What Is Spyware - ALL Spyware Definition in One Place

Total Page:16

File Type:pdf, Size:1020Kb

What Is Spyware - ALL Spyware Definition in One Place What is Spyware - ALL Spyware definition in one place Adware Adware is any type of advertising-supported software that will play, display, or download advertisements automatically on a user's computer once the software has been installed on it or while the application is in use. Some adware can also be spyware due to its privacy-invasive characteristics. BackDoor A backdoor in a computer system (or cryptosystem or algorithm) is a means of circumventing regular authentication, securing remote computer access, accessing plaintext, etc., while remaining to be undetected. A backdoor may appear to be an installed program or a modification to a program or hardware device that's already installed. Baiting Baiting uses tangible media and relies on the curiosity or greed of the victim. Baiting involves an attacker leaving a malware infected media such as a CD ROM or USB flash drive in a public place where it is likely to be found, appearing to be legitimate and appealing, and waits to be used by the victim. Baiting is easy to perform as in this example where an attacker might create a malware loaded CD with a company logo on it, and the words "Company Reorganization Plan" on the front. The media is left on the lobby floor of the targeted company. An employee could find it and then insert it into a computer to satisfy their curiosity. By inserting the CD into a computer to view its contents, the user unknowingly installs malware on it, allowing the attacker access to his computer and possibly, the company's computer network. If there is no mechanism to block the malware, then computers set to "auto-run" inserted media could be immediately compromised when the CD is inserted. Botnet Botnet is a collection of software robots, or bots, that are automatic and self- directed. Botnet is often associated with malware but can refer to the network of computers using distributed computing software. Botnet generally refers to a group of compromised computers called zombie computers running software that is usually installed via worms, trojans or backdoors, under a common command-and-control infrastructure. Browser plugin A browser plugin is a software program that extends the capabilities of your Internet browser in a specific way. Not all browser plugins are harmful and some may be helpful. This category contains mostly dubious browser plugins such as "Search Assistant", toolbars, etc. that have been known to transmit user data to their creators or have been installed using covert means. Commercial network A commercial network management tool is mostly used in (large) corporations. It can log the network traffic passively (sniffing) or examine the logs of proxies, etc. Nothing is installed on the individual computers, the software runs on a central server. They can only log items that pass through the network, but not local items such as the entered passwords, keystrokes or screenshots. Crimeware Crimeware is a distinct type of malware designed to automate financial crime by performing identity theft to access online accounts of users at financial institutions and online retailers for the express purpose of stealing funds from those accounts or performing unauthorized transactions to the benefit of the thief controlling the crimeware. Crimeware is often used to export private information from a network for financial exploitation. Crimeware is viewed as a growing concern in network security as this type of threat seeks to steal confidential information. Computer virus A computer virus is computer software that has the ability to replicate itself and infect a computer without the informed consent or knowledge of the computer user. Certain malware, adware and spyware have been incorrectly termed as a “virus” because they lack the ability to copy themselves. A real virus spreads from one system to another through an executable code when its host is transferred to a target computer; such as being sent over a network or the Internet, email or transported via removable media such as a CD, DVD or USB drive. Infected files residing in a network file system or any instance where a computer can be accessed by another one increases the chances of spreading a virus infection. The term "computer virus" is considered to be malware, a much broader term which also encompasses several types of malicious software including worms, trojans, and others. Although technically different, viruses are often confused with computer worms and trojans. Unlike a virus, a worm can take advantage of security holes in order to spread itself among other systems, while a trojan appears to be harmless but has an underlying plan. A worm, trojan or virus, once executed, can endanger a computer’s data, operation, or network ability. User awareness of some computer viruses and other malware