Malware

Malware, or malicious software, gets access to your device without your knowledge to cause general mayhem: giving bad actors access to your files, using your device as a base to spread viruses across a network, generating revenue for the developer, stealing login details, and so on.

There are many types of malware and we expect that even businesses with limited security knowledge will have heard of one the most well-known: ransomware.

Ransomware is a type of malware that gives a hacker access to your files. The cybercriminal will then block your access to those files and demand that a ransom be paid in exchange for the safe return of your data (of course, payment is no guarantee that your data will actually be returned).

Malware can enter your system in many ways, including through email or via a shared connection with a device that’s already infected. A Trojan is – as you may expect if you know the classic tale of subterfuge from Ancient Greece – malware disguised as legitimate software. You may think you are downloading a harmless app to your computer or mobile, while in fact, you are allowing a virus to access your device.

Most of the time, you won’t know that malware is attacking your network until it has already wreaked havoc; you may wonder why your device seems slower than usual, or why your memory is suddenly full. This is why anti-malware is an important part of business security; it stops malicious software before it reaches your device.

Email attacks

Email attacks used to be fairly easy to spot – an email with poorly written language and an over-dramatic sense of urgency asking you to click a strange-looking link or send some money. However, they are now far more sophisticated and can be used to steal information such as credit card details using techniques such as phishing.

Phishing emails, or phish, are sometimes referred to as spam, but they are not the same. Spam simply means unwanted emails, or junk mail, and most well-known email providers are good at filtering out what they think you won’t be interested in. Phishing, on the other hand, are emails that appear to be legitimate and from a trusted source, like a bank or charity.

Spearphishing is even sneakier. Assailants will spend time researching a company or individual and identifying who they should imitate and who they should target to get the best chance of success. For example, they might set up a replica account for the CEO and email an assistant to send bank login details. While phishing emails are sent en-masse, spearphishing is highly targeted.

Code injection

The average employee may have heard the terms ‘malware’ or ‘phishing’, even if they don’t know what it means. But we’re betting that not so many will have heard of SQL injection.

SQL, or ‘Structured Query Language’, basically refers to the language used in database management. For example, if you want to know the local branch of a retailer, you might visit their website and type the location into a search bar. SQL is used to read that search, or query, and return relevant results from a database stored on the web server.

During an SQL injection attack, weaknesses in a website’s development are used to upload, or inject, malicious code into the database. The code gives the hacker access and control to the web server’s database to make changes and steal data as they please.

If you save logins, email addresses or any kind of personally identifiable data that’s accessible by your website, your customers and your business could be at risk. And if you enable any kind of transactions on your website, this could be extremely damaging.

A similar attack is cross-site scripting, or XSS. It also exploits weaknesses in a website’s coding – or into applications – but it injects code that can alter or add scripts. This attack uses HTML or JavaScript rather than SQL and can be used to turn a legitimate website into a malicious one. For example, XSS could be used to add a script that downloads malware to a customer’s device any time they download a PDF from your website.

DOS

Any action that you take on your device is a request that must be fulfilled; for example ‘send this email’, ‘close this application’, or ‘open this link’. If you’ve ever had too many tabs open on your browser, you’ll know how multiple requests will slow down your device – and you’ll also know how frustrating this can be when you’re trying to meet a deadline or complete a report. This unresponsive state is what denial of service (DOS) attacks are trying to achieve but on a bigger scale.

DOS attacks start with malware. Once your device becomes infected, the DOS software makes request after request until your system is completely overloaded and potentially, your entire business network. Your company must block the device from the web server until it can remove the offending malware.

DDoS, or Distributed Denial of Service, is an advanced version of a DOS attack that uses multiple compromised devices, rather than just one, to conduct the assault.

Once malware enters a device it can spread to other computers, and create a network. This network of infected devices is called a botnet and gives the perpetrator the power to overwhelm systems with requests from multiple points. So unlike DOS, blocking a single source from your server is no use – the attack will simply continue from another compromised device.

DDoS attacks are usually saved for enterprises, public authorities, and financial institutions.