Core Threats & Attacks
The most common weapons attackers use — yeh sab basic attacks hain jo real-world mein sabse zyada hote hain.
Malware = Malicious + Software. Koi bhi software jo deliberately tumhare system ko harm karta hai — data churaata hai, corrupt karta hai, ya control leta hai.
Virus, Worm, Trojan, Ransomware, Spyware, Adware, Rootkit, Keylogger — sab malware ke hi forms hain. Agle chapter mein har ek detail mein hai.
Malware ek bimari ki tarah hai. Jaise flu (virus), jaundice (spyware jo slowly damage kare), ya cholera (worm jo paani se spread ho) — sab alag hai, sab nuksan karta hai, par sab "bimari" hi hai.
WannaCry (2017): 150 countries mein ek worm-based malware ne UK ke NHS hospitals, Telefónica Spain, aur FedEx ko paralyze kar diya. $4 billion+ estimated loss. Ek unpatched Windows vulnerability se spread hua.
- Updated antivirus always run karo
- OS aur software patches turant apply karo
- Unknown links/files pe click mat karo
- Regular backups rakho offline
Attacker ek fake email/website/SMS banaata hai jo bilkul legit dikhti hai (bank, Google, Amazon). Tum usmein apni credentials enter karo — aur woh chala jaata hai.
Spear Phishing: Targeted attack (naam se bulata hai)
Whaling:
CEOs ko target
Smishing: SMS se
Vishing: Voice call se
Fake Email
Receives
Link
Website
Stolen!
Google & Facebook Scam (2013-2015): Evaldas Rimasauskas ne Lithuania se fake invoices Google aur Facebook ko bheji (impersonating Quanta Computer). $100M+ chura liye. Dono companies ne actually pay kiya!
- Sender ka email address dhyan se check karo
- Links pe hover karo URL dekhne ke liye pehle click se
- Koi bhi urgency feel ho — ruko, verify karo
- 2FA enable karo har jagah
Malware jo tumhare saare files encrypt kar deta hai (lock), phir Bitcoin mein payment maangta hai key ke liye. Pay karo ya data jaata hai.
Phishing emails, malicious attachments, unpatched software, RDP bruteforce. Ek infected machine poore network ko infect kar sakti hai.
- Malware system pe install hota hai (usually phishing se)
- Quietly files dhundhta hai — documents, photos, databases
- Strong encryption (AES-256) se sab files lock kar deta hai
- Screen pe ransom note dikhta hai with Bitcoin address
- Timer shuru hota hai — nahi diya to price badhta hai ya key delete
Colonial Pipeline (2021): US ki sabse badi fuel pipeline band ho gayi jab DarkSide ransomware ne attack kiya. $4.4 million ransom diya gaya. East coast mein fuel shortage aayi, panic buying shuru. Biden ne national emergency declare kiya.
- Offline backups (3-2-1 rule: 3 copies, 2 media, 1 offsite)
- Network segmentation — infection spread na ho
- RDP access restrict karo
- Pay mat karo — koi guarantee nahi key milegi
Hazaron ya laakhon infected computers ka ek network, jise ek "bot herder" (attacker) remotely control karta hai. Tumhara PC bina tumhare jaane bot ban sakta hai.
DDoS attacks, spam sending, crypto mining, credential theft, ad fraud. Attacker yeh bots dark web pe rent pe bhi deta hai doosron ko.
Sochao koi tumhare phone ko secretly remote control kar raha hai. Tum normal use kar rahe ho, but background mein woh kisi par spam bhej raha hai ya kisi website ko attack kar raha hai tumhare naam se.
Mirai Botnet (2016): IoT devices (cameras, routers) ko infect kar ke ek massive botnet banaya gaya. Iska use Dyn DNS pe DDoS attack karne ke liye hua jisse Twitter, Netflix, Amazon, Reddit — sab down ho gaye US mein ek din ke liye.
Hazaron bots ek hi server par ek saath itna traffic bhejte hain ki server handle nahi kar paata aur crash ya freeze ho jaata hai. Real users access nahi kar paate.