may be readily apparent while many other types go unnoticed. The increasing number of computers being connected to local area networks and the Internet is creating an environment for computer viruses to spread. Increased use of email and instant messaging are additional ways computer viruses spread. Computer worm A computer worm is a self-replicating computer program that sends copies of itself within a computer network and it can do so without any involvement by the user. A worm doesn’t need to attach itself to an existing program in order to spread. Worms typically cause some harm to the network, most notably by consuming bandwidth. Data miner A data miner's primary function is to gather data about an end user. Some adware applications may employ data mining abilities. Email bomb An email bomb is a form of network abuse by sending enormous amounts of emails to an address in an attempt to overflow the mailbox or overwhelm the mail server where the email address is hosted in what is called a denial-of-service attack. Email spoofing Email spoofing is a fraudulent email activity in which parts of the email header and the sender address are modified, appearing as if the email was sent from another source. This technique is commonly used for spamming and phishing to conceal the origin of an email message. By altering certain properties of the email header, such as the From, Return-Path and Reply-To fields, fraudulent users can make the email appear to have been sent from someone other than the real sender. Sometimes the source of the spam email is indicated in the Reply-To field. If the initial email is replied to, it will be delivered to the address specified in the Reply-To field, which might be the spammer's address. But most spam emails, especially malevolent ones carrying a trojan or virus, or those advertising a website, falsify this email address, sending the reply to another potential victim. Exploit An exploit is a portion of software, data, or string of commands that take advantage of a computer bug, glitch or vulnerability disrupting normal behavior on computer software, hardware or other electronic device. Usually this includes seizing control of a user's computer system or attacks that allow privilege escalation or a denial of service. Fast flux Fast flux, DNS technique, is used by botnets to conceal phishing and malware distribution sites behind a continuously changing network of compromised host systems utilized as proxies. Fast flux can also refer to a combined peer-to-peer network, distributed command and control, web-based load balancing and proxy redirection to make malware networks less detectable and more resistant to counter-measures. Fast flux may be seen by Internet users in phishing attacks linked to crime organizations, including attacks on social networks. Fraudulent dialers Dialers are used to connect computers to the Internet but fraudulent dialers are designed to connect to premium-rate numbers. Fraudulent dialers are often installed through security holes in a computer's operating system and will change the computer settings to dial up through the premium-rate number. The additional monies are collected by the provider of the fraudulent number. Some dialers inform the user of benefits for using the special number to access special content which is usually illegal materials or downloads. Users that have DSLs or other broadband connections are usually not affected since a dial is dependent on regular phone lines. But, if an ISDN adapter or additional analog modem is installed, the dialer may be able to connect. Malicious dialers can be identified by: A download popup opens when a website is opening. The website may or may not discreetly display a price. The download initiates even if the cancel button has been clicked. Without any notice, the dialer installs as a default connection. The dialer perpetuates unwanted connections without any user action. No notice about the price is presentedbefore dialing in. While connected, the high price of the connection is not shown. The dialer cannot be easily uninstalled if at all. Hacker A hacker is a someone who breaks into computers. A hacker subculture has evolved and is often referred to as the computer underground. Hackers proclaim to be motivated by artistic and political ends, and apparently have no concern in using criminal means to accomplish them. A hacker could also be unrelated to computer security, such as a computer programmer or home computer hobbyists. Hijacker Hijacker is an application that attempts to take control of the user's homepage and replace it with one that the hijacker chooses. It is a low security threat, but is annoying. Most hijackers use stealth techniques or trick dialog boxes to perform installation. Browser hijackers commonly do one or more of the following: Change your "search" page and passes all searches to a pay-per-search site Change your default home page to the company page.
