Phishing is the practice of sending fraudulent communications that appear to come from a reputable source, usually through email. The goal is to steal sensitive data like credit card and login information or install malware on the victim’s machine. Phishing is an increasingly common cyberthreat.
Man-in-the-middle (MitM) attacks, also known as eavesdropping attacks, occur when attackers insert themselves into a two-party transaction. Once the attackers interrupt the traffic, they can filter and steal data.
Two common points of entry for MitM attacks:
- On insecure public Wi-Fi, attackers can insert themselves between a visitor’s device and the network. Then, without knowing, the visitor passes all information through the attacker.
- Once the malware has breached a device, an attacker can install software to process all victims’ information.
A denial-of-service attack floods systems, servers, or networks with traffic to exhaust resources and bandwidth. As a result, the system is unable to fulfill legitimate requests. Attackers can also use multiple compromised devices to launch this attack. This is known as a distributed-denial-of-service (DDoS) attack.
A Structured Query Language (SQL) injection occurs when an attacker inserts malicious code into a server that uses SQL and forces the server to reveal information it usually would not. For example, an attacker could simply carry out a SQL injection by submitting malicious code into a vulnerable website search box.
A zero-day exploit hits after a network vulnerability is announced but before a patch or solution is implemented. Attackers target the disclosed vulnerability during this window of time. Therefore, zero-day vulnerability threat detection requires constant awareness.
DNS tunneling utilizes the DNS protocol to communicate non-DNS traffic over port 53. It sends HTTP and other protocol traffic over DNS. There are various legitimate reasons to utilize DNS tunneling. However, there are also malicious reasons to use DNS Tunneling VPN services. First, they can be used to disguise outbound traffic like DNS, concealing data that is typically shared through an internet connection. Second, DNS requests are manipulated to exfiltrate data to the attacker’s infrastructure for malicious use from a compromised system. Finally, it can also be used for command-and-control callbacks from the attacker’s infrastructure to a compromised system.