Cyber Attacks and Threats: Malware, Network and Web Attacks, and Defences · সাইবার আক্রমণ ও হুমকি: ম্যালওয়্যার, নেটওয়ার্ক ও ওয়েব আক্রমণ এবং প্রতিরোধ

1. Threat, vulnerability, risk and the CIA triad

Five words come first, because exams test their exact meaning:

• Threat: anything that could cause harm by exploiting a weakness (an attacker, malware in circulation, a flood).
• Vulnerability: the weakness itself (an unpatched bug, a weak password, an open port, an untrained employee).
• Exploit: the code or technique that takes advantage of a vulnerability.
• Attack: the act of using the exploit; a threat that has actually happened.
• Risk: how likely the harm is and how bad it would be (informally, likelihood × impact).

Think of a building: an unlocked window is the vulnerability, an intruder is the threat, the way in is the exploit, the break-in is the attack, and the risk is how likely and how costly a break-in is.

Every attack damages at least one of three security goals, the CIA triad:

Goal	Meaning	Concern it answers	What breaks it
Confidentiality	Only authorised people can read the data	Interception	Sniffing, spyware, phishing, data theft
Integrity	Data and systems are not changed without authority	Falsification, masquerade	Tampering in a MITM attack, altering records via SQL injection, defacing a page
Availability	Authorised users can use the service when needed	Denial of service	DoS/DDoS, ransomware, wiper malware

A neighbouring classification, common in cryptography textbooks, appears in MCQs: snooping and traffic analysis threaten confidentiality; modification, masquerading, replaying and repudiation threaten integrity; denial of service threatens availability. So someone obtaining a document they are not allowed to see is committing snooping (unauthorised access to information). Two more goals are often added: authentication (you are who you claim) and non-repudiation (you cannot deny an action you took).

Attacks are also either passive or active:

Point	Passive attack	Active attack
What the attacker does	Only watches or copies	Changes, injects, replays, blocks or impersonates
Goal broken	Confidentiality	Integrity and availability
Detection	Hard (nothing changes)	Easier (it leaves traces)
Main defence	Encryption (prevention)	Detection and recovery
Examples	Sniffing, eavesdropping, traffic analysis	DoS, MITM, spoofing, replay, session hijacking

2. Malware: the types and how to tell them apart

Malware (malicious software) is any program written to harm a system, steal from it or control it without permission. It is software, not hardware: a computer virus is a program. NIST's malware guide (SP 800-83) describes viruses, worms, Trojan horses, malicious mobile code and attacker tools such as backdoors, keystroke loggers and rootkits; the table adds the other families exams ask about. The deciding questions are: does it copy itself, does it need a host file, and does it need the user to run it?

Type	Self-replicates?	Needs a host file?	How it spreads	What it does	Example
Virus	Yes	Yes (attaches to a program, document or boot sector)	The user runs or opens the infected host	Infects other files; runs a payload	Melissa macro virus (1999)
Worm	Yes	No (standalone)	By itself over the network	Spreads fast, uses bandwidth, often drops other malware	Morris worm (1988), SQL Slammer (2003)
Trojan horse	No	No	Disguised as useful software; the user installs it	Opens a backdoor, steals data, downloads more malware	Banking Trojans
Ransomware	Not by itself (some add a worm)	No	Phishing, exploits, a worm component	Encrypts files or locks the system, demands payment	WannaCry (2017)
Spyware / keylogger	No	No	Bundled software, Trojans	Secretly records activity, keystrokes and passwords	Stalkerware
Adware	No	No	Bundled with free software	Shows unwanted adverts, tracks browsing	–
Rootkit	No	No	Installed after a break-in or by a Trojan	Hides itself and other malware by altering the OS; keeps privileged access	Sony BMG CD rootkit (2005)
Bot / botnet	Often (via a worm)	No	Infected machines join a network run from a command-and-control (C2) server	Used together for DDoS, spam	Mirai (2016, IoT devices)
Logic bomb	No	Hidden in a legitimate program	Planted by an insider	Fires when a condition is met (a date, a name removed)	–