Recommended publications
  • Tutorial Blogspot Plus Blogger Templates
    Tutorial Blogspot Plus Blogger Templates To Bloggers Everywhere 1 2 Contents Contact Us 25 Cara daftar Gmail 25 Cara daftar Blogger pertama kali 27 Cara login ke blogger pertama kali 28 Kontrol panel blogger (dashboard) 29 Cara posting di blogger 30 Halaman Pengaturan (menu dasar) 31 Banyak malware yang ditemukan google 32 Google ! Mesin pembobol yang menakutkan 32 Web Proxy (Anonymous) 33 Daftar alamat google lengkap 34 Google: tampil berdasarkan Link 37 Oom - Pemenang kontes programming VB6 source code 38 (www.planet-sourc... Oom - Keyboard Diagnostic 2002 (VB6 - Open Source) 39 Oom - Access Siemens GSM CellPhone With Full 40 AT+Command (VB6 - Ope... Oom - How to know speed form access (VB6) 40 Para blogger haus akan link blog 41 Nama blog cantik yang disia-siakan dan apakah pantas nama 41 blog dipe... Otomatisasi firewalling IP dan MAC Address dengan bash script 43 Firewalling IP Address dan MAC Address dengan iptables 44 Meminimalis serangan Denial of Service Attacks di Win Y2K/XP 47 Capek banget hari ini.. 48 3 daftar blog ke search engine 48 Etika dan cara promosi blog 49 Tool posting dan edit text blogger 52 Setting Blog : Tab Publikasi 53 Wordpress plugins untuk google adsense 54 Google meluncurkan pemanggilan META tag terbaru 54 “unavailable after” Setting Blog : Tab Format 55 Melacak posisi keyword di Yahoo 56 Mengetahui page ranking dan posisi keyword (kata kunci) anda 56 pada S... Percantik halaman blog programmer dengan "New Code 57 Scrolling Ticke... 20 Terbaik Situs Visual Basic 58 BEST BUY : 11 CD Full Source Code Untuk Programmer 60 Tips memulai blog untuk pemula 62 Lijit: Alternatif search untuk blogger 62 Berpartisipasi dalam Blog "17 Agustus Indonesia MERDEKA" 63 Trafik di blog lumayan, tapi kenapa masih aja minim komentar? 64 Editor posting compose blogger ternyata tidak "wysiwyg" 65 Google anti jual beli link 65 Tips blogger css validator menggunakan "JavaScript Console" 65 pada Fl..
    [Show full text]
  • Electronic Mail Haibo Zhang Computer Science, University of Otago
    COSC301 Network Management and Security Lecture 14: Electronic Mail Haibo Zhang Computer Science, University of Otago COSC301 Lecture 14: Electronic Mail 1 Today’s Focus Electronic Mail -- How does it work? -- How to manage it? -- How to ensure security & privacy? COSC301 Lecture 14: Electronic Mail 2 What is an email? • A formatted file in ASCII code • Consists of Mail From: [email protected] • Envelope RCPT To: [email protected] envelope • Header From: Haibo Zhang To: Zhiyi Huang Date: 01/01/2015 header • Body Subject: Meeting Dear Zhiyi, Could we have a meeting on this Friday? body Cheers, Haibo COSC301 Lecture 14: Electronic Mail 3 Components in Email Architecture • User Agent (UA) – For users to compose, send, and browse emails – pine, Mail, ThunderBird • Mail Transport Agent (MTA) – Emails are handed to it for delivery – sendmail, exim • Mail Access Agent (MAA) – Retrieve message from mailbox COSC301 Lecture 14: Electronic Mail 4 Email Architecture User mail app User Agent local host host local Agent mail app MTA sendmail sendmail MTA MTA MTA server server relay Internet relay MTA MTA Mail server Mail server COSC301 Lecture 14: Electronic Mail 5 Email Protocols • SMTP (Simple Mail Transfer Protocol) – Email delivery protocol between two MTAs – Used twice: between the sender and the sender’s mail server and between the two mail servers • Mail fetching protocols – Between the receiver and its mail server – Post Office Protocol (POP): simple but limited in functionality – Internet Mail Access Protocol (IMAP): more features, more
    [Show full text]
  • F-1 Attachment F ACCESSING the FCC NETWORK USING WINDOWS
    Attachment F ACCESSING THE FCC NETWORK USING WINDOWS 3.1 OR 3.11 This attachment describes how to access the FCC Network from a system that is running the Microsoft Windows 3.1 or Windows for Workgroups 3.11 operating system. This involves using the FCC-supplied Point-to-Point Protocol (PPP) Dialer. This attachment summarizes the hardware and software required for the PPP Dialer, then describes the procedures for performing the following tasks: C Downloading the Dialer files from the Internet or the FCC Bulletin Board C Extracting the Dialer from the downloaded files C Installing the Dialer application C Configuring PPP C Establishing a PPP connection The attachment also describes how to troubleshoot and uninstall the PPP Dialer