Do you remember the times with safe internet? So… 3 times a charm of attacking WWW users.
Internet – whether for business or for personal use – is accessed by everyone. The attacks which take its source in infected website are the most popular – with spray’n’pray effect – one source, many potentially infected hosts. It doesn’t matter if you own a website and want to secure it or want to secure your employees browsing the internet… It matters to know what you are up against.
If you’re a website owner – you risk loss of reputation, visitors or denial of service. As an organization – you open for attackers access to your network – which currently ends up mostly in encrypting your data with ransomware.
Below, we will discuss 3 most known attacks directed towards internet-browsing users:
1. Cross-Site Scripting (XSS) – many industry reports points towards XSS as the most common cyber attack, accounting for around 40% of all attacks. As befits most popular attack, these are done mostly by so-called script-kiddies – attackers using software created by others.
Cross-site scripts are for site visitors, not the web application itself. The malicious hacker places a snippet on a secured website, which is then executed by the website visitor. The code may crack a user’s account, activate Trojan or website pop-up to trick the user into giving in the sensitive data – e.g. credentials.
2. Man-In-The-Middle – common among websites that have not encrypted their data on the way from the user. As a user, you can identify a potential risk by checking that the website URL starts with HTTPS, where “S” means that the data is encrypted. Nowadays, it is actually a standard – and the browser itself will warn you about entering a website that does not encrypt the connection.
Attackers use a man-in-the-middle attack to gather (often sensitive) information. The perpetrator intercepts data sent between two parties. If the data is not encrypted, an attacker can easily read personal data, login credentials, or other sensitive data that travels between two locations on the Internet.
Rescue? SSL certificate installed on the website! Though you might want to ask us how attackers can come around even SSL-guarded websites 🙂
3. Phishing – the most common social engineering cybercrime, according to the FBI Internet Crime Report. COVID, information about military operations in Ukraine or the news about high wins – and you can give your data away to cybercriminal.
E-mail used to be standard tool used in phishing attempts. Nevertheless, due to the growing awareness of users, the number of attacks using seemingly authentic websites or indistinguishable pop-ups to log into popular services such as Gmail or Facebook is growing.
The above attacks are usually aimed at delivering malware or extorting your data. Usually, you either click on something or download something. As specialists, we deal with the mitigation of web threats, either at the proxy server level or directly on the end device, using agent solutions.
We do it because everyone uses the Internet today – and not everyone is aware of the dangers … Do you want to find out? Talk to us about how you can test the awareness of your users – yourself or with our help.
