- Related Topics:
- computer
- Internet
- ransomware
- malware
- denial of service attack
cyberattack
News •
-
What is a cyberattack?
A cyberattack is a deliberate attempt to gain unauthorized access to a digital system, such as computers, smartphones, or other Internet-connected devices. Cyberattacks can be untargeted, affecting as many devices as possible, or targeted, tailored to a specific individual or organization.
Cybercriminals often aim to steal money, personal information, or intellectual property, but they may also disrupt or cripple the targeted system. Cyberattacks can lead to identity theft, privacy invasion, and fraud, with damages often costing $500,000 or more.
To prevent cyberattacks, individuals and organizations should keep software up to date, avoid unknown links, and use strong passwords.
3 Britannica SourcesCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles. -
How do cyberattacks affect computers and networks?
Cyberattacks can significantly disrupt computer and network functionality. A common method is the denial-of-service (DoS) attack, which overwhelms the target system with excessive traffic, preventing legitimate users from accessing services. Distributed denial-of-service (DDoS) attacks amplify this by using botnets—networks of malware-infected devices—to flood the target with traffic from multiple sources.
Ransomware, another form of cyberattack, encrypts a system's files, blocking access until a ransom is paid, typically in cryptocurrency. Computer viruses replicate and attach to other programs, spreading through networks and storage devices, potentially destroying data or causing systems to crash. These attacks exploit vulnerabilities in software, highlighting the need for robust security measures and regular software updates.
5 Britannica SourcesCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles. -
What are some common types of cyberattacks?
Cyberattacks are either untargeted, affecting many devices, or targeted, aimed at a specific entity. Common types include:
- Phishing Cyberattackers impersonate trusted sources via email to steal data or install malware.
- Ransomware Malware blocks access to data until a ransom is paid, usually via cryptocurrency.
- Denial-of-service (DoS) attacks Overwhelm a target with traffic to prevent legitimate use. Distributed denial-of-service (DDoS) attacks use botnets, networks of malware-infected devices, to amplify the attack.
- Man-in-the-middle (MitM) attacks Intercept communications, often on unsecured networks. Session hijacking, a type of MitM attack, occurs when attackers match their IP address to a legitimate user's, gaining the same access level.
4 Britannica SourcesCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles. -
How do hackers use malware in cyberattacks?
Cyberattacks often involve malware to infiltrate systems by targeting software vulnerabilities. Malware, a term for malicious software, can be delivered through dangerous links or emails, hiding within seemingly harmless applications.
Attackers probe systems for weaknesses, using social engineering like phishing to gather information. Once inside, they establish a digital presence, disable security, and execute their plans, which could include stealing data, disrupting operations, or demanding ransom. Some attackers may attempt to control the system remotely or connect it to other compromised devices. After achieving their objectives, advanced attackers often remove evidence of their presence, sometimes leaving a backdoor for future access.
3 Britannica SourcesCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles. -
Why is it important to protect personal information from cyberattacks?
Protecting personal information from cyberattacks is crucial because these attacks can lead to identity theft, invasion of privacy, and fraud. Cyberattacks, which are deliberate attempts to gain unauthorized access to digital systems, can result in the theft of money, personal information, and intellectual property, with the aim to disrupt systems. The increasing amount of personal information stored in computer databases creates vulnerabilities that hackers can exploit. Implementing measures such as strong passwords, multifactor authentication, and keeping software up to date are effective strategies to prevent cyberattacks and lessen potential damage. Individuals and businesses share the responsibility of protecting data and preventing unauthorized disclosure.
3 Britannica SourcesCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles. -
What are some ways people and organizations can defend against cyberattacks?
To defend against cyberattacks, individuals and organizations can implement several strategies. Ensuring all software is up-to-date and avoiding unknown links is an effective first step. Additional measures include identity and access management strategies like multifactor authentication, strong passwords, and virtual private networks (VPNs).
Organizations can further protect themselves by educating employees about cybersecurity, hiring third-party security experts, or investing in an internal cybersecurity team. These teams can identify system weaknesses, detect attacks, and create response plans. Using firewalls and internet encryption can also prevent malicious actors from accessing a network. Data loss prevention tools can monitor for security threats and back up important data in case of a breach. Sharing scam stories can also deter criminals, as scams are more likely to fail when people are forewarned.
4 Britannica SourcesCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles.
cyberattack, deliberate and malicious attempt to gain unauthorized access to a digital system. Cyberattacks can affect computers, smartphones, or other Internet-connected devices. Cybercriminals’ main goal is often to steal money, personal information, credentials, intellectual property, or otherwise valuable information. Attackers may also aim to disrupt or cripple the targeted system. Cyberattacks are often a precursor to more-serious cybercrime, such as identity theft, invasion of privacy, and fraud. Such attacks occur every day, and more than half of them result in damages of $500,000 or more each. The average cost of a data breach is $4.35 million, and some estimates indicate that cybercrime will cost the world $10.5 trillion annually by 2025. The most advanced cyberattacks have disrupted industrial machinery, transportation, and Internet service to entire regions; they have even left hundreds of thousands of people without electricity.
Cyberattacks present a significant threat to computer systems not only because of the damage they can cause but also because of their low cost of entry. With mastery over certain software, one person could launch an attack against an entire country. Moreover, attackers can easily hide their identity, location, and motive. Cyberdefense measures must repeatedly deter attacks that may differ in scope and method, whereas a cyberattack needs to succeed only once; an unprotected server can face hundreds of attacks a day. The line between cyberdefense and cyberattack, however, sometimes blurs. For example, Pegasus spyware was explicitly designed for national security and law enforcement but was used to track and monitor influential individuals without their knowledge.
