So ... you've been hacked

Michael Brooks

DOI: https://doi.org/10.1038/d41586-024-00818-x

IF: 64.8

2024-03-20

Nature

Abstract:Research institutions are under siege from cybercriminals and other digital assailants. How do you make sure you don't let them in? Research institutions are under siege from cybercriminals and other digital assailants. How do you make sure you don't let them in?

multidisciplinary sciences

What problem does this paper attempt to address?

Cyberattacks are hitting research institutions — with devastating effects

Diana Kwon

DOI: https://doi.org/10.1038/d41586-024-01711-3

IF: 64.8

2024-06-13

Nature

Abstract:Hackers are targeting universities and research institutes with ransomware, leaving staff and students without the ability to work. Hackers are targeting universities and research institutes with ransomware, leaving staff and students without the ability to work.

multidisciplinary sciences
Cyber Security Threats and Countermeasures in Digital Age

DOI: https://doi.org/10.54060/a2zjournals.jase.42

2024-01-01

Abstract:Due to the quick development of technology, the digital age has brought with it ad-vantages never before seen, but it has also opened the door to a flood of new cyber security concerns. This study offers detailed analysis of the cyber threat environment in the digital era along with suggestions for doable protective measures. The report outlines a number of cyber threats, including malware, phishing scams, ransomware, and insider threats. It looks at the continually evolving tactics employed by cyber-criminals, such as social engineering, zero-day flaws, and sophisticated persistent threats. The growing hazards associated with cutting-edge technology, such as the Internet of Things (IoT), cloud computing, and artificial intelligence, are also exam-ined. The importance of a multi-layered security strategy to counter these attacks is emphasized in the article. Among the important preventative measures that are presented are robust network security, secure coding methodologies, user awareness training, encryption, access controls, and incident response planning. It also high-lights how crucial it is for people, businesses, and governments to collaborate in or-der to confront cyber risks. By using the recommended solutions and promoting a culture of cyber security awareness, people and organizations may navigate the dig-ital age with confidence and protect themselves from the continuously evolving environment of cyber risks.
SoK: Safer Digital-Safety Research Involving At-Risk Users

Rosanna Bellini,Emily Tseng,Noel Warford,Alaa Daffalla,Tara Matthews,Sunny Consolvo,Jill Palzkill Woelfer,Patrick Gage Kelley,Michelle L. Mazurek,Dana Cuomo,Nicola Dell,Thomas Ristenpart

DOI: https://doi.org/10.48550/arXiv.2309.00735

2023-09-02

Abstract:Research involving at-risk users -- that is, users who are more likely to experience a digital attack or to be disproportionately affected when harm from such an attack occurs -- can pose significant safety challenges to both users and researchers. Nevertheless, pursuing research in computer security and privacy is crucial to understanding how to meet the digital-safety needs of at-risk users and to design safer technology for all. To standardize and bolster safer research involving such users, we offer an analysis of 196 academic works to elicit 14 research risks and 36 safety practices used by a growing community of researchers. We pair this inconsistent set of reported safety practices with oral histories from 12 domain experts to contribute scaffolded and consolidated pragmatic guidance that researchers can use to plan, execute, and share safer digital-safety research involving at-risk users. We conclude by suggesting areas for future research regarding the reporting, study, and funding of at-risk user research

Computers and Society,Cryptography and Security,Human-Computer Interaction
Reviewing Cyber Security Social Engineering Training and Awareness Programs—Pitfalls and Ongoing Issues

Hussain Aldawood,Geoffrey Skinner

DOI: https://doi.org/10.3390/fi11030073

2019-03-18

Future Internet

Abstract:The idea and perception of good cyber security protection remains at the forefront of many organizations’ information and communication technology strategy and investment. However, delving deeper into the details of its implementation reveals that organizations’ human capital cyber security knowledge bases are very low. In particular, the lack of social engineering awareness is a concern in the context of human cyber security risks. This study highlights pitfalls and ongoing issues that organizations encounter in the process of developing the human knowledge to protect from social engineering attacks. A detailed literature review is provided to support these arguments with analysis of contemporary approaches. The findings show that despite state-of-the-art cyber security preparations and trained personnel, hackers are still successful in their malicious acts of stealing sensitive information that is crucial to organizations. The factors influencing users’ proficiency in threat detection and mitigation have been identified as business environmental, social, political, constitutional, organizational, economical, and personal. Challenges with respect to both traditional and modern tools have been analyzed to suggest the need for profiling at-risk employees (including new hires) and developing training programs at each level of the hierarchy to ensure that the hackers do not succeed.
UNIVERSITY CYBER SECURITY AS A METHOD FOR ANTI-FISHING FRAUD