Key distinctions exams ask:

• Virus vs worm: a virus needs a host file and a user action; a worm is standalone and spreads by itself across a network.
• Trojan: it does not replicate. Papers often write "Trojan horse virus", but strictly it is malware, not a virus; when both options appear, "malware" is the precise answer.
• Rootkit vs bootkit: a rootkit hides inside the operating system (or kernel); a bootkit infects the boot process (the master boot record, boot loader or UEFI firmware), so it loads before the OS and its defences.
• Kinds of virus by target or trick: file infector; boot sector virus; macro virus (in Word or Excel macros); polymorphic virus (changes its code on every copy to defeat signatures); resident virus (installs itself in memory and infects files as they are opened); stealth virus (intercepts system calls to hide its changes, so infected files look clean — the usual key for "hard to detect").
• Backdoor (trapdoor): a hidden way into a system that skips normal authentication, left by a developer or planted by malware such as a Trojan.
• Components of a virus: (1) an infection mechanism (how it spreads), (2) a trigger (the event that releases the payload) and (3) the payload (the effect). Its life passes through four phases: dormant, propagation, triggering and execution.
• A bug is a programming mistake, not malware.

3. Social engineering: targeting the person

Social engineering tricks people into revealing information or running malware. It is the most common way attacks begin, which is why "untrained staff are the biggest risk" is defensible: a person can bypass every technical control.

Attack	Channel	What happens
Phishing	Email or fake website, sent widely	A message posing as a bank or service asks you to click a link or open an attachment
Spear phishing	Email aimed at one person or team	Personalised with real names, roles and projects, so far more convincing
Whaling	Email aimed at executives	Spear phishing against senior staff, often to approve a payment
Vishing	Voice call	A caller poses as the bank or IT support and asks for an OTP or PIN
Smishing	SMS	A text with a link (a "parcel fee", a "blocked account")
Pharming	DNS or the hosts file	Redirects the victim to a fake site even when the correct address is typed (by poisoning DNS or editing the hosts file)

Spam vs phishing: spam is unwanted bulk email, usually advertising — a nuisance; phishing is a deliberate fraud that impersonates a trusted sender to steal credentials or plant malware.

Defences: user-awareness training, email filtering and sender authentication (SPF, DKIM, DMARC), never sharing an OTP, confirming requests on a second channel, and MFA so a stolen password alone is not enough. CISA advises recognising the signs — urgency, a mismatched sender, an unexpected link — and reporting rather than clicking.

4. Network attacks

Attack	Idea	What it does	Main defence
DoS	Availability	One source floods a server or link so real users cannot be served	Rate limiting, filtering
DDoS	Availability	Many machines (a botnet) flood at once; cannot be blocked by one IP	Anti-DDoS scrubbing, anycast, over-provisioning
Man-in-the-Middle (MITM)	Integrity/confidentiality	Attacker relays traffic between two parties, reading or altering it	End-to-end encryption (TLS), certificate checks
IP / MAC spoofing	Forging an address	Sends packets with a fake source address to impersonate or evade filters	Ingress filtering (BCP 38), authentication
Sniffing	Passive capture	Reads traffic on the network (easy on a hub or open Wi-Fi)	Encryption; switched networks
ARP poisoning	Layer 2	Sends forged ARP replies so the victim's "gateway" MAC points at the attacker, enabling MITM	Dynamic ARP Inspection, static ARP, port security
Replay attack	Re-sending captured data	Captures a valid message (such as a login or payment) and sends it again later to repeat its effect	Timestamps, nonces, one-time session tokens
Session hijacking	Stealing a session	Takes over a logged-in session by stealing its token or cookie	HTTPS, HttpOnly/Secure cookies, re-authentication
DNS spoofing / cache poisoning	Fake name resolution	Puts a false IP in a resolver's cache so a name leads to the attacker's server	DNSSEC, randomised source ports

How a DoS differs from a DDoS: a DoS comes from one machine; a DDoS comes from many at once, so you cannot simply block one address. SYN flood is the classic: in the TCP three-way handshake (SYN, SYN-ACK, ACK) the attacker sends many SYNs with spoofed source addresses and never completes with the ACK, so the server's half-open connection queue fills and real users are refused; SYN cookies defend against it.

