so an APT can persist for weeks, months or in some cases, even years. Many traditional cyber defences, such as antivirus and firewalls, can't always protect against these types of attacks. Advanced persistent threats are often sponsored, sometimes by governments, and often APTs can be linked to specific groups of attackers and these are given identities or nicknames, such as APT28, which is nicknamed FANCYBEAR. Targeted cyber attacks are often carefully planned and the anatomy of an attack can be broken down into various stages. There are a number of different models which outline the stages of targeted cyber attacks. The Cyber Kill Chain, produced by Lockheed Martin, is a very popular example but each of the models demonstrates that there's a typical pattern. Our slide shows the model which has been adopted by the National Cyber Security Centre. In the first stage, survey, attackers will start by looking for information about people, technology, buildings and procedures, to see if they can find anything that can be of use to them to exploit. They'll use information from social media, such as LinkedIn and Facebook, they'll search job adverts and look at company websites.

Now, using publicly-accessible information on the internet to gather information is known as open-source intelligence and this is a technique employed by both attackers and security professionals. Remember, people are generally the weakest link in security and they'll often unwittingly be giving information out in the public domain that can then be used by attackers. They might be posting on social media about where they work, what they do and even what's going on at work and this is all useful stuff to attackers, to build up a profile. They might even be able to identify vulnerable employees to target or assess the way things are done, which they can take advantage of, such as delivering a link in a phishing email, which allows the attacker to gain remote control and then impersonate that person on the company network. They can take a look at company websites and find out who the executives are and maybe some other key employees. They might also be able to get information from publicly-accessible documents, which might reveal where things are stored or what software was used to create them and even something like a job advert could be giving away information. Employers who are looking for new people will often post adverts about the skills they're looking for, so the job ad gives away information about the software and the systems that are being used by the employer. Attackers will use standard network tools and also, special toolkits to collect and assess any information about computers, software and security systems that are being used and this'll help them identify possible weak systems, back doors and vulnerabilities, as well as potential victims that they can go on to target.

During the delivery stage, the attacker will look to get into a position where they can exploit the vulnerability that they've identified or they think could potentially exist. For example, they might attempt to access an organisation's online services, where they've found a weakness or they might send an email containing a link to a malicious website or an attachment which contains malicious code. They might try different paths to find a way to breach the security defences and gain access to computer systems and networks and this could involve writing custom malware or coding scripts that interrupt operations and defeat security tools. Again, people could be the weak link here. Getting malware or hacking tools onto a company's network can be very difficult to do, especially if there are good security controls in place but all it might take is one unsuspecting person who isn't being careful. For example, they could be at a trade fair and they're given a free USB stick, which they then to take back to work and they just plug into their computer without thinking. Now, once attackers have found ways to gain access, they'll attempt to exploit the weaknesses in the systems and this is the breach phase. They might make changes that affect the system's operation, gain access to online accounts or take control of the user's computer, pretending to be the victim and using their legitimate access to gain access to other systems and information. Their ultimate aim might be to get administrator-level access to some systems, which they then use to unlock security systems or to gain further access to other information.

Depending on their objectives, the affect phase is where the attackers aim to carry out their ultimate mission to steal sensitive information, disrupt business operations or make changes for their own benefit, such as creating payments into a bank account. They might use their presence on the network to continue to get access to more and more things. The affect phase could last for some time but after achieving their objectives, more skilled attackers might try to cover their tracks and delete any evidence. In some cases, attackers might try to leave things open for others or even advertise that they've been successful. Attack vectors describe the routes and the techniques that attackers use and here are some of the most common ones. During this course, we'll be looking at many of these, from both the perspective of the attacker and the defender. As we introduce more and more complexity and technology into our homes and businesses, we increase the footprint for attack and this raises an important question, is it harder to defend than attack? What do you think?

Module 3: How do they attack?​

About

Module 3: How do they attack?