Irina Tatomur

DOI: https://doi.org/10.36742/2410-0919-2020-1-7

2020-03-01

The economic discourse

Abstract:Introduction. With the rapid adoption of computer and networking technologies, educational institutions pay insufficient attention to the implementation of security measures to ensure the confidentiality, integrity and accessibility of data, and thus fall prey to cyber-attacks. Methods. The following methods were used in the process of writing the article: methods of generalization, analogy and logical analysis to determine and structure the motives for phishing attacks, ways to detect and prevent them; statistical analysis of data – to build a chronological sample of the world's largest cyber incidents and determine the economic losses suffered by educational institutions; graphical method – for visual presentation of results; abstraction and generalization – to make recommendations that would help reduce the number of cyber scams. Results. The article shows what role cyber security plays in counteracting phishing scams in the educational field. The motives for the implementation of phishing attacks, as well as methods for detecting and preventing them, have been identified and regulated. The following notions as "phishing", "submarine" and "whaling" are evaluated as the most dangerous types of fraud, targeting both small and large players in the information chain of any educational institution. An analytical review of the educational services market was conducted and a chronological sampling of the largest cyber incidents that occurred in the period 2010-2019 was made. The economic losses incurred by colleges, research institutions and leading universities in the world were described. It has been proven that the US and UK educational institutions have been the most attacked by attackers, somewhat inferior to Canada and countries in the Asia-Pacific region. It is found that education has become the top industry in terms of the number of Trojans detected on devices belonging to educational institutions and the second most listed among the most affected by the ransomware. A number of measures have been proposed to help reduce the number of cyber incidents. Discussion. The obtained results should be taken into account when formulating a strategy for the development of educational institutions, as well as raising the level of awareness of the representatives of the academic community in cybersecurity. Keywords: phishing, cyber security, cyber stalkers, insider threat, rootkit, backdoor.
Cyber Security; Etiology and Importance

DOI: https://doi.org/10.33140/aurdp.01.01.02

2024-02-27

Abstract:Background: Cyber Security is to protect online data and software from cyber threats. These cyberattacks are typically intended to gain access to, change, or delete sensitive information; extort money from users; or disrupt regular corporate activities. It is difficult to keep up a regular follow up with new technologies, so it is necessary to keep the important data safe from cyber threats. There are many types of cyber threats, malware, ransomware, social engineering, phishing etc. To prevent cyber-attacks one can, use password manager tools like LastPass and others. People also use two factor authentication for double security on their accounts. Methods: Boards such as the National Institute of Standards and Technology (NIST) are developing frameworks to assist firms in understanding their security risks, improving cybersecurity procedures, and preventing cyber assaults. The fight against cybercrimes and attack, organizations needed a strong base there are 5 types of cyber securities: Critical Infrastructure Security, application security, network security, cloud security and (IoT) Security. In the modern time the US is highly based on computers and on different software, so it is really important for the US to be more conscious about the security as they get many threats almost every day for hacking their data and accounts. Results and Conclusion: Nowadays, even small businesses rarely recover their loss from the cyber-attacks and many back-off from continuing their businesses after being target of hackers. The first cybercrime attack was recorded in 1988 by a graduate student. Now that large companies and even small businesses are aware of cyber-attacks, they try their best to take every precaution to prevent hacking with double security and password manager tools.
Secure Arcade: A Gamified Defense Against Cyber Attacks

Sean Loesch,Ryan Hrastich,Jordan Herbert,Ben Drangstveit,Jacob Weber,Mounika Vanamala