Both individuals and organizations can perpetrate cyberattacks, but such attacks differ from cyberwar, which is typically waged between countries. Cyberwar can include physical attacks against digital infrastructure (such as destroying communications systems or hardware) in addition to cyberattacks.
" height="20" alt="HEW Logo">
Structure of cyberattacks
Cyberattacks target a system’s syntactic layer, its semantic layer, or both. Syntactic cyberattacks center on software and, in most cases, involve malware (a portmanteau of malicious and software). Semantic cyberattacks attempt to trick victims into providing valuable information or access to valuable systems, using a strategy known as social engineering. A common example of social engineering is phishing—the practice of sending fraudulent emails that impersonate trustworthy contacts to ask for personal information.
Cyberattacks generally operate in four broad phases. Attackers start with reconnaissance, during which they probe for weaknesses and gather information within a target’s system. They may use social engineering to obtain private information and may consider aligned targets, such as partners, customers, or suppliers. During this stage, the attackers typically research how to breach the system and whether that will require creating or buying malware or conducting trials.
The second phase is delivery, during which the attackers implement a plan to infiltrate the target. Common methods include using an infected USB, creating a fake website, or planting a link within an email. Attackers may even resort to more-traditional forms of crime, such as bribery or blackmail.
The third phase of a cyberattack is breaching. If the infiltration plan succeeds, the attackers gain access to the target’s system and establish a digital presence.
The trusted destination for professionals, college students, and lifelong learners.
SUBSCRIBE
The fourth phase is the attack. Now that the attackers have gained access to their target’s system, they may attempt to breach more-valuable networks or to establish a more permanent presence. They may also attempt to disable system security measures. The attackers can then proceed with their plans: depending on the target, they may be interested in sending bank payments, disrupting or crippling business operations, stealing intellectual property or sensitive information, or otherwise changing the network. They can disrupt the system to gain remote control over it, perhaps even connecting it to other compromised devices.
Advanced attackers typically vacate the system and remove evidence of their presence after they have achieved their goals; they may even disguise their work as someone else’s. In some cases, they leave behind a back door for future access or to sell access to other cybercriminals. Some attackers, however, wreak havoc merely to attract attention to their success.
Types of cyberattacks
Cyberattacks can be classified into two categories: untargeted and targeted. Untargeted attacks aim to affect as many devices or services as possible. For example, infiltrators sometimes use “water holing,” in which a web page is created or compromised and visitors are then attacked as they access the page. Another example is scanning, in which attackers systematically attempt to find vulnerabilities in a system, often aiming for points of entry.
Targeted cyberattacks are tailored to a specific individual or organization. The culprit is often external, but internal actors can also compromise a system.
Malware
Malware is an umbrella term for software programs used in cyberattacks, typically installed on victims’ devices when they interact with a dangerous link or email. For example, electronic games or applications from a third-party service may hide malware within their software packages. Attackers may also try “baiting,” a strategy in which malware is left in a public online space, such as a web page. Malware includes viruses, worms, Trojans, rootkits, spyware, and adware. Scareware uses false alerts to pressure a user into downloading further malware or into providing valuable information. Ransomware, also called cryptoviral extortion, blocks access to a digital asset or device until the owner pays a ransom. Payments have been as much as $40 million. Ransomware is the second most common form of cyberattack; in fact, there are organizations that sell ransomware attacks as a service, enabling others to conduct such attacks.
Software exists to detect and combat malware, and operating systems are continually updated to minimize weaknesses. However, malware has advanced just as quickly as cyberdefense strategies and tools.
Phishing
Phishing is a common social engineering tactic in which cyberattackers impersonate trusted sources, typically via email, to steal valuable data or to install malware. Spear phishing is the term for sending such emails to specific targets in an organization; whale phishing is a subcategory that targets company executives. Business email compromise scams occur when cybercriminals impersonate an executive or a business associate and ask that money be wired to a specific account.
Denial-of-service attacks
A denial-of-service (DoS) attack overwhelms its target with traffic and thus prevents legitimate use. Distributed denial-of-service (DDoS) attacks occur when the source of the traffic is not a single entity but many, typically involving the use of a botnet. A botnet is a network of connected devices—termed zombie computers—that are all infected with malware, allowing attackers to use them for their own purposes without owner authorization. The largest discovered botnet comprised nearly two million computers.
Man-in-the-middle attacks
Man-in-the-middle (MitM) attacks, sometimes called eavesdropping attacks, occur when attackers intercept communications either between people or between an individual and a server. Unsecured public networks provide a relatively easy environment for attackers to spy on and intercept Internet traffic. Session hijacking attacks are a subcategory of MitM attacks in which attackers match their IP address to that of a legitimate user, thereby gaining the same level of access on the user’s server.
Other types of cyberattacks
- Cross-site scripting (XSS) occurs when an attacker infects a website, often through JavaScript code, which typically involves sending the target to a different site or stealing targeted data.
- Supply chain attacks occur when attackers hijack a third-party vendor used by the target in order to infiltrate the system. Depending on the extent of the attack and the size of the vendor, attackers could access multiple targets.
Cyberattack prevention
Simply ensuring that all software is up-to-date and avoiding unknown links can be an effective strategy to prevent cyberattacks. Identity and access management strategies, such as multifactor authentication, strong passwords, and virtual private networks (VPNs), provide added levels of security. Firewalls and Internet encryption can prevent bad actors from interacting with a network. Additionally, data loss prevention tools can monitor security threats and aid in backing up important data in the event of a breach.
Organizations can work to deter cyberattacks by educating employees on cybersecurity tips, enlisting third-party security experts, or investing in an internal cybersecurity team. Such teams can take measures to root out system weaknesses, detect cyberattacks, and create response plans in the aftermath of an attack. Although it is impossible to be completely secure from cyberattacks, such measures can help to lessen potential damage.