Blog/Development

Common Cyberthreats to Watch Out for in 2023

Copy Link

Praise Iwuh

June 13, 2023

Common Cyberthreats to Watch Out for in 2023

When you think of mankind’s most important inventions, what comes to mind? The wheel, electricity, or the compass? Whichever way the list goes, you certainly must include the Internet. While it might lose out to electricity for the all-time position, the internet definitely wins the place of most important invention of the last century. It's transformed life, business, the human society as a whole, creating an interconnected world and playing a central role in our daily lives.

The internet brings many benefits and improvements to human living, but unfortunately, it comes with its nemesis, which is cybercrime. Cybercrime is the scourge of the internet, and it continues to advance as our reliance on digital technology grows. Fun fact, in the time it’s taken you to read this paragraph(39 seconds), a hacker has just placed a new target on a business’s infrastructure, and going by the statistics, it just might be yours. (Over 4.1 million websites on the Internet have malware at any given time)

Today, cybercrime is being touted as a highly lucrative illegal venture, and the reaction to this is that businesses are investing more in cyber security. Cybercriminals constantly evolve their tactics to exploit vulnerabilities and compromise our online security. To protect ourselves and our sensitive information, we must be aware of the common cyber threats we may encounter, and this article delves into the most common of these threats. It is outlined as follows:

What is Cybersecurity?
What are Cyberthreats?
Common Cyberthreats
Emerging Threats to anticipate in 2023
Conclusion

What is Cybersecurity?

Cybersecurity is an intentional effort by individuals and organizations to combat cyberthreats and protect computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks.

What are Cyberthreats?

Cyber threats are potential dangers, risks or malicious actions that could result in damage to digital or software infrastructure. They involve a wide range of criminal activities and tactics used by individuals or groups to compromise or exploit computer systems, networks, and data.

Familiar terms we encounter

Malicious- This defines the intent to cause harm or damage to a software system or application.

Exploit- An exploit is a tool with which an intruder capitalises on vulnerabilities. This could be code, software, commands, or in a single word, Malware. The act of using exploits successfully is also referred to as exploitation.

Asset- These are items of value to an organisation. They may be sensitive documents, customer information, passwords, etc.

Risk- A risk is the potential damage a threat poses to the organisation's assets.

Common cyber threats

Malware

Malware, short for "malicious software", encompasses various harmful programs such as viruses, worms, and ransomware, which are designed to infiltrate computer systems and networks. Malware can infect devices through email attachments, compromised websites, or software downloads. It takes advantage of unsuspecting users, exploiting security weaknesses or enticing them into unintentional actions that compromise their devices and personal information. 5.5 billion malware attacks were detected around the world, with an estimated 300,000 threats being created daily. Common forms of Malware are:

Ransomware

Ransomware attacks by encrypting a victim’s files, making them inaccessible until a ransom is paid to the attacker. They target individuals, businesses, and critical infrastructure systems and are one of the most common forms of cybercrime. More than 7 out of every 10 businesses reported falling victim to ransomware attacks in 2022.

Virus

Viruses are programs designed to replicate themselves and spread throughout a system or network, often causing damage along the way. Viruses can corrupt or delete files, disrupt system operations, and render devices inoperable, leaving victims at the mercy of their digital assailants.

Worm

A Worm is a self-replicating program that can spread independently from one device to another, often through network connections. They overload networks, compromise sensitive data, or even transform infected devices into botnets under the control of malicious actors.

Trojan

Trojan horses, modelled and named after the deceptive wooden horse from ancient Greek mythology, masquerade as legitimate and harmless programs and trick users into willingly installing them. Once inside a device, Trojans grant unauthorised access to cybercriminals, allowing them to spy on activities, steal personal information, or gain control of the infected system.

Although 92% of Malware attacks are delivered successfully through email, they may be initiated through various means, such as malicious links within seemingly harmless websites, exploiting software vulnerabilities, or using Social engineering techniques, such as phishing, to entice users to download compromised files.

Malware attacks are costly and can be avoided by implementing robust cybersecurity measures, including firewall protection, regularly updating software and operating systems, and utilising reputable antivirus software, which can fortify digital defences against malware attacks. It is also important to be cautious while downloading files or clicking on links, verify the authenticity of sources and avoid suspicious websites or emails.

Social Engineering

Social engineering targets human psychology, capitalising on emotions, trust, and the willingness to assist others in deceiving or manipulating individuals into giving up unauthorised access to sensitive information. Such attacks are crafted to exploit the human element rather than technical vulnerabilities to evoke a sense of urgency, fear, or curiosity, coercing victims into swift and thoughtless responses that can reveal sensitive information. Social engineering attacks come in various forms, which we look at next.