DOI: https://doi.org/10.48550/arXiv.2311.16131

2023-11-01

Cryptography and Security

Abstract:In modernity, we continually receive increasingly intricate technologies that allow us to increase our lives convenience and efficiency. Our technology, particularly technology available over the internet, is advancing at unprecedented speed. However, this speed of advancement allows those behind malicious attacks to have an increasingly easier time taking advantage of those who know little about computer security. Unfortunately, education in the computer security field is generally limited only to tertiary education. This research addresses this problem through a gamified web-based application that drives users to reach learning goals to help them become more vigilant internet users: 1. Learn and memorize general computer security terminology, 2. Become familiar with basic cryptography concepts, 3. Learn to recognize potential phishing scams via email quickly, and 4. Learn common attacks on servers and how to deal with them.
Mitigation Techniques for Cyber Attacks: A Systematic Mapping Study

Kashif Ishaq,Sidra Fareed

2023-08-26

Abstract:In the wake of the arrival of digital media, the Internet, the web, and online social media, a flood of new cyber security research questions have emerged. There is a lot of money being lost around the world because of cyber-attacks. As a result, cyber security has emerged as one of the world's most complex and pressing issues. Cyber security experts from both industry and academia institutions are now analyzing current cyber-attacks occurring around the world and developing various strategies to defend systems from possible cyber-threats and attacks. This paper examines recent cyber security attacks as well as the financial losses incurred as a result of the growing number of cyber-attacks. Our findings indicate that the majority of the research chosen for this study focused solely on a small number of widespread security flaws, such as malware, phishing, and denial-of-service attacks. A total of over 50 major studies that have been published in reputable academic journals and conferences have been chosen for additional examination. A taxonomy of cyber-attacks elements that is based on the context of use in various environments has also been suggested, in addition to a review of the most recent studies on countermeasures for cyber-attacks being the state of the art. Lastly, the research gaps in terms of open issues have been described in order to offer potential future directions for the researchers working in the field of cyber security.

Cryptography and Security
How to build a vulnerability benchmark to overcome cyber security attacks

Junaid Akram,Luo Ping

DOI: https://doi.org/10.1049/iet-ifs.2018.5647

2020-01-01

IET Information Security

Abstract:Cybercrimes are on a dramatic rise worldwide. The crime rate is growing day by day in every field or department which is directly or indirectly connected to the internet including Government, business or any individual. The main objective of this study is to evaluate the vulnerabilities in different software systems at the source code level by tracing their patch files. The authors have collected the source code of different types of vulnerabilities at a different level of granularities. They have proposed different ways to collect or trace the vulnerability code, which can be very helpful for security experts, organisations and software developers to maintain security measures. By following their proposed method, you can build your own vulnerability data-set and can detect vulnerabilities in any system by using suitable code clone detection technique. The study also includes a discussion of reasons for the rise in cybercrimes including zero-day exploits. A case study has been discussed with results and research questions to show the effectiveness of this study. This study concludes with the effective key findings of published and non-published vulnerabilities and the ways to prevent from different security attacks to overcome cybercrimes.
Cyber security insights into self-proclaimed virtual world hackers

Nicholas Patterson,Michael Hobbs,Frank Jiang,Lei Pan

DOI: https://doi.org/10.48550/arXiv.1908.11010

2019-08-29

Cryptography and Security

Abstract:Virtual worlds have become highly popular in recent years with reports of over a billion people accessing these environments and the virtual goods market growing to near 50 billion US dollars. An undesirable outcome to this popularity and market value is thriving criminal activity in these worlds. The most profitable cyber security problem in virtual worlds is named Virtual Property Theft. The aim of this study is to use an online survey to gain insight into how hackers (n=100) in these synthetic worlds conduct their criminal activity. This survey is the first to report an insight into the criminal mind of hackers (virtual thieves). Results showed a clear-cut profile of a virtual property thief, they appear to be mainly aged 20-24 years of age, live in the United States of America, while using virtual worlds for 5-7 hours a day. These and the other key results of this study will provide a pathway for designing an effective anti-theft framework capable of abolishing this cyber security issue.
Why it is Hard to Fight against Cyber Criminals?