application, and tells how to get help from the FCC. Conventions The instructions in this attachment use the following typographical conventions: bold Represents objects on the screen that you click with the mouse pointer, including buttons, Internet links, icons, tabs, menu items (e.g., Cancel button, Auctions link, Save option in the File menu). italic Represents field names or areas of a screen (e.g., Licensee Name field, Applicant Information area of a screen). bold italic Represents characters that you must type exactly as they appear in the instructions. For example, if you are instructed to type http://www.fcc.gov, you should type all of the characters shown in bold italic exactly as they are printed. SMALL CAPS Represents keys on the keyboard (e.g., ENTER, CTRL, ESC). F-1 Hardware and Software Requirements Applicants who want to connect to the FCC Network using the FCC PPP Dialer will need the following hardware and software.
    [Show full text]
  • Interaction Dialer Installation and Configuration Guide
    Interaction Dialer Installation and Configuration Guide 2018 R4 Last updated June 6, 2018 (See Change Log for summary of changes.) Abstract This document explains how to install Interaction Dialer. Interaction Dialer is a set of client/server extensions that add predictive dialing and campaign management capabilities to the PureConnect platform. iii Copyright and Trademark Information Interactive Intelligence, Interactive Intelligence Customer Interaction Center, Interaction Administrator, Interaction Attendant, Interaction Client, Interaction Designer, Interaction Tracker, Interaction Recorder, Interaction Mobile Office, Interaction Center Platform, Interaction Monitor, Interaction Optimizer, and the “Spirograph” logo design are registered trademarks of Genesys Telecommunications Laboratories, Inc. Customer Interaction Center, EIC, Interaction Fax Viewer, Interaction Server, ION, Interaction Voicemail Player, Interactive Update, Interaction Supervisor, Interaction Migrator, and Interaction Screen Recorder are trademarks of Genesys Telecommunications Laboratories, Inc. The foregoing products are ©1997-2017 Genesys Telecommunications Laboratories, Inc. All rights reserved. Interaction Dialer and Interaction Scripter are registered trademarks of Genesys Telecommunications Laboratories, Inc. The foregoing products are ©2000-2017 Genesys Telecommunications Laboratories, Inc. All rights reserved. Messaging Interaction Center and MIC are trademarks of Genesys Telecommunications Laboratories, Inc. The foreg oing p rodu cts are ©2001-2017 Genesys
    [Show full text]
  • System Center Endpoint Protection for Mac
    System Center Endpoint Protection for Mac Installation Manual and User Guide Contents Context menu 19 System Center Endpoint Protection 3 System requirements 3 Advanced user 20 Import and export settings 20 Installation 4 Import settings 20 Typical installation 4 Export settings 20 Proxy server setup 20 Custom installation 4 Removable media blocking 20 Uninstallation 5 21 Beginners guide 6 Glossary Types of infiltrations 21 User interface 6 Viruses 21 Checking operation of the system 6 Worms 21 What to do if the program does not work properly 7 Trojan horses 21 Work with System Center Endpoint Adware 22 Spyware 22 Protection 8 Potentially unsafe applications 22 Antivirus and antispyware protection 8 Potentially unwanted applications 22 Real-time file system protection 8 Real-time Protection setup 8 Scan on (Event triggered scanning) 8 Advanced scan options 8 Exclusions from scanning 8 When to modify Real-time protection configuration 9 Checking Real-time protection 9 What to do if Real-time protection does not work 9 On-demand computer scan 10 Type of scan 10 Smart scan 10 Custom scan 11 Scan targets 11 Scan profiles 11 Engine parameters setup 12 Objects 12 Options 12 Cleaning 13 Extensions 13 Limits 13 Others 13 An infiltration is detected 14 Updating the program 14 Update setup 15 How to create update tasks 15 Upgrading to a new build 15 Scheduler 16 Purpose of scheduling tasks 16 Creating new tasks 16 Creating user-defined task 17 Quarantine 17 Quarantining files 17 Restoring from Quarantine 17 Log files 18 Log maintenance 18 Log filtering 18 User interface 18 Alerts and notifications 19 Alerts and notifications advanced setup 19 Privileges 19 System Center Endpoint Protection As the popularity of Unix-based operating systems increases, malware authors are developing more threats to target Mac users.
