Skip to main content

Cyber Attacks, Prevention, and Countermeasures

  • Chapter
  • First Online:
Book cover Counterterrorism and Cybersecurity

Abstract

President Barack Obama said in the 2015 State of the Union address, “No foreign nation, no hacker, should be able to shut down our networks, steal our trade secrets, or invade the privacy of American families, especially our kids. We are making sure our government integrates intelligence to combat cyber threats, just as we have done to combat terrorism.

There is no such thing as 100 percent security, on- or offline, but we must strive to strengthen our defenses against those who are constantly working to do us harm…. The alternative could be a digital Pearl Harborand another day of infamy.

— U.S. Senators Joe Lieberman , Susan Collins

and Tom Carper (July 7, 2011)

There are only two types of companies: those that have been hacked, and those that will be. Even that is merging into one category: those that have been hacked and will be again.

— FBI Director Robert Mueller

RSA conference (March 1, 2012)

The attack surfaces for adversaries to get on the Internet now include all those mobile devices. The mobile security situation lags. It’s far behind.

— Army Gen. Keith Alexander , Director of National Security Agency and Commander of U.S. Cyber Command

DEF CON 20 (July 27, 2012)

The only two products not covered by product liability are religion and software, and software should not escape for much longer.

— Dan Geer, Chief Information Security Officer of In-Q-Tel (August 6, 2014)

Overall, network security solutions haven’t evolved for the past 20-plus years.

— Mike Kail, Chief Information Officer at Yahoo! (October 22, 2014)

We are making sure our government integrates intelligence to combat cyber threats, just as we have done to combat terrorism.

— President Barack Obama in 2015 State of the Union address (January 20, 2015)

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Hardcover Book
USD 54.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Bibliography

  1. Office of the Press Secretary. Excerpts of the President’s State of the Union Address. [Online] The White House, January 20, 2015. http://www.whitehouse.gov/the-press-office/2015/01/20/excerpts-president-s-state-union-address.

  2. Schiff, et al. H.R.2290 -- Cyber-Security Enhancement Act of 2007 (Introduced in House - IH). [Online] The Library of Congress, May 14, 2007. http://thomas.loc.gov/cgi-bin/query/z?c110:H.R.2290.

  3. Ackerman, et al. H.R.7007 -- National Commission on American Cybersecurity Act of 2008. [Online] The Library of Congress, September 23, 2008. http://thomas.loc.gov/cgi-bin/query/z?c110:H.R.7007:.

  4. Rockefeller, et al. S.773 -- Cybersecurity Act of 2009. [Online] The Library of Congress, April 1, 2009. http://thomas.loc.gov/cgi-bin/query/z?c111:S.773:.

  5. Reid, et al. S.21 -- Cyber Security and American Cyber Competitiveness Act of 2011. [Online] The Library of Congress, January 25, 2011. http://thomas.loc.gov/cgi-bin/query/z?c112:S.21:.

  6. Lieberman, et al. S.2105 -- Cybersecurity Act of 2012. [Online] The Library of Congress, February 14, 2012. http://thomas.loc.gov/cgi-bin/query/z?c112:S.2105:.

  7. Tummarello, Kate. Intel panel approves cybersecurity bill. [Online] The Hill, July 8, 2014. http://thehill.com/policy/technology/211616-intel-panel-approves-cybersecurity-bill.

  8. Lieberman, Joe, Collins, Susan and Carper, Tom. A gold standard in cyber-defense. [Online] The Washington Post, July 7, 2011. http://www.washingtonpost.com/opinions/a-gold-standard-in-cyber-defense/2011/07/01/gIQAjsZk2H_story.html.

  9. Nagesh, Gautham. Sen. Rockefeller presses Congress to pass cybersecurity legislation. [Online] The Hill, January 31, 2012. http://thehill.com/blogs/hillicon-valley/technology/207729-rockefeller-presses-congress-to-pass-cybersecurity-legislation.

  10. Kain, Erik. Does The Cybersecurity Act Of 2012 Mark The Beginning Of The War On Cyber-terrorism? [Online] Forbes, February 22, 2012. http://www.forbes.com/sites/erikkain/2012/02/22/does-the-cybersecurity-act-of-2012-mark-the-beginning-of-the-war-on-cyber-terrorism/.