Shui Yu,Wanlei Zhou,Wanchun Dou,S. Kami Makki

DOI: https://doi.org/10.1109/ICDCSW.2012.25

2012-01-01

Abstract:We are witnessing numerous cyber attacks every day, however, we do not see many cyber criminals are brought to justice. One reason is that it is technically hard to identify and trace cyber criminals. One reason for this passive situation is our limited or even inappropriate understanding of the cyber space. In this paper, we survey the challenges and opportunities in this research field for interested readers. We also list promising tools and directions based on our understanding.
Understanding Cyber Threats Against the Universities, Colleges, and Schools

Harjinder Singh Lallie,Andrew Thompson,Elzbieta Titis,Paul Stephens

DOI: https://doi.org/10.48550/arXiv.2307.07755

2023-07-15

Cryptography and Security

Abstract:Universities hold and process a vast amount of valuable user and research data. This makes them a prime target for cyber criminals. Additionally, universities and other educational settings, such as schools and college IT systems, have become a prime target for some of their own students -- often motivated by an opportunity to cause damage to networks and websites, and/or improve their grades. This paper provides a focused assessment of the current cyber security threat to universities, colleges, and schools (`the education sector') worldwide, providing chronological sequencing of attacks and highlighting the insider threat posed by students. Fifty-eight attacks were identified, with ransomware being the most common type of external attack, and hacking motivated by personal gain showing as the most common form of internal attack. Students, who have become a significant internal threat by either aiding or carrying out attacks are not a homogeneous group, as students may be motivated by different factors, therefore calling for targeted responses. Furthermore, the education sector is increasingly reliant on third party IT service providers meaning attacks on third parties can impact the university and its users. There is very little research analysing this problem, even less research analysing the problem in the context of schools. Hence this paper provides one of the first known assessment of the cyber attacks against the education sector, focusing on insider threat posed by students and offering recommendations for mitigating wider cyber threats.
Phishing and Spear Phishing: examples in Cyber Espionage and techniques to protect against them

Alessandro Ecclesie Agazzi

DOI: https://doi.org/10.48550/arXiv.2006.00577

2020-06-01

Abstract:Phishing attacks have become the most used technique in the online scams, initiating more than 91% of cyberattacks, from 2012 onwards. This study reviews how Phishing and Spear Phishing attacks are carried out by the phishers, through 5 steps which magnify the outcome, increasing the chance of success. The focus will be also given on four different layers of protection against these social engineering attacks, showing their strengths and weaknesses; the first and second layers consist of automated tools and decision-aid tools. the third one is users' knowledge and expertise to deal with potential threats. The last layer, defined as "external", will underline the importance of having a Multi-factor authentication, an effective way to provide an enhanced security, creating a further layer of protection against Phishing and Spear Phishing.

Cryptography and Security,Computers and Society
Computer Network Attack and Defense Technology

S. Zhou,Guanghui Ren,Yaling Liu,Xinyu Yang

2018-02-07

Abstract:In recent years, the Internet as a symbol of the computer network protocols, standards and application technology development is extremely rapid. But the Internet is like a sharp double-edged sword, it is for the convenience of people at the same time, but also for computer viruses and computer crime to provide the soil, for systems, network protocols and databases, whether it is its own design flaws, or due to human factors caused by a variety of security vulnerabilities, may be some of the other attempts to use hackers and attack, so the establishment of an effective network security system is even more urgent. To ensure network security, reliable, you must be familiar with the general process of hacker network attacks. The only way to do before the hacker attack the necessary precautions is to ensure that the network is safe and reliable operation. This article comprehensively analyzes the steps, methods and common attack tools of network attack, and tells the concrete precautionary measures from several aspects, so that readers have a comprehensive network of knowledge, in the treatment of network threats are well prepared.

