Upload
trannhi
View
214
Download
0
Embed Size (px)
Citation preview
IASP 470
The Internet of Insecure Things Professor Yoon
Group Paper
Student Name Work Accomplished
Thomas Hayes Cloud data, Cars, Wi-Fi, Wireless Devices, and Database Security
Iliandra Gonzalez Software, DDoS, Botnet, Malware,
Spyware, Keylogging, and Ransomware.
Abstract
There are numerous security risk on the internet that can cause problems to users. In the
spectrum of the internet and risk, there are a couple of key things to be aware of. In the internet
of insecure things, the more devices that are connected to the internet, the more vulnerabilities
there are exposed too. In technology there are software, cloud data, cars, Wi-Fi, and database
security that are prone to attacks or risks to end users. These threats are usually DDoS, botnets,
many forms of malware, spyware, keylogging, and ransomware.
We live in a world where the internet has become an extremely important aspect of our
everyday lives. Although there are more and more technological advances that are being created
constantly, there are more and more risks and threats that come with the new advances in
technology. Many people are not aware of the risks and threats that are present on the internet. It
is important to be aware and be educated of these risks. The term IoT illustrates the present day
dependency on the internet.
The internet of insecure things (IoT) is a term referring to the growing number of devices
being connected to the internet. Essentially all the “things” mentioned have security holes that
can put users at risk, every if they appear harmless. This terminology is not a new concept, it
first appeared in the early 2000’s by Kevin Ashton. Ashton laid the foundation of internet of
insecure things at MIT’s AutoID lab. This concept was dynamic because of its simplicity. During
the time of this, not all devices communicated with each other and stored the data in computers.
The concept of IoT is the possibility of all objects communicating with each other while being
managed by computers. In a 1999 article for the RFID Journal Ashton wrote the following:
“If we had computers that knew everything there was to know about things-
using data they gathered without any help from us—we would be able to track
and count everything, and greatly reduce waste, loss and cost. We would know
when things needed replacing, repairing or recalling, and whether they were
fresh or past their best. We need to empower computers with their own means
of gathering information, so they can see, hear and smell the world for
themselves, in all its random glory. RFID and sensor technology enable
computers to observe, identify and understand the world- without the limitations
of human-entered data.”
Obviously given that information presently, is humorous. We have technology that
communicates easily to other devices and effectively stores data with humans needed to enter
that data. This was a revolutionary idea that benefited and resulted to today’s modern
technology. The following technologies, although overlooked, are what IoT strived for and
became foundations for communications for data to be shared.
Software are one of the many programs available on the internet. The term software is a
general term, it is for various kinds of programs used to operate computers and related devices.
There are two types of software, systems software and application software. This is relevant
because users use and encounter both system and application software. Users can be exposed to
security holes in software unknowingly.
System software are programs that are exclusively dedicated to controlling the computer
itself. Examples of this are file management utilities, operating system, and disk operating
system (DOS). Two types of system software that are a requirement for a device are operating
system, and utility software. An operating system is a software program that enables the
computer hardware to communicate and operate with the computer software. This allows the
computer to function; without a computer operating system, the computer and software programs
would be useless. Examples of operating systems (OS) are commonly Microsoft Windows,
Apple macOS, and many Linux based systems. Utility software is a computer system software
intended to analyze, configure, monitor, and help maintain a computer. The size of a utility is
smaller than a standard program size, and usually includes an operating system. There are
numerous utility software available for the computer, some are antivirus programs, disk tools,
and backup software.
System software are designed to provide a platform for other software. System software
is a type of computer program that is designed to run a computer’s hardware and application
programs. This software is the interface between the hardware and user applications. As stated
prior, there are two main types of system software, the operating system and the utility software.
Utility software is intended to help maintain a computer. It is typically small, and provides
additional capabilities provided by the operating system. Some of utility software given were
antivirus programs, disk tools, and backup software. Some of these programs and nonessential
part of the operating system. An example of this is the print feature that comes with the operating
system. While utility has usages like this, it can also be an application.