Why ARP poisoning enables MITM: ARP has no authentication, so a host believes any ARP reply. The attacker tells the victim "the gateway is at my MAC" and tells the gateway "the victim is at my MAC". Both now send their traffic through the attacker, who can read or change it — a man-in-the-middle position gained at Layer 2.

5. Web attacks (SQL injection, XSS, CSRF) and buffer overflow

The three web attacks share one root cause: untrusted input is mixed with a trusted command or trusted markup, and the interpreter cannot tell data from instruction. In the current OWASP Top 10 (2025), A05:2025 – Injection covers SQL injection and XSS (it was A03 in the 2021 list that many exam keys still use), and Cross-Site Request Forgery (CWE-352) is part of A01:2025 – Broken Access Control.

SQL injection (SQLi)

If user input is pasted straight into a SQL string, the input can become SQL. Suppose a login builds its query by string concatenation:

SELECT username FROM users WHERE username = '<user>' AND password = '<pass>'

Entering the password value ' OR '1'='1 turns the query into one whose WHERE clause is always true, so it returns every row and the check passes without the real password. Running this against a test SQLite table of three users returned all three rows — the login was bypassed. Entering admin' -- as the username comments out the rest of the line and logs in as admin.

The fix is a parameterized query (prepared statement): the SQL text and the data travel separately, so the database treats the input only as a value, never as code. The same two inputs then return no rows — the attack fails. In Python's sqlite3 module (other drivers use %s instead of ?):

# Unsafe: input is concatenated into the SQL text
q = "SELECT username FROM users WHERE username = '" + u + "' AND password = '" + p + "'"
cur.execute(q)

# Safe: parameterized query — the ? placeholders keep data separate from code
cur.execute(
    "SELECT username FROM users WHERE username = ? AND password = ?",
    (u, p),
)

(Real systems never store or compare plaintext passwords; they compare a salted hash — see §6.)

Extra layers: input validation, least-privilege database accounts, and never showing raw database errors to users. The keyed MCQ answer to "how to prevent SQL injection" is input validation (and, more completely, parameterized queries); showing database errors or using input directly are wrong.

Cross-Site Scripting (XSS)

XSS injects script that runs in another user's browser because it appears to come from the trusted site, so it can steal cookies or session tokens or act as the user. Three kinds: stored (saved on the server, e.g. in a comment — the most dangerous), reflected (echoed back from the request, needs a crafted link) and DOM-based (client-side JavaScript writes the input into the page). The primary defence is output encoding for the context (turning <, >, &, " into HTML entities so a script tag displays as text), plus a Content Security Policy and the HttpOnly cookie flag.

Cross-Site Request Forgery (CSRF)

CSRF makes a logged-in victim's browser send a request the victim did not intend (for example, a transfer), and the server trusts it because it carries the victim's valid session cookie. Defences: a secret, per-session CSRF token the attacker cannot guess, the SameSite cookie attribute, and re-authentication for sensitive actions.