Computer Science,Engineering
Exploitation of Human Trust, Curiosity and Ignorance by Malware

Sundar Krishnan

DOI: https://doi.org/10.48550/arXiv.2002.11805

2020-02-27

Abstract:Despite defensive advances in the Internet realm, Malware (malicious software) remains a Cybersecurity threat. These days, Malware can be purchased and licensed on the Internet to further customize and deploy. With hundreds of Malware variants discovered every day, organizations and users experience enormous financial losses as cybercriminals steal financial and user data. In this article surveys the human characteristics that are key to the defense chain against Malware. The article starts with the attack models/vectors that humans often fall prey to and their fallouts. Next, analysis of their root cause and suggest preventive measures that may be employed is detailed. The article concludes that while Internet user education, training, awareness can reduce the chances of Malware attacks,it cannot entirely eliminate them.

Cryptography and Security
A Research Ecosystem for Secure Computing

Nadya Bliss,Lawrence A. Gordon,Daniel Lopresti,Fred Schneider,Suresh Venkatasubramanian

DOI: https://doi.org/10.48550/arXiv.2101.01264

2021-01-04

Computers and Society

Abstract:Computing devices are vital to all areas of modern life and permeate every aspect of our society. The ubiquity of computing and our reliance on it has been accelerated and amplified by the COVID-19 pandemic. From education to work environments to healthcare to defense to entertainment - it is hard to imagine a segment of modern life that is not touched by computing. The security of computers, systems, and applications has been an active area of research in computer science for decades. However, with the confluence of both the scale of interconnected systems and increased adoption of artificial intelligence, there are many research challenges the community must face so that our society can continue to benefit and risks are minimized, not multiplied. Those challenges range from security and trust of the information ecosystem to adversarial artificial intelligence and machine learning. Along with basic research challenges, more often than not, securing a system happens after the design or even deployment, meaning the security community is routinely playing catch-up and attempting to patch vulnerabilities that could be exploited any minute. While security measures such as encryption and authentication have been widely adopted, questions of security tend to be secondary to application capability. There needs to be a sea-change in the way we approach this critically important aspect of the problem: new incentives and education are at the core of this change. Now is the time to refocus research community efforts on developing interconnected technologies with security "baked in by design" and creating an ecosystem that ensures adoption of promising research developments. To realize this vision, two additional elements of the ecosystem are necessary - proper incentive structures for adoption and an educated citizenry that is well versed in vulnerabilities and risks.
Principles of Security: Human, Cyber, and Biological

Blake C. Stacey,Yaneer Bar-Yam

DOI: https://doi.org/10.48550/arXiv.1303.2682

2013-03-11

Cryptography and Security

Abstract:Cybersecurity attacks are a major and increasing burden to economic and social systems globally. Here we analyze the principles of security in different domains and demonstrate an architectural flaw in current cybersecurity. Cybersecurity is inherently weak because it is missing the ability to defend the overall system instead of individual computers. The current architecture enables all nodes in the computer network to communicate transparently with one another, so security would require protecting every computer in the network from all possible attacks. In contrast, other systems depend on system-wide protections. In providing conventional security, police patrol neighborhoods and the military secures borders, rather than defending each individual household. Likewise, in biology, the immune system provides security against viruses and bacteria using primarily action at the skin, membranes, and blood, rather than requiring each cell to defend itself. We propose applying these same principles to address the cybersecurity challenge. This will require: (a) Enabling pervasive distribution of self-propagating securityware and creating a developer community for such securityware, and (b) Modifying the protocols of internet routers to accommodate adaptive security software that would regulate internet traffic. The analysis of the immune system architecture provides many other principles that should be applied to cybersecurity. Among these principles is a careful interplay of detection and action that includes evolutionary improvement. However, achieving significant security gains by applying these principles depends strongly on remedying the underlying architectural limitations.
Emerging Threats in Cyberspace: Implications for National Security Policy and Healthcare Sector