A utility software is an application that is limited in capability but very specialized. An
example of this is the search and replace utility. Some operating systems provide a limited
capability to do a search and replace for given character strings, usually the application is
available but up to user if it will be used. Keep in mind the utility program, and utility software
are programs that are designed for certain tasks that overall help the device perform better. It
should not be confused with application software, which is similar but is not considered a system
software. Utility programs are mostly all free and are available on the internet. They are
available with the operating system as a package while some it up to user preference so it is up to
the user to find it.
System software, such as the utility programs, allow users to directly interact with it.
While other system software, such as the operating system (OS) runs in the background keeping
the device functional. Some system software are capable of allowing users to interact directly
with the hardware functionality. Examples of this can be illustrated with the utility programs like
control panel or the device manager. The control panel is used to configure and manage
practically all aspects of Windows such as keyboard/ mouse functionality, power options,
network settings, users and passwords, desktop background, and many more options. While the
device manager is a control panel that is tailored for hardware, it allows users to view and control
the hardware attached to the computer. The list of hardware can be sorted by various criteria.
Another form of software that does not fall under system software, but is a form of
software is application software. Application software is a program or group of programs
designed for end users. System software consist of low level programs that communicate with
the computer at a basic level. While application software resides above system software. Most
application software are database programs, word processors and spreadsheets. Application
software can be published alone as a single application or usually it will be grouped along with
system software. Examples of application software are Microsoft Office which included all of
the above, Adobe Photoshop which allows users to edit pictures, Chrome, Explorer, Firefox that
allow you to browse the internet, and Outlook which allow users to check their email.
Cloud data can be a blessing and an extremely great resource for users to store any
amounts of data for little to no cost. It allows users to save money by not having to purchase hard
drives or flash drives. This is a great resource that is readily available, however, it also poses a
great risk. Users may store sensitive information on the cloud or information that they do not
want to be shared. Hackers see this is a gold mine of information for them to steal. In 2016,
Apple, one of the biggest companies that allows users to store their data on the cloud was
breached. This was a result of a vulnerability in Apple’s password security system. It allowed
hackers to be able to guess passwords and security questions of users and gain access to their
cloud and all the information they stored on the cloud (Rubenking).
Businesses that offer cloud software take different measures to ensure that their users
data and information and secure and cannot be compromised. The businesses will encrypt the
data that is being stores with many different complex encryption methods. However, this does
not make it totally secure. The security on a cloud is typically more secure than on an average
user’s computer, however, the cloud can still be hacked. Weak passwords can be unsecure and
can be easily guessed by hackers. Users will also use the same password that they use on
different platforms. The other platform can be hacked, and they can give access to your data by
using that same password. Users should not use passwords that are related to their personal life.
A password should not contain your name, birthday, or anything related to that matter. This can
make is easy for hackers to guess your password. Users can also seek out their own encryption
options to encrypt their files and make them more secure. They can have access to encryption
options that the cloud companies do not use and this can make it harder for hackers to be able to
decrypt your password (Ko).
To prevent your information from being stolen it is best to encrypt your data on your
personal computer. A good option when browsing the web is to use a Virtual Private Network
also known as VPN. The purpose of a Virtual Private Network is to encrypt your traffic as you
browse the web. Your traffic will not be encrypted between the VPN server and the website
unless you are connected to a HTTPS website. This is a good option for security, however, your
files will not become encrypted and you can still be tracked while using a VPN. When a file
become encrypted a back door is typically created. The back door is created as a way for the
company to get past the encryption if they need to. Hackers can gain access to the back door and
will be able to bypass the encryption. In 2016, the FBI requested a back door to gain access to an
iPhone from apple, however, Apple refused to give them access to it. This is because apple does
not create back doors for their encryption and they refused to create one for the FBI. Apple did
not create a back door, because they do not want to give hackers a chance to be able to get past
their encryption and Apple felt it would get leaked sooner or later. Once Apple had the
cryptographic servers running they will physically destroy the keys that would permit
modification and allow access. Hackers can not use them to get in this way, however, Apple will
not be able to modify them either.