  11. Stiennon, Richard. Rockefeller’s Cybersecurity Act of 2010: A Very Bad Bill. [Online] Forbes, May 4, 2010. http://www.forbes.com/sites/firewall/2010/05/04/rockefellers-cybersecurity-act-of-2010-a-very-bad-bill/.

  12. Brito, Jerry and Watkins, Tate. Wired Opinion: Cyberwar Is the New Yellowcake. [Online] Wired, February 14, 2012. http://www.wired.com/threatlevel/2012/02/yellowcake-and-cyberwar/.

  13. Singel, Ryan. NSA Must Examine All Internet Traffic to Prevent Cyber Nine-Eleven, Top Spy Says. [Online] Wired, January 15, 2008. http://www.wired.com/threatlevel/2008/01/feds-must-exami/.

  14. Obama, Barack. Executive Order -- Improving Critical Infrastructure Cybersecurity. [Online] The White House, February 12, 2013. http://www.whitehouse.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity.

  15. Cyberspace Policy Review: Assuring a Trusted and Resilient Information and Communications Infrastructure. [Online] The White House, May 8, 2009. http://www.whitehouse.gov/assets/documents/Cyberspace_Policy_Review_final.pdf.

  16. National Security Council. The Comprehensive National Cybersecurity Initiative. [Online] The White House. [Cited: January 18, 2013.] http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative.

  17. The White House. National Initiative for Cybersecurity Education (NICE) Relationship to President’s Education Agenda. [Online] The White House, April 19, 2010. http://www.whitehouse.gov/sites/default/files/rss_viewer/cybersecurity_niceeducation.pdf.

  18. Information Assurance Support Environment (IASE). Cyber Awareness Challenge. [Online] U.S. Department of Defense. [Cited: January 21, 2013.] http://iase.disa.mil/eta/cyberchallenge/launchPage.htm.

  19. Homeland Security. National Cyber Security Awareness Month. [Online] U.S. Department of Homeland Security. [Cited: January 18, 2013.] http://www.dhs.gov/national-cyber-security-awareness-month.

  20. —. Cyber Storm: Securing Cyber Space. [Online] U.S. Department of Homeland Security. [Cited: January 18, 2013.] http://www.dhs.gov/cyber-storm-securing-cyber-space.

  21. National Cybersecurity Alliance (NCSA). StaySafeOnline.org. [Online] National Cybersecurity Alliance (NCSA). [Cited: January 18, 2013.] http://www.staysafeonline.org/.

  22. Center for Internet Security. Multi-State Information Sharing and Analysis Center (MS-ISAC). [Online] Center for Internet Security. [Cited: January 18, 2013.] http://msisac.cisecurity.org/.

  23. Patrikakis, Charalampos, Masikos, Michalis and Zouraraki, Olga. Distributed Denial of Service Attacks. [Online] The Internet Protocol Journal, December 2004. http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_7-4/dos_attacks.html.

  24. Goodin, Dan. DDoS attacks on major US banks are no Stuxnet—here’s why. [Online] ArsTechnica, October 3, 2012. http://arstechnica.com/security/2012/10/ddos-attacks-against-major-us-banks-no-stuxnet/.

  25. Prolexic. Prolexic Quarterly Global DDoS Attack Report. [Online] Prolexic, Q4 2012. http://www.prolexic.com/knowledge-center-ddos-attack-report-2012-q4/pr.html.

  26. Eddy, W. TCP SYN Flooding Attacks and Common Mitigations. [Online] The Internet Engineering Task Force (IETF), August 2007. http://tools.ietf.org/html/rfc4987.

  27. VeriSign. DDoS Mitigation - Best Practices for a Rapidly Changing Threat Landscape Whitepaper. [Online] VeriSign, 2012. http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/nia-information-center/ddos-best-practice-confirmation/index.xhtml.

  28. Cisco. Defeating DDOS Attacks. [Online] Cisco. [Cited: January 20, 2013.] http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5879/ps6264/ps5888/prod_white_paper0900aecd8011e927.html.

