4.2Threats and Attack Techniques (Malware, Web Application Attacks, Social Engineering)

Choosing the right countermeasure starts with identifying what an attack technique actually exploits. Malware exploits software vulnerabilities or careless execution, web application attacks exploit flaws in an app's input handling, and social engineering exploits human psychology and habits. Because the exploited target differs, so does the effective countermeasure—this section organizes representative attack techniques around what each one exploits.

4.2.1Malware and targeted attacks

• A virus parasitizes another program file, self-replicating and spreading as the host program is executed. A worm self-replicates as a standalone program, spreading autonomously across a network to other machines without needing a host. A Trojan horse disguises itself as a harmless program to get in, and performs malicious actions such as installing a backdoor without self-replicating.
• Ransomware encrypts or otherwise disables a victim's files and demands payment in exchange for restoring access. Spyware covertly collects personal information or usage history and transmits it externally without the user noticing. For both, cutting off the infection vector (email attachments, malicious sites, USB drives, etc.) is an effective countermeasure.
• A targeted attack aims at a specific organization or individual, using emails disguised as work-related to trick the recipient into opening a malicious file. Compared with older attacks aimed at unspecified many, it is harder to detect and tends to cause prolonged damage. Phishing uses fake sites or emails impersonating a legitimate organization to trick victims into giving up credentials; verifying URL/domain authenticity is an effective countermeasure.

4.2.2Web app attacks, DoS, man-in-the-middle, and password attacks

• SQL injection injects malicious SQL into an input field to manipulate or read a database improperly; the countermeasure is using prepared statements (parameter binding) and escaping input values. XSS (cross-site scripting) injects malicious script into a web page so it runs in a viewer's browser; the countermeasure is sanitizing/escaping input values.
• CSRF (cross-site request forgery) tricks a logged-in user's browser into sending an unintended request through another site (e.g., opening a trap site silently triggers a money transfer under the victim's authority). The countermeasure is a one-time token embedded in the form and verified on submission. Distinguish XSS ("injecting a malicious script") from CSRF ("forging a request that abuses the user's authority").
• A DoS attack exhausts a target server's capacity with a flood of requests or abnormal traffic, rendering the service unavailable. A DDoS attack launches a DoS attack from many distributed machines (often a malware-infected botnet), making countermeasures such as blocking a source IP much harder. A man-in-the-middle (MITM) attack impersonates a communication party and intercepts traffic to eavesdrop or tamper with it; the countermeasure is encrypting communications (e.g. TLS) with certificate verification.
• Password attacks: a brute-force attack tries every possible combination; a dictionary attack tries dictionary words or known weak passwords; a password-list attack exploits credentials reused across services, leaked from a different breach (password reuse is the core weakness it targets). Countermeasures are account lockout, multi-factor authentication, and prohibiting password reuse.

Trace a case where an e-commerce site suffers several attacks in succession, to see how to distinguish each technique. First, if entering a string like ' OR '1'='1 into the product search box leaks the entire product catalog, the search logic embedded the raw input directly into a SQL statement — this is SQL injection, and the root-cause fix is adopting prepared statements (parameter binding) so input is never interpreted as part of the SQL. Next, if a script posted in a product review runs in other visitors' browsers and steals their cookies, the review display logic output raw input directly as HTML — this is XSS, and the fix is sanitizing/escaping tags like <script> at display time. Further, if a logged-in member's delivery address changes unexpectedly after merely visiting a malicious site, a legitimate-looking request was forged by abusing the logged-in member's authority — this is CSRF, and the fix is verifying a one-time token that changes on every form submission, checked server-side. Finally, if the entire site suddenly stops responding and investigation reveals massive simultaneous traffic from countless IP addresses worldwide, this is a DDoS attack driven by a botnet; blocking a single IP cannot stop it, so distributing and filtering traffic via a CDN or WAF is the realistic countermeasure. The core insight of this area is that even though these are all "attacks on a website," the mechanism exploited — and therefore the fix — differs completely each time.

4.2.3Section summary

• Virus = parasitic; worm = self-replicating standalone; Trojan horse = no self-replication. Ransomware and spyware are distinguished by their goal
• SQL injection defended by prepared statements; XSS by sanitizing; CSRF by one-time tokens
• DDoS = a distributed DoS via a botnet. Password-list attacks exploit password reuse; multi-factor authentication is the countermeasure