As technology keeps moving forward, cars today become more and more reliant on
technology. We are in an age where cars can drive on their own and this is all due to technology.
However, just like anything else in the technology world cars can be vulnerable to being
hacked. Hacking into a car’s system is inefficient for hackers as it is a low-reward and high-risk
and effort. Cars can have built in Wi-Fi and Bluetooth systems. This is what typically will be
hacked as hackers will want to steal your data and will most likely go unnoticed. However there
are other ways that a car can be hacked. The on-board diagnostics or OBD-II port of a car is
connected to the car’s controller area network bus. The more advanced that the car is the more
systems that will be connected to the controller area network bus. On most modern cars the
OBD-II port will control the steering, braking, engine, fuel management, advanced safety, drive
assistance systems, door locks, and window controls. Exploiting the OBD-II port can be a
difficult task. Specific software for the make, model, and year of the car will be required to do
this exploit. It is not very rewarding for hackers to take control of the car unless they are
planning on stealing it. They will also do this is they want to take control of the car to hurt the
driver or other people (Vincent).
Another way that cars can be hacked are through smart keys. Many modern cars will
come with a keypad that is used to lock and unlock the doors, or to start the car. The keypad will
send a specific signal to the car for it to be able to perform the action. There are technologies that
can capture signals that are sent to the car and can copy that signal. Hackers can also use brute
force to break into the car without having to physically break the window to gain access. They
can also use signal amplifiers to be able to access the signal from far away distances without the
owner knowing. Bluetooth systems are a standard in modern cars. Bluetooth systems can provide
a direct pathway to the car’s controller area network bus and can allow hackers to inject
malicious signals into different systems in the car. If the car has a tire pressure monitoring
system it is at risk of vulnerabilities. The sensors for the tire pressure monitoring system are
often set up to speak to other systems in the car, including: the anti-lock brake system, and
dashboard displays. Malicious files or data can be downloaded onto your smart phone without
you even knowing. If the phone contains the malicious file or data and plugged into a USB, or
aux port the malicious code can download into the car’s systems and can cause many problems.
Car manufacturers can provide apps that can be used to communicate with your car. It is similar
to the keypad where you can start your car, and unlock and lock the doors with the app.
However, if the app gets hacked the hackers will be able to do these functions. Ransomware is
not only happening on personal computers it is happening in modern cars as well. A pop up will
appear on your cars information screen stating that the car will not start again until money wire
to a specific place (Vincent).
Wi-Fi can be a great way to provide internet access to many users, however, Wi-Fi can be
seen as extremely vulnerable even when it is secured with a password. According to researchers
at the KU Leuven University in Belgium, the WPA2 protocol that is used to protect Wi-Fi
networks has weaknesses and vulnerabilities. Hackers are able to exploit the weaknesses and
vulnerabilities to inject and manipulate data. This can be used to steal sensitive information such
as passwords and credit cards. Many different operating systems are at risk, including: Android,
Apple, Linux, Windows, OpenBSD, and Linksys. In 2017, The United States Computer
Emergency Readiness Team issued a statement regarding exploiting vulnerabilities including
decryption, packet relay, TCP connection hijacking, and HTTP content injection. The
vulnerabilities are in the protocol itself and not in a specific device or software. Websites that do
not indicate their support for HTTPS should be considered unsecure and all of the information
that will be sent will be public. Users that use Wi-Fi from their routers should be aware that even
though it is password secured it is still vulnerable. Home internet connections will not be secure
any time soon. Wireless routers are rarely updated for security measures. The attacks are
considered complex and does not seem likely that any major attacks will happen exploiting these
vulnerabilities, however, the possibility is still out there and any sensitive information should not
be sent over Wi-Fi (Hern).
One attack that hackers are using is called KRACKs, also known as key reinstallation
attacks. The weakness is in the Wi-Fi protocol itself and not in any individual products or
implementations, therefore, hackers are able to use this method on most modern Wi-Fi systems.