  29. VeriSign. VeriSign Internet Defense Network Enhanced With New DDoS Monitoring Service. [Online] Reuters, September 10, 2009. http://www.reuters.com/article/2009/09/10/idUS126052+10-Sep-2009+MW20090910.

  30. Prolexic. Prolexic Issues Mitigation, Detection Rules for Critical DDoS Threat Used in Banking Attacks. [Online] PresseBox, January 3, 2013. http://www.pressebox.com/inactive/prolexic-technologies/Prolexic-Issues-Mitigation-Detection-Rules-for-Critical-DDoS-Threat-Used-in-Banking-Attacks/boxid/564817.

  31. Tata Communications. Cloud-based security services. [Online] Tata Communications. [Cited: January 20, 2013.] http://security.tatacommunications.com/cloud.asp.

  32. Gross, Doug. Massive cyberattack hits Internet users. [Online] CNN, March 29, 2013. http://www.cnn.com/2013/03/27/tech/massive-internet-attack.

  33. Ingraham, Nathan. BitTorrent wants to change the way the web is built. [Online] The Verge, December 10, 2014. http://www.theverge.com/2014/12/10/7361603/bittorrenet-wants-to-change-the-way-the-web-is-built.

  34. Mueller, Robert S. III. Robert S. Mueller, III Speech at RSA Cyber Security Conference. [Online] Federal Bureau of Investigation, March 1, 2012. http://www.fbi.gov/news/speeches/combating-threats-in-the-cyber-world-outsmarting-terrorists-hackers-and-spies.

  35. Microsoft. Microsoft Joins Financial Services Industry to Disrupt Massive Zeus Cybercrime Operation That Fuels Worldwide Fraud and Identity Theft. [Online] Microsoft, March 25, 2012. http://www.microsoft.com/en-us/news/press/2012/mar12/03-25CybercrimePR.aspx.

  36. Mushtaq, Atif. Grum, World’s Third-Largest Botnet, Knocked Down. [Online] FireEye, July 18, 2012. http://blog.fireeye.com/research/2012/07/grum-botnet-no-longer-safe-havens.html.

  37. Cowley, Stacy. Grum takedown: ‘50 % of worldwide spam is gone’. [Online] CNNMoney, July 19, 2012. http://money.cnn.com/2012/07/19/technology/grum-spam-botnet/index.htm.

  38. Prolexic. Prolexic Issues Dirt Jumper Threat Advisory and Releases Free Security Scanner . [Online] PRWeb, December 29, 2011. http://www.prweb.com/releases/2011/12/prweb9067808.htm.

  39. Breeden, John II. Hackers’ new super weapon adds firepower to DDOS. [Online] GCN, October 24, 2012. http://gcn.com/Articles/2012/10/24/Hackers-new-super-weapon-adds-firepower-to-DDOS.aspx.

  40. Goldman, David. Take down any website for $3 . [Online] CNNMoney, December 31, 2014. http://money.cnn.com/2014/12/31/technology/lizard-squad-attack/index.html.

  41. Cowley, Stacy. FBI Director: Cybercrime will eclipse terrorism. [Online] CNNMoney, March 2, 2012. http://money.cnn.com/2012/03/02/technology/fbi_cybersecurity/index.htm.

  42. Perlroth, Nicole. Some Victims of Online Hacking Edge Into the Light. [Online] The New York Times, February 20, 2013. http://www.nytimes.com/2013/02/21/technology/hacking-victims-edge-into-light.html.

  43. —. Home Depot Data Breach Could Be the Largest Yet. [Online] The New York Times, September 8, 2014. http://bits.blogs.nytimes.com/2014/09/08/home-depot-confirms-that-it-was-hacked/.

  44. Pagliery, Jose. ‘Smart credit card’ terminals can be hacked too. [Online] CNNMoney, August 8, 2014. http://money.cnn.com/2014/08/08/technology/security/hack-credit-card-terminal/index.html.

  45. —. Half of American adults hacked this year. [Online] CNNMoney, May 28, 2014. http://money.cnn.com/2014/05/28/technology/security/hack-data-breach/.

