The forms of attack
The specification asks for each form of attack: how it is used, and its purpose. Those are two separate things, and answers that give only the definition tend to lose marks — so each entry below covers both.
Social engineering deserves particular attention, because the specification names people as the 'weak point'. Every other attack in the list is technical, and can be resisted with technical measures. Social engineering bypasses all of them: no firewall stops a user who is persuaded to type their password into a convincing fake website. That is why staff training appears among the prevention methods in 1.4.2, and it is why social engineering is often the most effective attack of all.
Phishing is the example the specification names — an email or message pretending to be from a trusted organisation, asking the user to click a link and enter their details on a fake site.
Common types of malware worth being able to name:
• Virus — attaches itself to a file and spreads when that file is opened • Worm — spreads by itself across a network without needing a user to do anything • Trojan — disguised as legitimate software the user installs willingly • Spyware — secretly records what the user does, including keystrokes • Ransomware — encrypts the user's files and demands payment for the key
- Malware
- software written to damage or gain unauthorised access to a computer system
- Phishing
- an attack sending messages that appear to be from a trusted organisation, to trick a person into giving away details such as passwords
- Social engineering
- manipulating people into giving away information or access, exploiting people as the 'weak point' rather than the technology
- Brute-force attack
- an attack that tries every possible combination until it finds the correct password
- Denial of service attack
- an attack that floods a server with requests so that it cannot respond to legitimate users
- SQL injection
- an attack entering SQL into an input box so that it is run by the database, revealing or altering data
Applying it to a scenario
Worked example
An online shop finds that someone has logged into several customer accounts. Passwords were not written down anywhere. Suggest two attacks that could explain this.
- Consider brute-force: software trying every combination until one works, which succeeds against short or common passwords.
- That fits, because it needs no help from the user at all.
- Consider social engineering: a phishing email pretending to be from the shop, asking customers to log in on a fake site.
- That also fits — the passwords were not stolen from anywhere, they were given away by the customers themselves.
- Consider data interception: passwords captured over an unsecured wireless connection if the site did not use HTTPS.
Answer: A brute-force attack, in which software tries every combination until it finds a working password — most likely to succeed where customers chose short or common passwords. Or social engineering through phishing, where customers were tricked into entering their details on a convincing fake version of the shop's login page.
Common mistake
A denial of service attack does not steal data or break into an account. Its purpose is to make a service unavailable — so it is the wrong answer to any question about information being obtained.
Before you practise
- The six forms: malware, social engineering, brute-force, denial of service, data interception and theft, SQL injection.
- For each, be able to say both how it is used and what it aims to achieve.
- Malware types: virus, worm, trojan, spyware, ransomware.
- Social engineering targets people rather than technology, which is why people are the weak point.
- Phishing is the named example — a message impersonating a trusted organisation.
- A brute-force attack tries every combination until one works.
- Denial of service makes a service unavailable; it does not steal data.
- SQL injection enters database code into an input box so the database executes it.