Advanced Threats & Social Engineering
Sophisticated attacks jo months tak undetected reh sakte hain — human psychology exploit karna
Long-term targeted attack — attacker mahino ya saalo tak network mein chupa rehta hai bina detect hue. Nation-states typically. Goal: data exfiltration ya sabotage — not ransomware quick hit.
Advanced: Zero-days, custom malware, multiple vectors
Persistent: Months/years long campaign
Threat: Specific high-value target
SolarWinds (2020): Russia's SVR ne SolarWinds software update mein malware inject kiya (supply chain). 18,000 organizations ne infected update install kiya. US government agencies breach — 9 months undetected.
Government ya corporations ke sensitive information chori karna digital means se. Military plans, technology secrets, diplomatic cables, trade secrets — sab target. Traditional spy agencies ka cyber equivalent.
China (APT40, APT10), Russia (APT28 Fancy Bear, APT29 Cozy Bear), North Korea (Lazarus Group), Iran. India bhi increasingly targeted.
State-sponsored cyberattacks dusre nations ko disrupt ya damage karne ke liye. Power grids, water systems, financial systems, military systems target hote hain. 5th domain of warfare — land, sea, air, space, cyber.
Ukraine power grid attacks by Russia (2015, 2016). Estonia DDoS (2007). Stuxnet vs Iran. NotPetya Ukraine attack ($10B+ global damage). These are acts of war.
Direct target attack mushkil hai. To attacker uske software supplier, hardware vendor, ya IT provider ko compromise karta hai. Target khud infected software install kar leta hai thinking it's legitimate.
Trusted source se aata hai — security bypasses. Scale: ek vendor compromise = hazaron customers compromise simultaneously. Defense very difficult.
SolarWinds Orion (2020) + XZ Utils (2024): Open source library mein backdoor inject kiya gaya 2 years ke patient social engineering ke baad. Nearly compromised OpenSSH on millions of Linux servers.
Systematically har possible password/key combination try karna jab tak sahi na mile. Simple 4-digit PIN = 10,000 combinations. "abc123" jaise common passwords seconds mein crack.
Simple Brute Force: aaa, aab, aac...
Dictionary Attack: Common words list
Rainbow Table: Pre-computed hash lookups
Hybrid: Dictionary + variations
- Rate limiting — 3 attempts failed → lockout
- CAPTCHA
- Long, complex passwords — "Tr0ub4dor&3" better than "password123"
- MFA — even if password cracked, need 2nd factor
Data breach se leaked username-password pairs ko automated tools se hazaron other sites pe try karna. Same password everywhere use karte ho? Ek site breach = sab sites compromise.
Billions of credentials dark web pe available. Tools like Snipr, STORM automate yeh process. 0.1% success rate bhi millions of accounts = huge impact.
- Unique password har site pe — password manager use karo (Bitwarden, 1Password)
- haveibeenpwned.com pe check karo tumhara email leaked hai kya
- MFA always
Malicious: Deliberately data steal ya damage kare (disgruntled employee)
Negligent: Accidentally security mistake kare (click phishing, lose laptop)
Compromised: External attacker ne account highjack kiya
UEBA (behavior analytics) — normal se deviation. Unusual access times, large data downloads, off-hours logins. DLP tools unusual data movement flag karte hain.
Edward Snowden (2013): NSA contractor — 1.7 million classified documents copied aur media ko diye. Sab access legitimate tha — audit trail nahi tha ki woh itna sab ek saath download kar raha hai.
Unskilled individuals jo publicly available tools/scripts use karte hain attacks ke liye bina understanding ke. "Point and click" hacking. Real hackers inhe seriously nahi lete, par inka sheer volume ek threat hai.
Volume mein dangerous — hazaron script kiddies = significant DDoS. Basic vulnerabilities exploit kar lete hain. Patched systems ka importance inhi se pata chalta hai.
Systems jahan digital aur physical world meet karte hain — industrial control systems (ICS), SCADA, power plants, water treatment, hospital equipment. Hack karo → physical world mein damage.
Power grid hack → lights off city mein. Water treatment hack → poison in water. Hospital device hack → patient harm. These are life-and-death scenarios — not just data theft.
Humans ko manipulate karke confidential info reveal karwana ya actions perform karwana. Technical skills ki zaroorat nahi — psychological manipulation. Phishing, pretexting, baiting, quid pro quo sab forms.
Pretexting: Fake identity banao (IT support, bank)
Baiting: Infected USB chhodna parking mein
Quid Pro Quo: "IT help ke badle password do"
Tailgating: Physically follow someone through secure door
"Tumhara PC virus infected hai, main IT se hun, abhi remote access do" — yahi social engineering. Firewall bypass nahi kiya, tumhe manipulate kiya khud access dene ke liye.