    [Show full text]
  • Recommended Practice for Securing Control Systems Modems
    Recommended Practice for Securing Control System Modems January 2008 ABSTRACT This paper addresses an often overlooked “backdoor” into critical infrastructure control systems created by modem connections. A modem’s connection to the public telephone system is similar to a corporate network connection to the Internet. By tracing typical attack paths into the system, this paper provides the reader with an analysis of the problem and then guides the reader through methods to evaluate existing modem security. Following the analysis, a series of methods for securing modems is provided. These methods are correlated to well-known networking security methods. iii ACKNOWLEDGEMENT This document was developed for the U.S. Department of Homeland Security to provide guidance for modem security for control systems. The author team consisted of subject matter expertise from the Idaho National Laboratory (James Davidson & Jason Wright) For additional information or comments, please send inquires to the Control Systems Security Program at [email protected]. iv CONTENTS ABSTRACT.................................................................................................................................................iii ACKNOWLEDGEMENT ........................................................................................................................... iv ACRONYMS..............................................................................................................................................vii 1. INTRODUCTION.............................................................................................................................
    [Show full text]
  • Cybercrime and Cyber-Security Issues Associated with China: Some Economic and Institutional Considerations
    Cybercrime and Cyber-security Issues Associated with China: Some Economic and Institutional Considerations By: Nir Kshetri Kshetri, Nir (2013). “Cybercrime and Cyber-security Issues Associated with China: Some Economic and Institutional Considerations" Electronic Commerce Research 13 (1): 41-69. The original publication is available at: http://link.springer.com/article/10.1007%2Fs10660-013-9105-4 ***Reprinted with permission. No further reproduction is authorized without written permission from Springer Verlag. This version of the document is not the version of record. Figures and/or pictures may be missing from this format of the document. *** Abstract: China is linked to cybercrimes of diverse types, scales, motivations and objectives. The Chinese cyberspace thus provides an interesting setting for the study of cybercrimes. In this paper, we first develop typology, classification and characterization of cybercrimes associated with China, which would help us understand modus operandi, structures, profiles and personal characteristics of cybercrime organizations and potential perpetrators, the signature aspects and goals of cybercrimes, the nature and backgrounds of the criminal groups involved, characteristics of potential targets for criminal activities, the nature and extent of the damage inflicted on the victims and the implications to and responses elicited from various actors. We then examine this issue from developmental and international political economy angles. Specifically, we delineate salient features of China’s politics, culture, human capital and technological issues from the standpoint of cyber-security and analyze emerging international relations and international trade issues associated with this phenomenon. Our analysis indicates that China’s global ambition, the shift in the base of regime legitimacy from MarxLeninism to economic growth, the strong state and weak civil society explain the distinctive pattern of the country’s cyber-attack and cyber- security landscapes.