Attack	Runs where	Targets	Root cause	Primary defence
SQL injection	The database (server)	The data store	Input mixed into SQL	Parameterized queries
XSS	The victim's browser	Other users	Input mixed into HTML	Output encoding, CSP
CSRF	The server, via the victim's browser	The logged-in user's session	Server cannot tell a forged request from a real one	CSRF token, SameSite cookie

Buffer overflow (a related input attack)

A buffer overflow happens when a program copies input into a fixed-size buffer without checking its length (CWE-120). The extra bytes spill into the memory next to the buffer. On the stack that can include the function's saved return address, so an overflow can crash the program (a denial of service) or, worse, let an attacker redirect execution to code of their choosing. It is a flaw of languages such as C and C++ that do not check array bounds.

char name[16];
strcpy(name, input);                        /* unsafe: no length check */
snprintf(name, sizeof name, "%s", input);   /* bounded: at most 15 chars + '\0' */

Compiled and run with a 44-character input, the bounded version stores only the first 15 characters and stays inside the buffer. Defences, from the code outwards: bounds checking and input-length validation; safe library functions (snprintf, strncpy with explicit termination, strlcpy) instead of strcpy, gets or sprintf; stack canaries (a guard value the compiler checks before a function returns); ASLR (randomised memory addresses, so a target is hard to predict); DEP/NX (data areas cannot be executed); and memory-safe languages (Java, Python, Rust).

6. Password attacks and zero-day

• Brute force: try every possible password. The cost grows explosively with length and character set. Computed key spaces (at a generous 10¹⁰ guesses per second, offline worst case): an 8-character lowercase password is 26⁸ ≈ 2.09 × 10¹¹ combinations, exhausted in about 21 seconds; 8 characters of mixed letters and digits is 62⁸ ≈ 2.18 × 10¹⁴, about 6 hours; a 12-character password from the 95 printable ASCII characters is 95¹² ≈ 5.4 × 10²³, which would take on the order of a million years. Length wins — this is why long passphrases and MFA matter.
• Dictionary attack: try a list of likely words and common passwords instead of all combinations — fast against weak passwords.
• Rainbow table: precomputed hash-to-password lookups; defeated by a per-user random salt added before hashing.
• Credential stuffing: reuse username/password pairs leaked from another site.
• Defences: strong, unique passwords or passphrases; salted, slow hashes (bcrypt, scrypt, Argon2); account lockout / rate limiting; and above all multi-factor authentication.

Zero-day: a vulnerability unknown to the vendor (so there are "zero days" to have fixed it) and the exploit that uses it before a patch exists. NIST's glossary defines it as an attack that exploits a previously unknown vulnerability. It is dangerous precisely because signatures and patches do not yet exist; defences are behaviour-based detection, least privilege, network segmentation and fast patching once a fix ships. Stuxnet (2010) famously chained several zero-days.

7. Defences: defence in depth

No single control is enough; exams reward naming layers and matching each to the threat.

Control	What it does	What it stops
Firewall	Filters traffic by rules (ports, addresses, state)	Unwanted connections; a WAF filters web attacks such as SQLi/XSS
IDS	Intrusion Detection System — detects and alerts on suspicious traffic	Gives warning; does not block by itself
IPS	Intrusion Prevention System — detects and blocks inline	Active attacks in real time
Patching / updates	Fixes known vulnerabilities	Exploits of known bugs (worms, many breaches)
MFA	Needs a second factor beyond the password	Account takeover from a stolen password
Encryption (TLS, at rest)	Makes intercepted data unreadable	Sniffing, MITM eavesdropping
Antivirus / EDR	Detects and removes malware	Known and suspicious malware
Backups (offline/immutable)	Restore after loss	Ransomware, data destruction
Least privilege & segmentation	Limit what each account and segment can reach	Lateral movement after a breach
Honeypot	A decoy system with no real users, so any contact with it is suspicious	Gives early warning and shows attackers' methods

Firewall vs antivirus (often asked): a firewall controls network traffic at the boundary; antivirus scans files and programs on the host for malware. IDS vs IPS: IDS only detects and alerts; IPS also blocks. A WAF (Web Application Firewall) sits between clients and a web server, inspecting HTTP requests and blocking web attacks.

NIST SP 800-61 (incident response) completes the picture: even with these controls, an organisation needs a plan to detect, respond to and recover from incidents, because no defence is perfect.