Pretexting

In this threat, attackers create a fictional scenario or pretext to establish credibility and gain the trust of their victims. They may impersonate colleagues, IT personnel, or other individuals with authority or knowledge, fabricating a believable story to elicit the desired response. By exploiting the victim's trust in the fabricated persona, the attacker can extract sensitive information or persuade them to perform certain actions.

Baiting

An approach where attackers use enticing incentives or rewards to lure victims into compromising their security. They may offer free software, exclusive access to desirable content, or even physical items to entice victims to click on malicious links or download infected files.

Malvertising

This involves online advertising controlled by hackers, which contains malicious code that infects a user’s computer when they click or view the ad. Malvertising has been found in many leading online publications.

Scareware

a threat actor tricks the victim into thinking they inadvertently downloaded illegal content or that their computer is infected with malware. Next, the threat actor offers the victim a solution to fix the fake problem, tricking the victim into downloading and installing malware.

Scareware security software

pretends to scan for malware and then regularly shows the user fake warnings and detections. Attackers may ask the user to pay to remove the fake threats from their computer or to register the software. Users who comply transfer their financial details to an attacker.

Phishing

Phishing is reported to be the most common form of cybercrime, with an estimated 3.4 billion spam emails sent daily. This cyber threat wrecks so much havoc that it deserves an article of its own. Its modus operandi involves tricking individuals into divulging sensitive information such as passwords, credit card details, and other personal data.

The criminals behind this often pose as trustworthy entities, such as banks, government agencies, or popular websites, and replicate credible emails, phone calls, or text messages to deceive their targets. To protect yourself, be cautious of unsolicited communications and avoid clicking on suspicious links or providing personal information unless you know the source's authenticity. Phishing attacks primarily come in three forms:

Emails- The most common method involves sending fraudulent emails that appear genuine, complete with logos, formatting, and language mimicking legitimate communication. These emails urge the recipient to click on a seemingly innocuous link, redirecting them to a counterfeit website designed to trick them into entering their login credentials or other sensitive data.

Social media- Attacks also come through social media platforms in the form of messages from compromised or fake accounts, purporting to be a friend, colleague, or trusted contact. These messages can be urgent requests for assistance, enticing offers or other alarming notifications that spur the recipient into an action that compromises them.

Counterfeit Logins- Phishing attacks can also exploit vulnerabilities in popular websites or online platforms. Cybercriminals skillfully create counterfeit login pages or forms that closely resemble legitimate ones, tricking users into entering their credentials, which the attackers then capture. These fraudulent websites may even use tactics like URL manipulation or domain spoofing to deceive the victims further.

To protect oneself, it is crucial to exercise caution when clicking on links or downloading attachments from unfamiliar sources, even if they appear legitimate. Verifying the authenticity of emails, messages, or websites through independent means, such as directly contacting the purported sender, can help uncover potential phishing attempts. Robust security measures, such as using multi-factor authentication, regularly updating passwords, and keeping software and antivirus programs up to date, can also significantly improve defences against phishing attacks.

Software supply chain attacks

Software supply chain attacks take advantage of the trust placed in the software development process, aiming to infiltrate legitimate code repositories or introduce malicious components into the software supply chain. By compromising trusted sources or injecting malware into the software build process, attackers can subvert the integrity of the software and distribute adulterated versions to unsuspecting users. Some primary forms of software supply chain attacks are:

Compromising Trusted software

One method used in software supply chain attacks is compromising a trusted software vendor or repository. Attackers infiltrate the vendor's infrastructure, often through social engineering or exploiting vulnerabilities, to gain unauthorised access. Once inside, they manipulate the software code or introduce malicious components, which are then unwittingly distributed to users as part of legitimate software updates or installations.

Exploiting Third-party dependencies

Many software projects rely on external libraries, frameworks, or plugins to enhance functionality or accelerate development. Attackers identify vulnerabilities in these dependencies and introduce malicious code into their repositories. When developers incorporate these compromised components into their software, they inadvertently introduce the attacker's malware into their codebase.

Using Malicious code

Software supply chain attacks can also target the build and distribution processes themselves. Attackers compromise build systems, build scripts, or distribution channels to inject malicious code or modify legitimate software packages. This allows them to distribute tampered versions of the software, which, when installed by users, give the attacker unauthorised access or introduce malicious activities on the target systems.

Software vendors and developers should follow secure development practices, including verifying code integrity and using secure repositories for distributing software components. Regular security audits, vulnerability scanning, and adherence to industry best practices can help identify and address weaknesses within the software supply chain. Also, regularly monitoring and updating these components, utilising official sources and trusted repositories, and validating their authenticity and integrity can minimise the risk of incorporating compromised code into software projects. End-users also protect themselves by ensuring that software installations and updates come from official sources, verifying the authenticity of digital signatures, and being cautious when prompted to download or install software from unfamiliar or untrusted locations.