Stephanie Ness,Tushar Khinvasara

DOI: https://doi.org/10.9734/jerr/2024/v26i21075

2024-01-29

Journal of Engineering Research and Reports

Abstract:Currently, the majority of economic, commercial, cultural, social, and governmental activity and contacts between countries, encompassing individuals, non-governmental organizations, and government institutions, occur in the virtual realm known as cyberspace. In recent times, numerous private enterprises and governmental institutions worldwide have encountered the issue of cyber- attacks and the peril associated with wireless communication technology. The modern society heavily relies on electronic technology, and safeguarding this data from cyber-attacks poses a formidable challenge. Cyber-attacks are intended to inflict financial harm onto companies. Cyber- attacks may serve military or political objectives in certain instances. Some examples of these damages include PC infections, knowledge breaches, data distribution service (DDS), and other attack routes. For this purpose, different companies employ diverse strategies to mitigate the harm caused by cyber-attacks. Cybersecurity monitors up-to-date information on the most recent IT data. Researchers worldwide have proposed several techniques to prevent cyber-attacks or mitigate their impact. Several approaches are currently in the operational phase, while others are still in the study phase. The objective of this study is to conduct a thorough examination and evaluation of the latest advancements in the field of cyber security, with the purpose of identifying and analyzing the problems, vulnerabilities, and strengths of the proposed methodologies. A comprehensive analysis is conducted on several forms of novel descendant attacks. The discussion revolves around conventional security frameworks, encompassing their historical context and early-generation approaches to cyber-security. Furthermore, this report presents the latest advancements and developing patterns in the field of cyber security, as well as the current problems and risks to security. The comprehensive review study offered for IT and cyber security researchers is anticipated to be beneficial.
A Human Dimension of Hacking: Social Engineering through Social Media

Heidi Wilcox,Maumita Bhattacharya

DOI: https://doi.org/10.48550/arXiv.2005.04049

2020-05-08

Cryptography and Security

Abstract:Social engineering through social media channels targeting organizational employees is emerging as one of the most challenging information security threats. Social engineering defies traditional security efforts due to the method of attack relying on human naivet\'e or error. The vast amount of information now made available to social engineers through online social networks is facilitating methods of attack which rely on some form of human error to enable infiltration into company networks. While, paramount to organisational information security objectives is the introduction of relevant comprehensive policy and guideline, perspectives and practices vary from global region to region. This paper identifies such regional variations and then presents a detailed investigation on information security outlooks and practices, surrounding social media, in Australian organisations (both public and private). Results detected disparate views and practices, suggesting further work is needed to achieve effective protection against security threats arsing due to social media adoption.
Hack technology and detection of online games

LUO Ping,XU Qian-hua

DOI: https://doi.org/10.3969/j.issn.1000-7024.2007.06.011

2007-01-01

Abstract:Online games are becoming more and more commercial,meanwhile,more rogue game hacks are emerging on various game sites,hacks bring a lot of endangerment to the society.Besides early technique,like mouse-keyboard simulating and speed gear,some new high-techniques are applied in game hacks,for instance,intercepting winsock,intercepting API,hook,modifying the memory.Until now nobody has come up with a viable generalized solution to this problem.There are many versatile methods of evading hack de-tection,it is necessary to carry on a thorough analysis about these mechanisms and raise a few comprehensive and effective counterme-asures of detecting hacks.

So ... you've been hacked

Cyberattacks are hitting research institutions — with devastating effects

Cyber Security Threats and Countermeasures in Digital Age

SoK: Safer Digital-Safety Research Involving At-Risk Users

Reviewing Cyber Security Social Engineering Training and Awareness Programs—Pitfalls and Ongoing Issues

UNIVERSITY CYBER SECURITY AS A METHOD FOR ANTI-FISHING FRAUD

Cyber Security; Etiology and Importance

Secure Arcade: A Gamified Defense Against Cyber Attacks

Mitigation Techniques for Cyber Attacks: A Systematic Mapping Study

How to build a vulnerability benchmark to overcome cyber security attacks

Cyber security insights into self-proclaimed virtual world hackers

Why it is Hard to Fight against Cyber Criminals?

Understanding Cyber Threats Against the Universities, Colleges, and Schools

Phishing and Spear Phishing: examples in Cyber Espionage and techniques to protect against them

Computer Network Attack and Defense Technology

Exploitation of Human Trust, Curiosity and Ignorance by Malware

A Research Ecosystem for Secure Computing

Principles of Security: Human, Cyber, and Biological

Emerging Threats in Cyberspace: Implications for National Security Policy and Healthcare Sector

A Human Dimension of Hacking: Social Engineering through Social Media

Hack technology and detection of online games