  46. Zetter, Kim. Google Hack Attack Was Ultra Sophisticated, New Details Show. [Online] Wired, January 14, 2010. http://www.wired.com/threatlevel/2010/01/operation-aurora/.

  47. Cowley, Stacy. Former FBI cyber cop worries about a digital 9/11. [Online] CNN, July 25, 2012. http://money.cnn.com/2012/07/25/technology/blackhat-shawn-henry/index.htm.

  48. Jewell, Mark. TJX breach could top 94 million accounts. [Online] NBC News, October 24, 2007. http://www.msnbc.msn.com/id/21454847/ns/technology_and_science-security/t/tjx-breach-could-top-million-accounts/.

  49. Cubrilovic, Nik. RockYou Hack: From Bad To Worse. [Online] TechCrunch, December 14, 2009. http://techcrunch.com/2009/12/14/rockyou-hack-security-myspace-facebook-passwords/.

  50. Krebs, Brian. PlentyofFish.com Hacked, Blames Messenger. [Online] KrebsOnSecurity.com, January 31, 2011. http://krebsonsecurity.com/2011/01/plentyoffish-com-hacked-blames-messenger/.

  51. Hickins, Michael and Clark, Don. Questions Over Break-In at Security Firm RSA. [Online] The Wall Street Journal, March 18, 2011. http://online.wsj.com/article/SB10001424052748703512404576208983743029392.html.

  52. Wingfield, Nick, Sherr, Ian and Worthen, Ben. Hacker Raids Sony Videogame Network. [Online] The Wall Street Journal, April 27, 2011. http://online.wsj.com/article/SB10001424052748703778104576287362503776534.html.

  53. Smith, Aaron. Citi: Millions stolen in May hack attack. [Online] CNNMoney, June 27, 2011. http://money.cnn.com/2011/06/27/technology/citi_credit_card/index.htm.

  54. Zakaria, Tabassum and Hosenball, Mark. Stratfor Hack: Anonymous-Affiliated Hackers Publish Thousands Of Credit Card Numbers. [Online] Huffington Post, December 30, 2011. http://www.huffingtonpost.com/2011/12/30/stratfor-hack-anonymous_n_1176726.html.

  55. Bradley, Tony. Zappos Hacked: What You Need to Know. [Online] PC World, January 16, 2012. http://www.pcworld.com/article/248244/zappos_hacked_what_you_need_to_know.html.

  56. Acohido, Byron. Credit card processor hit by hackers. [Online] USA Today, March 30, 2012. http://www.usatoday.com/money/industries/banking/story/2012-03-30/mastercard-security-breach/53887854/1.

  57. Goldman, David. More than 6 million LinkedIn passwords stolen. [Online] CNNMoney, June 7, 2012. http://money.cnn.com/2012/06/06/technology/linkedin-password-hack/index.htm.

  58. eHarmony.com. Update on Compromised Passwords. [Online] eHarmony Blog, June 6, 2012. http://www.eharmony.com/blog/2012/06/06/update-on-compromised-passwords/#.U5ynqssU914.

  59. Gross, Doug. Yahoo hacked, 450,000 passwords posted online. [Online] CNN, July 13, 2012. http://www.cnn.com/2012/07/12/tech/web/yahoo-users-hacked/index.html.

  60. Riley, Charles. Barnes & Noble customer data stolen. [Online] CNNMoney, October 24, 2012. http://money.cnn.com/2012/10/24/technology/barnes--noble-hack/index.html.

  61. Lord, Bob. Keeping our users secure. [Online] Twitter Blog, February 1, 2013. http://blog.twitter.com/2013/02/keeping-our-users-secure.html.

  62. Bull, Alister and Finkle, Jim. Fed says internal site breached by hackers, no critical functions affected. [Online] Reuters, February 6, 2013. http://www.reuters.com/article/2013/02/06/net-us-usa-fed-hackers-idUSBRE91501920130206.

  63. Krebs on Security. Experian Sold Consumer Data to ID Theft Service. [Online] Krebs on Security, October 20, 2013. http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/.

  64. Engberg, Dave. Security Notice: Service-wide Password Reset. [Online] The Evernote Blog, March 2, 2013. http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/.