Denial-of-Service (DoS) Attacks:

Denial-of-Service (DoS) attacks aim to disrupt the availability of a service or website by overwhelming it with a flood of illegitimate traffic. These attacks can result in significant downtime, financial losses, and damage to a company's reputation. It aims to exhaust the resources of a target system, rendering it incapable of handling legitimate user requests. These attacks can take various forms, each with the common objective of overwhelming the target's capacity to respond effectively.

Botnet

The attackers may employ a single machine or coordinate a botnet—a network of compromised devices—to flood the target with an excessive traffic volume, rendering it unable to distinguish between genuine and malicious requests.

Flood attack

Attackers can attack with an overwhelming volume of traffic. This flood can consist of massive amounts of data packets, network requests, or even requests for computationally intensive operations. The target becomes inundated and struggles to keep up with the sheer magnitude of incoming traffic, eventually becoming overloaded and unable to function properly.

Distributed Denial-of-Service (DDoS)

This attack amplifies the impact by coordinating multiple compromised devices to launch simultaneous attacks on the target. These devices, often unknowingly controlled by the attackers, act as a collective force, flooding the target from various sources and angles. The distributed nature of DDoS attacks makes them even more challenging to mitigate, as the traffic appears to come from diverse locations, making it difficult to filter out malicious requests.

Mitigating Denial-of-Service attacks requires robust network infrastructure capable of handling high volumes of traffic and implementing mechanisms to identify and filter out malicious requests. Intrusion detection and prevention systems can help detect and block suspicious traffic patterns, reducing the impact of these attacks.

Man-in-the-Middle (MitM)

MITM works like an invisible eavesdropper positioned between two individuals engaged in conversation. The attacker silently inserts themselves into the communication path, intercepting and potentially altering the data exchanged without the knowledge or consent of the communicating parties. The attacker may accomplish this by compromising network infrastructure, exploiting insecure protocols, or employing deceptive tactics to fool the communicating parties into connecting to a malicious entity masquerading as a trusted intermediary. 35% of exploitation activity involves MITM attacks, and they come in various approaches.

Eavesdropping

One common scenario involves attackers intercepting unencrypted communication channels. By placing themselves between the sender and the intended recipient, they can capture sensitive information, such as passwords, credit card details, or personal messages, as it traverses the network. The MitM attacker can then use this intercepted information for malicious purposes, such as identity theft, financial fraud, or unauthorised access to accounts.

Hijacking

Another variant of MitM attacks targets encrypted communication channels. In these cases, the attacker decrypts and re-encrypts the data using their own encryption keys, effectively masquerading as both the sender and the recipient. This allows them to intercept and manipulate the data while maintaining the appearance of a secure communication channel. By exploiting vulnerabilities in encryption protocols or compromising digital certificates, the attacker can deceive the communicating parties into unknowingly divulging sensitive information or executing malicious actions.

Spoofing

where they redirect the communication traffic to their own malicious server, or session hijacking, where they hijack an established session between the communicating parties to gain unauthorised access or manipulate the data in transit.

Protecting against MitM attacks involves employing encryption technologies, such as Transport Layer Security (TLS) or Secure Sockets Layer (SSL), which is crucial for securing communication channels and preventing unauthorised interception and manipulation. Verifying the authenticity of communication endpoints, such as websites, email servers, or voice services, also helps. Users should be cautious when accessing sensitive information or performing transactions online, ensuring the presence of valid digital certificates and looking for indicators of secure connections, such as the lock icon in web browsers.

Emerging Threats to Anticipate in 2023

It is important to state that cyber security threats evolve with every technological advancement. Some new threats emerging in 2023 include:

Artificial Intelligence Use

In a recent article, we discussed the role of AI in application security. However, because what's good for goose is also appealing to the gander, cybercriminals will be looking to leverage AI for their shady activities. This means we can anticipate bots that behave like humans, which can aid pretexting, MITM, and other traditional attacks.

Internet-of-Thing hacking

IoT is a glimpse into the future, the next level of a truly interconnected society. However, while we envision the bliss of having all our devices smart, GPS-fitted and connected, we must prepare for the possibility of those devices being infiltrated or compromised by attackers. Imagine having hackers hijack your smart car or eavesdropping on conversations through your smartwatch or devices. Not a very appealing thought, is it?

Comprised Cloud Servers

Today, most business operations and data have been or are being migrated to cloud servers. This makes cloud security a major concern, as threat actors can gain authorised access to the data of thousands, if not millions, of companies or individuals, by targeting their cloud service providers. Again a scary thought.

Conclusion

Understanding the common cyber threats is crucial for protecting ourselves and our valuable information. By staying informed about phishing attacks, malware, ransomware, social engineering tactics, identity theft, and DoS attacks, we can adopt proactive measures to safeguard our online security. Remember to prioritise strong passwords, use reliable security software, exercise caution when sharing personal information, and stay vigilant against suspicious activities. By taking these precautions, we can minimise the risks.

Common Cyberthreats to Watch Out for in 2023

Share: