Cyber Security and Threats: Malware, Attacks and PYQs

Cyber security is the practice of protecting computers, networks, programs and data from unauthorised access, damage or theft. As banking, ticketing, examinations and government records moved online, the same network that made them convenient exposed them to attack, so every competitive examination now asks a few questions from this chapter. The subject is built on three goals, remembered as the CIA triad: confidentiality, that only authorised people can read the data; integrity, that the data is not altered on the way; and availability, that the authorised user can reach the system when needed. Authentication and non-repudiation are usually added to the list.

Malicious software

Malware is the general name for any program written to harm a system. A virus attaches itself to a file or program and spreads only when that host is copied or run, so it needs human action. A worm is a stand-alone program that copies itself across a network by itself and needs no host file, which is why worms spread far faster. A Trojan horse pretends to be useful software, and once installed opens a back door; it does not replicate. Ransomware encrypts the victim's files and demands payment for the key, the WannaCry outbreak of 2017 being the best known case. Spyware watches quietly and reports back, a keylogger records every keystroke, adware pushes advertisements, and a rootkit hides deep in the system so that scanners miss it. A logic bomb is code that waits for a condition or a date before it fires.

Attacks on people and on systems

Phishing is the sending of a fake message that appears to come from a bank or an office so that the reader gives away a password, a card number or a one-time password. Spear phishing aims at one named person, whaling at a senior executive, vishing works by telephone call and smishing by text message. Pharming quietly redirects a correct web address to a fake site. All of these are forms of social engineering, in which the weakest link attacked is the human being rather than the machine.

Against systems, a denial of service attack floods a server with requests until genuine users cannot be served; when the flood comes from thousands of hijacked machines at once it is a distributed denial of service attack. Those hijacked machines, controlled together by an attacker, form a botnet, and each infected machine is called a zombie. A man in the middle attack places the attacker silently between two parties who believe they are talking directly. SQL injection feeds database commands into a web form so that the site returns data it should not. A zero-day attack uses a flaw that the maker does not yet know about, so no patch exists. A brute force attack tries every possible password, while a dictionary attack tries likely words first.

Defences

A firewall stands between a trusted internal network and the untrusted outside, examining traffic and blocking whatever the rules do not permit; it may be hardware, software or both. Antivirus software compares files against a store of known signatures and also watches for suspicious behaviour, quarantining what it finds. Encryption turns readable plaintext into ciphertext. In symmetric encryption the same secret key locks and unlocks the message, as in AES and the older DES; in asymmetric or public key encryption a public key encrypts and a matching private key decrypts, as in RSA, and this is what makes the digital signature possible. A digital signature proves who sent a document, shows that it was not altered, and prevents the sender from later denying it.

Everyday defences matter as much. A strong password mixes cases, digits and symbols and is not reused. Two-factor authentication adds a second proof, usually a one-time password or a fingerprint, so that a stolen password alone is not enough. HTTPS, shown by the padlock in the address bar, means the connection is protected by SSL or TLS. A virtual private network carries traffic through an encrypted tunnel, useful on public wi-fi. A CAPTCHA tells a human apart from an automated program, and a honeypot is a decoy system set up to attract and study attackers.

The Indian framework

The Information Technology Act, 2000, amended in 2008, is the parent law for cyber offences in India. CERT-In, the Indian Computer Emergency Response Team, is the national nodal agency for responding to computer security incidents and works under the Ministry of Electronics and Information Technology. The National Critical Information Infrastructure Protection Centre protects systems in sectors such as power, banking and transport whose failure would harm national security. The Cyber Swachhta Kendra is the botnet cleaning and malware analysis centre that helps users remove infections. Complaints are filed on the national cybercrime reporting portal, and the national cybercrime helpline number is 1930. Safer Internet Day is observed on the second Tuesday of February.