This attack will allow the hacker to decrypt all of the data the victim will send. This attack is
especially devastating against Linux and devices running Android 6.0 and higher. This is due to
the fact that Android and Linux are able to be tricked into reinstalling an all-zero encryption key
instead of the real encryption key. Linux and Android devices commonly use version 2.4 and
above of wpa_supplicant, version 2.4 and up will clear the encryption key from memory once it
is created for the first time which allows the hacker to install an all-zero encryption key. When
the client receives retransmitted message 3 out of 4 of the handshake it will attempt to reinstall
an encryption key, which will be the hacker’s all-zero encryption key. When the all-zero
encryption key is installed associated parameters such as the incremental transmit packet and
receive packet are reset to their initial values allowing the hacker to manipulate the packets.
When this happens the encryption protocol will attempt to reuse keystream when encrypting the
packets. This will cause the keystream to become known and will allow the packets to be able to
be modified. The ability to decrypt the packets can be used to decrypt TCP SYN packets, this
allows the hackers to obtain the TCP sequence and hijack TCP connections. Hackers can use this
to do a common attack against Wi-Fi networks, they will inject data into the HTTP connection
(Vanhoef).
Databases can store personal information which can be a major target to hackers. A
database engine is responsible to accept SQL queries requests and execute those requests. The
requests will provide data back to the database and the querying computer. Databases listen to
queries on one or more TCPIP ports. Databases also work with the operating system to gain
better control on the disk and memory resources. Most modern databases provide additional
services such as web services, and data encryption. The database can use authentication and
access controls provided which can be important for security purposes, however, most users will
only use the controls provided by the database engine itself. One important aspect about
databases that users who use large databases need to consider is database performance. If a large
database does not have good performance and is not optimized well it can cause many problems.
Poor database performance can cause data to not be able to be accessed and if there is a website
that is dependent on that data it will not be able to function. Securing the database poorly or
having too much security can cause database performance issues as well (Smith).
Databases are a widely and continuously accessible component which makes it more
vulnerable to attacks. Database security requires careful design and requires modifications to all
network layers. There are many different ways that hackers will try to gain access to databases to
steal any information that the databases contain. Hackers will try to gain access to the database
by attempting to guess the username and password to the web server. Application configuration
files typically contain the default username and password to the web server. It is more common
than not that administrators do not change the default username or password to the web server.
As soon as the web server is bought the default username and password should be changed and
deleted from the configuration files. Packet sniffing is also a viable option for hackers to gain
access into the web server. Hackers will use a packet sniffer to capture packets going to and from
the database. The packets can be analyzed to be able to decipher the username and password to
log in to the web server. However, if the traffic is encrypted it will be more difficult use a packet
sniffer. When a web server gets a request it receives it in the form of a web url which will
contain a query string parameter which will direct the web application to the database to fetch the
requested data. If the developers are not fully aware of this method of attacking a database it can
cause many loopholes to open up for hackers to take advantage of (Smith).
The most common form of database attacks is SQL Injection. This attack in not just a
database attack but it is a combination of database and web vulnerability. It is done by creating
webpages which contain parts of SQL query statements which is filled up with relevant
information. If the database is not secure and not capable of handing the request it will send the
fake request to the database. The attacker can run a query to dump the entire database onto their
computer using this method. Another popular form of database attack that hacker’s use is
privilege evaluation. They will inject scripts which find out different levels of privileges and will
find one that they can access. Vulnerabilities by inefficient code in the database is a problem for
many database systems. Hacker’s will also do a Denial of Service attacks on databases. The
hacker will plant code on either the web server itself or the database which will send requests to
the database in an attempt to overwhelm the database causing in to not be able to function. The
queries will either be at the application layer or TCP layer and it will layer and dump database
contents in a loop, or a SYN packet storm. The database will stop accepting queries (Smith).