  65. Swisher, Kara. LivingSocial Hacked — More Than 50 Million Customer Names, Emails, Birthdates and Encrypted Passwords Accessed (Internal Memo). [Online] All Things D, April 26, 2013. http://allthingsd.com/20130426/livingsocial-hacked-more-than-50-million-customer-names-emails-birthdates-and-encrypted-passwords-accessed/.

  66. Arkin, Brad. Important Customer Security Announcement. [Online] Adobe Featured Blogs, October 3, 2013. http://blogs.adobe.com/conversations/2013/10/important-customer-security-announcement.html.

  67. Wallace, Gregory. Neiman Marcus hack hit 1.1 million customers. [Online] CNNMoney, January 23, 2014. http://money.cnn.com/2014/01/23/news/companies/neiman-marcus-hack/.

  68. Pagliery, Jose. 2 million Facebook, Gmail and Twitter passwords stolen in massive hack. [Online] CNNMoney, December 4, 2013. http://money.cnn.com/2013/12/04/technology/security/passwords-stolen/index.html.

  69. Isidore, Chris. Target: Hacking hit up to 110 million customers. [Online] CNNMoney, January 11, 2014. http://money.cnn.com/2014/01/10/news/companies/target-hacking/index.html.

  70. Lobosco, Katie. Michaels hack hit 3 million. [Online] CNN, April 18, 2014. http://money.cnn.com/2014/04/17/news/companies/michaels-security-breach/.

  71. Gross, Doug. Millions of accounts compromised in Snapchat hack. [Online] CNN, January 2, 2014. http://www.cnn.com/2014/01/01/tech/social-media/snapchat-hack/.

  72. Wallace, Gregory. Starbucks: We fixed app that left passwords vulnerable. [Online] CNNMoney, January 17, 2014. http://money.cnn.com/2014/01/17/technology/security/starbucks-app-passwords/index.html.

  73. Kickstarter. OMG. [Online] Kickstarter, March 3, 2014. https://www.kickstarter.com/1billion?ref=promo&ref=PromoNewsletterMar0314.

  74. eBay. eBay Inc. To Ask eBay Users To Change Passwords. [Online] ebay inc., May 21, 2014. http://investor.ebayinc.com/releasedetail.cfm?ReleaseID=849396.

  75. Riley, Charles. Data breach at UPS Stores in 24 states. [Online] CNNMoney, August 21, 2014. http://money.cnn.com/2014/08/21/technology/security/ups-store-data-hack/index.html.

  76. AOL Mail Team. AOL Security Update. [Online] Aol Blog, April 28, 2014. http://blog.aol.com/2014/04/28/aol-security-update/.

  77. Orcutt, Mike. Hackers Are Homing In on Hospitals. [Online] MIT Technology Review, September 2, 2014. http://www.technologyreview.com/news/530411/hackers-are-homing-in-on-hospitals/.

  78. Smith, Aaron. P.F. Chang’s confirms credit data was stolen. [Online] CNNMoney, June 13, 2014. http://money.cnn.com/2014/06/13/technology/security/pf-changs-security/index.html.

  79. Perlroth, Nicole and Gelles, David. Russian Hackers Amass Over a Billion Internet Passwords. [Online] The New York Times, August 5, 2014. http://www.nytimes.com/2014/08/06/technology/russian-gang-said-to-amass-more-than-a-billion-stolen-internet-credentials.html.

  80. Cooper, Charles. Celebs, beware: Those nude selfies will be hacked and shared. [Online] CNet, September 2, 2014. http://www.cnet.com/news/the-new-price-of-celebrity-careful-before-taking-that-nudie-selfie/.

  81. Pagliery, Jose. Staples hack exposes 1.2 million credit cards. [Online] CNNMoney, December 20, 2014. http://money.cnn.com/2014/12/19/technology/security/staples-hack/index.html.

  82. O’Toole, James. JPMorgan: 76 million customers hacked. [Online] CNNMoney, October 3, 2014. http://money.cnn.com/2014/10/02/technology/security/jpmorgan-hack/index.html?hpt=hp_t2.

  83. Perez, Evan. Hackers put data of U.S. government workers at risk. [Online] CNN, October 12, 2014. http://www.cnn.com/2014/08/06/tech/hackers-security-contractor-usis/index.html.

