Common Online Threats

Cyber Security: Botnets

Botnets are created using malware that give an attacker control over a group of computers and commonly use them to gather information from the computers (e.g., usernames and passwords), launch attacks against others. These attacks might be sending spam emails, or flooding a website with so many requests for content that the server cannot cope, which is known as a denial-of-service attack.
     
A single piece of malware can cause enormous damage, but when thousands, or even millions of computers run the same program, their effects can be devastating. So a botnet is a group of computers that coordinate their activity over the internet. There are a number of harmless botnets used for such purposes as the Internet Relay Chat (IRC) text messaging program, but the vast majority are created by malware.

Botnets spread through viruses and worms and once installed on the victim’s computer they use the internet to make contact with a control computer. At this point, the infected computer (often called a zombie) will do nothing more except periodically check for instructions from the control computer. Over time, more and more computers are recruited to the incipient botnet until it may contain tens of thousands of zombies, but they don’t raise suspicion as they appear to be doing nothing.
     

At some point in the future, the control computer will issue a command for the botnet to wake up and begin doing something. Often the people who created the botnet itself have either sold or rented the botnet to another group who want to use its capabilities.

Botnets have been used to flood the internet with spam messages, to commit fraud against advertisers and to perform so-called distributed denial of service attacks on companies and governments. Botnets are so large, and so widely distributed across the internet that they can be very hard to tackle and the effects of a coordinated attack on critical parts of the network can mean even very large websites struggle to remain online while the botnet targets their computers.

Cyber Security: Other Forms of Attack

‘Adware’, that forces users to view advertising, and ‘Spyware’, malware that attempts to access personal information and user passwords.

Autorun worms take advantage of the Windows AutoRun feature. They execute automatically when the device on which they are stored is plugged into a computer. Autorun worms are commonly distributed on USB drives, automatically infecting computers as soon as the USB is plugged in. AutoPlay is a similar technology to AutoRun.

“Rabbit” programs
These are programs for mainframe computers. If no jobs are waiting, these programs add a copy of themselves to the end of the queue.

Rootkit- While it might be easy to detect a background process by opening the task manager, the Rootkit tends to hide those processes in such a way that we dnt even get to know that such a process is already running.

Buffer Overflow attack - attacker sends excess data to a program , causing it to overwrite parts of the computer's memory that the operating system was using , thus providing opportunity for unauthorised/malicious code to execute itself or crash the system

The Botnet - A group of many computers that have been infected and now act together as part of a command and controlled server. The group of computers or botnet, can be used to spam emails, or assist in Distributed Denial of Service attacks. This is where you send many requests to a particular web site to try and stop the site from actually getting legitimate business traffic on the internet.

Zombie: A zombie system is one that is compromised, and that can be remotely prompted to do the bidding of its master (rather than its owner). This could mean scouring the internet for other vulnerable systems to contaminate and add to the collective/horde, known as a botnet. Botnet time can be sold like a mercenary service on the black-market: mass spamming, adware/fake products aimed at owners of zombie systems, the ever popular DDoS attacks that you only see widely reported when a mega popular service is downed. I'm sure there are some properly nasty organised criminal types with a finger in this pie these days.

Boot sector malware: when the computer is first switched on, the boot sector program initialises and loads the rest of the operating system into memory. The malware replaces the original boot sector program and loads its modified version when the computer is switched on, probably to ensure that the malware is easily viable

A 'drive by download' is when software (malware) is automatically downloaded without the user being aware of initiating the download. This can happen when you visit a site (including legitimate sites) that have been attacked and compromised; the malware exploits vulnerabilities in the browser (or plugins).

Malware - INTRODUCTION TO CYBER SECURITY THE OPEN UNIVERSITY

Malware
Finally, there are a number of terms associated with software that attempts to harm computers in different ways. Collectively these are known as ‘malware’ (a contraction of malicious software).

Depending on what the malware does, different terms are used to in relation to malware. For example:

• ransomware is malware that demands payment in order to refrain from doing some harmful action or to undo the effects of the harmful action
• spyware records the activities of the user, such as the passwords they type into the computer, and transmits this information to the person who wrote the malware
• botnets are created using malware that allows an attacker to control a group of computers and use them to gather personal information or launch attacks against others, such as for sending spam emails or flooding a website with so many requests for content that the server cannot cope, called a denial-of-service attack.

Threatsaurus

There are lots of technical terms relating to cyber security and it can be difficult to keep track of what’s what.

Sophos is one of the major players in the anti-malware business. They publish a Threatsaurus to help you remember and define the terms relating to malware. The Threatsauras is a plain-English guide, to help IT managers and end users understand the threats posed by malicious software. The Threatsaurus, includes:

• an A–Z glossary on computer and data security threats
• practical tips to stay safe from email scams, identity theft, malware and other threats
• a guide to Sophos’s security software and hardware.
• Download the Sophos Threatsaurus PDF here or from the Sophos website.

Malware - INTRODUCTION TO CYBER SECURITY THE OPEN UNIVERSITY

Malware
Finally, there are a number of terms associated with software that attempts to harm computers in different ways. Collectively these are known as ‘malware’ (a contraction of malicious software).

Depending on what the malware does, different terms are used to in relation to malware. For example:

• ransomware is malware that demands payment in order to refrain from doing some harmful action or to undo the effects of the harmful action
• spyware records the activities of the user, such as the passwords they type into the computer, and transmits this information to the person who wrote the malware
• botnets are created using malware that allows an attacker to control a group of computers and use them to gather personal information or launch attacks against others, such as for sending spam emails or flooding a website with so many requests for content that the server cannot cope, called a denial-of-service attack.

Threatsaurus

There are lots of technical terms relating to cyber security and it can be difficult to keep track of what’s what.

Sophos is one of the major players in the anti-malware business. They publish a Threatsaurus to help you remember and define the terms relating to malware. The Threatsauras is a plain-English guide, to help IT managers and end users understand the threats posed by malicious software. The Threatsaurus, includes:

• an A–Z glossary on computer and data security threats
• practical tips to stay safe from email scams, identity theft, malware and other threats
• a guide to Sophos’s security software and hardware.
• Download the Sophos Threatsaurus PDF here or from the Sophos website.

Malware - INTRODUCTION TO CYBER SECURITY THE OPEN UNIVERSITY

Malware
Finally, there are a number of terms associated with software that attempts to harm computers in different ways. Collectively these are known as ‘malware’ (a contraction of malicious software).

Depending on what the malware does, different terms are used to in relation to malware. For example:

• ransomware is malware that demands payment in order to refrain from doing some harmful action or to undo the effects of the harmful action
• spyware records the activities of the user, such as the passwords they type into the computer, and transmits this information to the person who wrote the malware
• botnets are created using malware that allows an attacker to control a group of computers and use them to gather personal information or launch attacks against others, such as for sending spam emails or flooding a website with so many requests for content that the server cannot cope, called a denial-of-service attack.

 

Threatsaurus

There are lots of technical terms relating to cyber security and it can be difficult to keep track of what’s what.

Sophos is one of the major players in the anti-malware business. They publish a Threatsaurus to help you remember and define the terms relating to malware. The Threatsauras is a plain-English guide, to help IT managers and end users understand the threats posed by malicious software. The Threatsaurus, includes:

• an A–Z glossary on computer and data security threats
• practical tips to stay safe from email scams, identity theft, malware and other threats
• a guide to Sophos’s security software and hardware.
• Download the Sophos Threatsaurus PDF here or from the Sophos website.