DoS: Single machine se attack (easy to block)
DDoS:
Distributed = hazaron machines se (almost impossible to block)
C&C Server
Bots
Server
CRASH
GitHub (2018): 1.35 Tbps ka attack — history ka biggest DDoS at that time. Memcached servers ka exploit karke amplification attack tha. GitHub 10 minutes tak down raha phir Akamai ne traffic absorb kiya.
- CDN use karo (Cloudflare, Akamai) jo traffic absorb kare
- Rate limiting implement karo
- Anycast network diffusion
- ISP-level filtering
Attacker do parties ke beech mein secretly ghus jaata hai. Tum sochte ho tum bank se baat kar rahe ho, par actually attacker beech mein hai, data padhta aur modify karta hai.
ARP Spoofing: Local network pe
DNS Spoofing: Wrong IP deta
hai
SSL Stripping: HTTPS → HTTP downgrade
Evil Twin: Fake
WiFi hotspot
(Victim)
MITM
Bank
Tumne apne dost ko letter bheja. Par postman ne woh letter open kiya, padhा, kuch badla, seal band kiya, aur bheja. Dono kisi ko nahi pata kuch hua bhi hai. Exactly yahi MITM hai.
Public WiFi MITM: Coffee shop/airport ke open WiFi par attacker "Evil Twin" attack karta hai — same naam ka fake hotspot. Tum connect hote ho, woh sab traffic dekh sakta hai.
Web forms mein SQL code enter karke database ko trick kiya jaata hai. Attacker login bypass kar sakta hai, data chura sakta hai, ya database delete kar sakta hai.
Jab website user input ko directly SQL query mein daalti hai bina sanitize kiye, attacker SQL command as input deta hai jo database execute kar leta hai.
Heartland Payment Systems (2008): SQL injection se 130 million credit card numbers chori hue. $140 million+ settlement. At that time, US history ki largest data breach.
- Parameterized queries / prepared statements use karo
- Input validation aur sanitization
- WAF (Web Application Firewall) use karo
- Principle of least privilege for database users
Attacker website mein malicious JavaScript inject karta hai. Jab koi user woh page open kare, unka browser attacker ka script run karta hai — cookies, session tokens chori ho sakte hain.
Stored XSS: Script database mein save (e.g. comments)
Reflected
XSS: URL mein script inject
DOM-based: Client-side manipulation
Samy Worm (MySpace, 2005): Samy Kamkar ne MySpace profile pe XSS script daali. Ek din mein 1 million+ profiles ne automatically "Samy is my hero" add kar liya. Ek teen ki prank ne history ka fastest spreading virus banaya.
Tum bank.com mein logged in ho. Attacker tumhe ek evil website pe le jaata hai. Woh website background mein bank.com pe request bhejti hai tumhare naam se — tumhara pata bhi nahi.
Browser automatically cookies bhejta hai same domain ke requests mein. Attacker iska fayda uthata hai — tumhara browser auth karta hai, request jayegi.
Koi tumhara haath pakad ke ek cheque pe sign karwa leta hai jab tum neend mein ho. Tumne kiya nahi, par signature tumhara hai. CSRF exactly aisa — browser tumhara auth use karta hai bina tumhare jaane.
- CSRF tokens — har request mein unique token
- SameSite cookie attribute
- Origin header verify karo server side
"Zero days" because vendor ko zero days mila fix karne ke liye — vulnerability abhi abhi discover hua, patch nahi bana, aur attacker already exploit kar raha hai.
Zero-day exploits dark web pe $1M+ mein bika karte hain. NSA, intelligence agencies bhi buy karti hain. Google ka Project Zero team inka hunt karta hai.
Stuxnet (2010): US+Israel jointly banaya ek zero-day exploit jo Iran ke nuclear centrifuges ko physically damage karne ke liye. 4 zero-days ek saath use kiye — unprecedented. Iran ke Natanz facility mein 1,000 centrifuges destroy huye bina koi bomb use kiye.