  84. Estes, Adam Clark. The Sony Pictures Hack Was Even Worse Than Everyone Thought. [Online] GIZMODO, December 3, 2014. http://gizmodo.com/the-sony-pictures-hack-exposed-budgets-layoffs-and-3-1665739357/1666122168/+ace.

  85. Cieply, Michael and Barnes, Brooks. Sony Cyberattack, First a Nuisance, Swiftly Grew Into a Firestorm. [Online] The New York Times, December 30, 2014. http://www.nytimes.com/2014/12/31/business/media/sony-attack-first-a-nuisance-swiftly-grew-into-a-firestorm-.html.

  86. Zetter, Kim. Sony Hackers Threaten to Release a Huge ‘Christmas Gift’ of Secrets. [Online] Wired, December 15, 2014. http://www.wired.com/2014/12/sony-hack-part-deux/.

  87. Petroff, Alanna. The heart of the Internet has been hacked. [Online] CNNMoney, December 19, 2014. http://money.cnn.com/2014/12/19/technology/security/icann-hack-internet/index.html.

  88. Zakrzewski, Cat. Anonymous Leaked A Massive List Of Passwords And Credit Card Numbers. [Online] TechCrunch, December 27, 2014. 1. http://techcrunch.com/2014/12/27/anonymous-leaked-a-massive-list-of-passwords-and-credit-card-numbers/.

  89. Goldman, David. Stock market hackers steal drug company secrets. [Online] CNN, December 29, 2014. http://money.cnn.com/2014/12/01/technology/security/stock-market-hack/index.html.

  90. Mathews, Anna Wilde and Yadron, Danny. Health Insurer Anthem Hit by Hackers. [Online] The Wall Street Journal, February 4, 2015. http://www.wsj.com/articles/health-insurer-anthem-hit-by-hackers-1423103720.

  91. Pagliery, Jose. Why North Korea’s attack should leave every company scared stiff. [Online] CNNMoney, December 19, 2014. http://money.cnn.com/2014/12/19/technology/security/hacking-companies-north-korea/index.html.

  92. Verizon RISK Team. 2012 Data Breach Investigations Report. [Online] Verizon, 2012. http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf.

  93. Menegaz, Gery. SQL Injection Attack: What is it, and how to prevent it. [Online] ZDNet, July 13, 2012. http://www.zdnet.com/sql-injection-attack-what-is-it-and-how-to-prevent-it-7000000881/.

  94. OWASP. SQL Injection Prevention Cheat Sheet. [Online] The Open Web Application Security Project, December 6, 2012. https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet.

  95. . Jewell, Mark. TJX breach could top 94 million accounts. [Online] NBC News, October 24, 2007. http://www.msnbc.msn.com/id/21454847/ns/technology_and_science-security/t/tjx-breach-could-top-million-accounts/.

  96. First Data Corporation. What Data Thieves Don’t Want You to Know: The Facts About Encryption. [Online] First Data Corporation, 2012. http://www.firstdata.com/downloads/thought-leadership/TokenizationEncryptionWP.pdf.

  97. Dulaney, Chelsey. Visa, MasterCard to Roll Out New Cybersecurity Features. [Online] The Wall Street Journal, February 13, 2015. http://www.wsj.com/articles/visa-mastercard-to-roll-out-new-cybersecurity-features-1423834542.

  98. Cowley, Stacy. How a lying ‘social engineer’ hacked Wal-Mart. [Online] CNNMoney, August 8, 2012. http://money.cnn.com/2012/08/07/technology/walmart-hack-defcon/index.htm.

  99. Honan, Mat. How Apple and Amazon Security Flaws Led to My Epic Hacking. [Online] Wired, August 6, 2012. http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/.

  100. Kirk, Jeremy. Researchers find vulnerability in Call of Duty: Modern Warfare 3. [Online] CSO, November 9, 2012. http://www.csoonline.com/article/721133/researchers-find-vulnerability-in-call-of-duty-modern-warfare-3.

  101. Facebook Security. Protecting People On Facebook. [Online] Facebook, February 15, 2013. https://www.facebook.com/notes/facebook-security/protecting-people-on-facebook/10151249208250766.