    [Show full text]
  • The Dark Side of Email 1
    Risky Business: The Dark Side of Email 1 Praxonomy e-Book Risky Business: The Dark Side of Email Why Email Is More Dangerous Than Ever For Boards Risky Business: The Dark Side of Email 2 TABLE OF CONTENTS Introduction 3 Chapter 1: Why Is Email The “Weapon of Choice”? 4 Chapter 2: Put Your Walls Up 6 Chapter 3: Playing Defense: Strong Email Hygiene 17 Conclusion 23 Sources 24 Risky Business: The Dark Side of Email 3 INTRODUCTION On August 14, 2019, an unsuspecting professional of Toyota Boshoku, a car components manufacturer member of the Toyota Group, received a vendor invoice requesting payment via email. With sufficient reason to believe it was a valid request, the transfer of funds (USD $37 million in total) was executed. By the time it was discovered that it was fraudulent, it was too late. The financial loss was significant enough for Toyota to issue a statement that it would “disclose amendments to its March 2020 earnings forecast documents, if necessary.” This subsidiary fell victim to a BEC (or Business Email Compromise) attack. It’s a scam that involves deceiving one or more employees of an organisation with the purpose of having these individuals transfer funds to the criminal’s bank account. A common scenario is to hijack a business email account and pretend that the request comes from a trusted business partner — or a high-level executive — to obtain credibility and the victim’s trust. This highly-publicised incident emphasises the need to remain vigilant over email use — even if you don’t believe it could possibly happen to you or your organisation.
    [Show full text]
  • Cybercrime Presentation
    Cybercrime ‐ Marshall Area Chamber of October 10, 2017 Commerce CYBERCRIME Marshall Area Chamber of Commerce October 10, 2017 ©2017 RSM US LLP. All Rights Reserved. About the Presenter Jeffrey Kline − 27 years of information technology and information security experience − Master of Science in Information Systems from Dakota State University − Technology and Management Consulting with RSM − Located in Sioux Falls, South Dakota • Rapid Assessment® • Data Storage SME • Virtual Desktop Infrastructure • Microsoft Windows Networking • Virtualization Platforms ©2017 RSM US LLP. All Rights Reserved. RSM US LLP 1 Cybercrime ‐ Marshall Area Chamber of October 10, 2017 Commerce Content - Outline • History and introduction to cybercrimes • Common types and examples of cybercrime • Social Engineering • Anatomy of the attack • What can you do to protect yourself • Closing thoughts ©2017 RSM US LLP. All Rights Reserved. INTRODUCTION TO CYBERCRIME ©2017 RSM US LLP. All Rights Reserved. RSM US LLP 2 Cybercrime ‐ Marshall Area Chamber of October 10, 2017 Commerce Cybercrime Cybercrime is any type of criminal activity that involves the use of a computer or other cyber device. − Computers used as the tool − Computers used as the target ©2017 RSM US LLP. All Rights Reserved. Long History of Cybercrime John Draper uses toy whistle from Cap’n Crunch cereal 1971 box to make free phone calls Teller at New York Dime Savings Bank uses computer to 1973 funnel $1.5 million into his personal bank account First convicted felon of a cybercrime – “Captain Zap” 1981 who broke into AT&T computers UCLA student used a PC to break into the Defense 1983 Department’s international communication system Counterfeit Access Device and Computer Fraud and 1984 Abuse Act was passed ©2017 RSM US LLP.
    [Show full text]
  • The Android Platform Security Model∗
    The Android Platform Security Model∗ RENÉ MAYRHOFER, Google and Johannes Kepler University Linz JEFFREY VANDER STOEP, Google CHAD BRUBAKER, Google NICK KRALEVICH, Google Android is the most widely deployed end-user focused operating system. With its growing set of use cases encompassing communication, navigation, media consumption, entertainment, finance, health, and access to sensors, actuators, cameras, or microphones, its underlying security model needs to address a host of practical threats in a wide variety of scenarios while being useful to non-security experts. The model needs to strike a difficult balance between security, privacy, and usability for end users, assurances for app developers, and system performance under tight hardware constraints. While many of the underlying design principles have implicitly informed the overall system architecture, access control mechanisms, and mitigation techniques, the Android security model has previously not been formally published. This paper aims to both document the abstract model and discuss its implications. Based on a definition of the threat model and Android ecosystem context in which it operates, we analyze how the different security measures in past and current Android implementations work together to mitigate these threats. There are some special cases in applying the security model, and we discuss such deliberate deviations from the abstract model. CCS Concepts: • Security and privacy → Software and application security; Domain-specific security and privacy architectures; Operating systems security; • Human-centered computing → Ubiquitous and mobile devices. Additional Key Words and Phrases: Android, security, operating system, informal model 1 INTRODUCTION Android is, at the time of this writing, the most widely deployed end-user operating system.