Database defense is very important for any business to have. Database servers are the
most important component of the whole database systems and must be secure on multiple levels
to ensure security. Patching is a first level defense of databases. A complex patching system
must be attached to the servers to make the database more secure. It is a good practice to disable
unwanted and unused database services. This is to prevent any vulnerabilities that those services
may contain. It may be harder to locate where the vulnerability is if an unused service is being
exploited. Any data that is being stored on the database should be encrypted by SSL or TLS
encryption. These encryption methods will help to prevent packet sniffing of data requested by
the database and the server. A database firewall should be present and should put restrictions to
only allow the database port to be accessible by a certain set of IP addresses. Businesses who
store massive amounts of data should have honeypots. A honeypot’s purpose is to deploy a fake
database server when the real one is being invaded. This will lure the hacker away from the real
database and direct them to a fake one.
In the grand scheme of the internet there are many forms of security risk or forms of
attacks. In cyber security, it is best to familiarize yourself with attacks in order to identify them
when it occurs. The forms of attacks or rather security risk are DDoS, Botnet, Malware, spyware,
and keylogging. They are the predators in a sense, when it comes to the internet. (IoT) Internet of
insecure things is focused on the risks of having more devices connected to the internet.
The first form of attack is DDoS. DDoS stands for distributed denial of service. It is a
subclass of denial of service (DoS). A distributed denial of service is an attack that involves
multiple botnets to overwhelm a target. Unlike the other kind of cyberattacks, distributed denial
of service, it does not attempt to breach your security perimeter. The focus of this form of attack
is to overwhelm the target. The target can be, and is not limited to a website and servers.
Distributed denial of service achieve this by sending large amounts of fake data to the website
until it because unavailable. This form of attack is highly noticeable for it impacts the entire
online user base. It is due to this, this form of attack has become popular for hacktivists to make
a point; or in some cases, become a champion. DDoS attacks can last days, months or even
years. For an online organization it can be destructing for business.
There are multiple attacks types that DDoS can use to target sites. However since DDos
is a sub category in DoS. DoS is Denial of service, a DoS attack is a single perpetrator using a
single connection to exploit a software vulnerability or flood a target with fake request. They
attempt to flood the target with fake request in order to exhaust server resources. Examples of
these resources are RAM and CPU. The main difference between DoS and DDoS is the amount
of users. DDoS will use multiple devices that are infected with malware to get to a target, while
DoS is a single users looking for exploits.
There are two general categories of attacks the DDoS are divided in. The application
layer attacks, and the network layer attacks. Since DDoS is a sub category to DoS, DoS is
capable of doing the same attacks. The application layer attacks can either be DoS or DDoS
threats that overload a server by sending request requiring handling and processing. This
category of attack can include HTTP floods slow attacks, such as Slowloris, RUDY, and DNS
query flood attacks. The application layer attacks is a layer seven attack. The application layer
attacks are measured in requests per second (RPS). The standard requirement to cripple most
medium sized websites is fifty to hundred request per second.
The other general category of attack is network layer attacks. This form of attack is
usually always used by DDoS. Network layer attacks are set up to clog the pipes connecting your
network. Any attacks in this category include UDP flood, SYN flood, NTP amplification and
DNS amplification attacks. These attacks can be used to prevent access to your servers and can
cause other severe operational damages. Almost all DDoS attacks will consist of high traffic
events. The network layer attacks is a layer three through four attack.
The next threat is botnets. In the previous form of attacks, the distributed denial of
service attack used botnets to flood websites and servers. Botnets is a network of private
computers infected and controlled as a group. Botnets are a collection of internet connected
devices, this includes personal computers, servers, smartphones, and any internet connected
device. Each of these devices must be infected and controlled by a type of malware. In most
cases, users are unaware of the botnet infecting their system. The infected devices are then
controlled remotely and are used for specific actions. This is done so the end user will not
become aware of the botnet. Botnets are used to send email spam, generate malicious traffic for
DDoS attacks and click fraud campaigns.
The word botnets derive from the word robot and network. The robot in this case is the
device that is infected by the malware. This “robot” then joins a network of infected devices
controlled by a single attacker or a group. This form of malware searches for vulnerable devices
through the internet. It does not target specific devices, individuals or companies. The objective
for botnets is to infect multiple devices, the more the merrier. It will not waste time attempting to
retrieve one device when it could easily spend that time infecting as many devices as possible.