    [Show full text]
  • 1 the Active Directory Controls, Enforces, and Assigns Security Policies and Access Rights for All Users
    98-367 QUESTION: 1 The Active Directory controls, enforces, and assigns security policies and access rights for all users. Select the correct answer if the underlined text does not make the statement correct. Select "No change is needed" if the underlined text makes the statement correct. A. NTFS permissions B. User Account Control C. Registry D. No change is needed Answer(s): D QUESTION: 2 E-mail bombing attacks a specific entity by: A. Redirecting all e-mail to another entity B. Sending high volumes of e-mail C. Tracing e-mail to the destination address D. Triggering high levels of security alerts Answer(s): B Explanation: In Internet usage, an email bomb is a form of net abuse consisting of sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address is hosted in a denial-of-service attack. QUESTION: 3 Which two characteristics should you recommend for a user's domain password? (Choose two.) A. Hard to guess B. Includes Unicode characters C. Easy to remember D. Easy to increment Answer(s): A, C Reference: http://www.usewisdom.com/computer/passwords.html QUESTION: 4 Passwords that contain recognizable words are vulnerable to a: A. Denial of Service attack B. Hashing attack C. Dictionary attack D. Replay attack Answer(s): C https://xcerts.com 2 98-367 Explanation: A dictionary attack is a method of breaking into a password-protected computer or server by systematically entering every word in a dictionary as a password. A dictionary attack can also be used in an attempt to find the key necessary to decrypt an encrypted message or document.
    [Show full text]
  • 2007 Cyber Attacks on Estonia
    CYBER OPERATIONS IMAGE – SHUTTERSTOCK 2007 cyber attacks on Estonia NATIONS INVOLVED: Estonia, Russian Federation TIME PERIOD: April 2007 – May 2007 THEMATIC AREA: Cyber Operations EXECUTIVE SUMMARY In April and May 2007, Estonia became the target of a coordinated cyber attack. Over a three-week period, government and parliamentary portals, ministries, news outlets, internet service providers, major banks, and small businesses were all targeted, predominantly by a Distributed Denial of Service (DDoS). The cyber attack coincided with the Estonian government’s decision to relocate the ‘Bronze Soldier Memorial’ in Tallinn, which led to significant civil disturbance in both Estonia and Russia. The vast majority of malicious network traffic was of Russian-language origin and had indications of political motivation. The Russian government denied any involvement; however, the cyber attacks were accompanied by hostile political rhetoric by Russian officials, unfriendly economic measures, and refusal to cooperate with the Estonian investigation in the aftermath of the attacks, all of which likely encouraged the perpetrators. The attacks caused some disruption and economic cost to Estonia. Perhaps more importantly, though, they exposed Estonia’s vulnerabilities, and demonstrated the potential of cyber attacks to cause far more lasting damage if intended. However, the incident also demonstrated Estonia’s capabilities and resilience in countering the cyber attacks. Ultimately, the shock caused by the cyber attack led to a significant strengthening of cyber defence capabilities, institutions and legislation in Estonia, the Eu- ropean Union, and NATO. KEY POINTS Ambiguity was a key feature of this cyber attack. As the attacks were apparently carried out independently by individuals using their own resources, any state sponsor responsible for orches- trating the attack was able to disguise and deny themselves as the source.
    [Show full text]