What follows after this is it will use the computing power and resources of those devices for
automated tasks that will not get noticed by the end user.
The botnet malware does have an architecture to it. The botnet infection is usually spread
through malware. It is designed to automatically scan systems and devices for common
vulnerabilities. It aims to infect as many devices as possible. Botnet will also scan for ineffective
or outdated security products, examples of this are firewalls and antivirus software. There are
two ways the attackers can control the bots. The traditional way which is the client/server
approach and the peer-to-peer network approach. The attackers typically control the bots after
the achieved number of devices are controlled.
The traditional client/server approach involves the command-and-control server. This is
done through a communications protocol, IRC or internet relay chat can be used as an example.
The bots then get controlled or they await commands from the command-and-control server
before initiating any malicious actions.
The other approach is peer-to-peer network. The main difference is the bots will not use
command-and-control server. Instead they would use a peer-to-peer botnet decentralized
approach. Some of the bots would be programmed to scan for malicious websites or for other
devices in the botnet. The botnets would then share updated commands or even the latest
versions of the botnet malware. This approach is most used today since C&C communications
are often now monitored for any botnet operations.
Malware is everywhere on the internet. Malware is a software that is intended to damage
or disable a computer or computer systems. Malware is any program or file that is potentially
harmful to a computer user. This includes computer viruses, worms, Trojan horses and spyware.
Often malware can perform various functions including but not limited to stealing, encrypting,
altering and hijacking core computing functions. There are many different types of malware that
contain unique characteristics. The ones mentioned previously each have their own trait and
characteristics.
A virus is the most common type of malware. It is a virus that infects the computer with a
malicious code that replicates by copying itself to another program. It can change itself to a
computer boot sector or document and change how the computer works. The virus requires
someone to spread the infection without permission of the end user or the systems administrator.
There are many ways a virus can spread, it can be sent as an email attachment, clicking on an
executable file, visiting an infected website or by viewing an infected website advertisement.
Another way viruses can be spread is through USB drives or infected removable storage devices.
Once a virus infects the host, it can begin infecting other system software or resources.
Another type of malware is a worm. Worms are like viruses in terms of infecting other
devices. A computer worm is a type of malicious software program that infects other computers
while remaining active on infected systems. A worm can self-replicate, it will duplicate itself to
spread to uninfected computers. Worms use parts of an operating system that are automatics and
not visible to users. In most cases, worms are noticed only when their replication consumes
system resources, which will slow the computer down or halt other tasks. A worm, unlike the
virus can be spread without any user interaction. The only requirement the worm needs is for it
to become active on an infected system. Worms rely on networking protocols to multiply. It does
this by searching for other networks via scanning and other networks will respond to the infected
one.
Another form of malware is spyware. Spyware is a malware that is designed to collect
information and data on users. Spyware is installed on a computer and observes activity without
the user’s knowledge. This type of malware is very controversial because it can violate the user’s
privacy. It has a high potential of being abused. Spyware can be also referred to tracking
software. This can be found in multiple places, for example workplaces can have software
installed to monitor employees browsing activities. Spyware is difficult to detect, the only way
an end user would know their computer was infected with spyware is a reduction in the
processor. To notice it in mobile devices, the data usage and battery life would take a toll. There
are different types of spyware that are ethical, one of the many is keylogging.
Similar to spyware, keylogging is a system monitor or a keystroke logger. It is a type of
surveillance technology that is used to monitor and record each keystroke typed on a specific
computers keyboard. This monitoring software is available for smartphones such as iPhones and
Android devices. Keyloggers are often used to steal personally identifiable information (PII).
They are also used to steal login credentials and sensitive data. There are ethical uses for
keylogging such as employers observing employees’ computer activities. Parents supervising
their children’s internet usage, or users trying to track unauthorized activity on their devices.
There are different types of keyloggers, a hardware-based keylogger and a keylogging
software program. A hardware-based keylogger is a small device that serves as a connector
between the computer keyboard and the computer. The device resembles an ordinary keyboard
adaptor, the USB part. Since most computers have their keyboards connected to the back of their
computer, making it easy to hide without the user’s knowledge. When the user types on the
keyboard, the keylogger collects each keystroke and then saves the data. The data gets saved as
text on its own hard drive. This hard drive can have a memory up to several gigabytes. The only
downside to this, is the individual who installed the keylogger must retrieve and remove the
device.
The other type of keylogger is a keylogging software program. A common keylogger
program typically consists of two files that get installed. These two files must be in the same
directory. The two files are a dynamic link library (DLL) file that executes the recording of the
data, the second file is the executable file. This file is what installs the DLL file and triggers it to
work. After this is done, the program then begins to record each keystroke the user types and
then uploads the information over the internet. This is done periodically and sent to whoever
installed the program. Some of the keylogging programs include a function for recording user
data besides the keystrokes. It could capture anything that has been copied to the clipboard or
take screenshots of the users screen or application.
There are ways to detecting, and preventing keylogging from a user’s computer.
However, no one method is more effective than the other. The software Anitkeylogger is a
software designed to scan for any software-based keyloggers. This is done by comparing the files
on a computer against a keylogger signature base or using a checklist of common keylogger
attributes In the case of detecting keylogging, an anitkeylogger would be more effective than
antivirus or antispyware program. Simply because an antikeylogger would have a better chance
to identify a keylogger as a legitimate program instead of spyware. Another use of detection is
application whitelisting. This will give the user a notification each time an application tried to
make a network connection. This will prevent keyloggers from infecting the user’s computer.
Following my earlier example on malware that is designed for a specific purpose,
ransomware is one of the few that fall in this category. Ransomware is a subset of malware in
which the data on a victim’s computer is locked. The malware then demands payment for the
data and returned to the user. Ransomware typically locks the user by encrypting the data, then
demanding money to decrypt it. This form of attack differs from the others because unlike other
malware, ransomware will notify the user when the attack occurred. The notification will provide
the user with instructions on how to retrieve their data back by payment. The payment often is a
virtual currency so that the cybercriminal’s identity is not known. Examples of virtual currency
are bitcoin. Another form of payment are prepaid cards/vouchers.
Ransomware can be spread through email attachments, infected software applications,
infected external storage devices and compromised websites. Ransomware does not rely on user
interaction. Attacks recently have used remote desktop protocol just to avoid using user
interaction. One attack called lock screen is a variant of the ransomware attack. The malicious
attacker would change the victim’s login credentials on their device. This is kidnapping data; the
malware can encrypt files on this device and even other connected network devices. To prevent a
ransomware attack, constantly backing up your files daily can avoid the end user losing anything
if attacked.
To conclude, there are many great resources on the internet available to users, however,
there are risks as well. Hackers will attempt to steal your data, and your information without you
being aware that it is happening. Large businesses are having all their customers’ information
stolen. This is done using many different forms of malware including: spyware, Trojans, DDoS,
botnet, ransomware, and many different forms of malware. Databases and cloud storage are a
very efficient way to store data, however, hackers see these as a goldmine of information that
they will attempt to steal.
Works Cited:
Hern, A. (2017, October 16). “All wifi networks' are vulnerable to hacking, security expert
discovers.”
Ko, E. (2018, January). “5 Safety Concerns with Cloud Data Storage, Answered.”
Rubenking, N. (2017, December). “The Best Encryption Software of 2018.”
Smith, K. (2017). “Cyber Attacks Explained: Database Hacking.”
Vanhoef, M. (2016). “Key Reinstallation Attacks Breaking WPA2 by forcing nonce reuse.”
Vincent, J. (2016, October). “5 Ways Your Car Can Get Hacked.”
https://www.incapsula.com/ddos/denial-of-service.html
https://searchsecurity.techtarget.com/definition/botnet
https://searchsecurity.techtarget.com/definition/malware
https://searchsecurity.techtarget.com/definition/spyware
https://searchsecurity.techtarget.com/definition/keylogger
https://www.cisco.com/c/dam/en_us/solutions/trends/iot/introduction_to_IoT_november.pdf