  102. Lute, Jane Holl. Is the Sony hack corporate America’s cybersecurity wakeup call? [Online] Fortune Magazine, December 29, 2014. http://fortune.com/2014/12/29/is-the-sony-hack-corporate-americas-cybersecurity-wakeup-call/.

  103. Simonite, Tom. The “Soft and Chewy Centers” That Put Your Data at Risk. [Online] MIT Technology Review, October 22, 2014. http://www.technologyreview.com/news/531931/the-soft-and-chewy-centers-that-put-your-data-at-risk/.

  104. resistsurveillance.org. DETEKT. [Online] RESIST SURVEILLANCE. [Cited: January 26, 2015.] https://resistsurveillance.org/index.html.

  105. Simonite, Tom. “Honey Encryption” Will Bamboozle Attackers with Fake Secrets. [Online] MIT Technology Review, January 29, 2014. http://www.technologyreview.com/news/523746/honey-encryption-will-bamboozle-attackers-with-fake-secrets/.

  106. Juels, Ari and Rivest, Ronald L. Honeywords Project. [Online] MIT, May 2, 2013. http://people.csail.mit.edu/rivest/honeywords/.

  107. Mila. Targeted attacks against personal accounts of military, government employees and associates . [Online] Contagio, February 17, 2011. http://contagiodump.blogspot.com/2011/02/targeted-attacks-against-personal.html.

  108. APWG. Phishing Activity Trends Report (2nd Quarter 2012). Anti-Phishing Working Group (APWG). [Online] September 2012. http://docs.apwg.org/reports/apwg_trends_report_q2_2012.pdf.

  109. Bursztein, Elie, et al. Handcrafted Fraud and Extortion: Manual Account Hijacking in the Wild. [Online] Association for Computing Machinery IMC’ 14, November 5-7, 2014. http://conferences2.sigcomm.org/imc/2014/papers/p347.pdf.

  110. Kelly, Suzanne and Benson, Pam. U.S. gears up for cyberwar amid conflicting ideas on how to fight it. [Online] CNN, February 24, 2012. http://security.blogs.cnn.com/2012/02/24/u-s-gears-up-for-cyberwar-amid-conflicting-ideas-on-how-to-fight-it/.

  111. Kim, Erin. Internet blackout for thousands begins Monday. [Online] CNNMoney, July 9, 2012. http://money.cnn.com/2012/07/06/technology/dnschanger/index.htm.

  112. Whittaker, Zack. Google services ‘disrupted’ in China; traffic declines rapidly. [Online] ZDNet, November 9, 2012. http://www.zdnet.com/google-services-disrupted-in-china-traffic-declines-rapidly-7000007195/.

  113. Taylor, Brad. Fighting phishing with eBay and PayPal. [Online] Official Gmail Blog, July 8, 2008. http://gmailblog.blogspot.com/2008/07/fighting-phishing-with-ebay-and-paypal.html#!/2008/07/fighting-phishing-with-ebay-and-paypal.html.

  114. Zetter, Kim. How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole. [Online] Wired, October 24, 2012. http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-widespread/all/.

  115. Orlando, Michael. Vulnerability Note VU#268267: DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust. [Online] U.S. Department of Homeland Security’s United States Computer Emergency Readiness Team (US-CERT), October 24, 2012. http://www.kb.cert.org/vuls/id/268267.

  116. US-CERT. Report Phishing Sites. [Online] U.S. Department of Homeland Security’s United States Computer Emergency Readiness Team (US-CERT). [Cited: January 22, 2013.] http://www.us-cert.gov/nav/report_phishing.html.

  117. The Google Safe Browsing Team. Report Phishing Page. [Online] Google. [Cited: January 22, 2013.] http://www.google.com/safebrowsing/report_phish/.

  118. Saran, Cliff. ING Direct implements two-factor authentication. [Online] Computer Weekly, August 17, 2006. http://www.computerweekly.com/news/2240078159/ING-Direct-implements-two-factor-authentication.

  119. Danchev, Dancho. Attacker: Hacking Sarah Palin’s email was easy. [Online] ZDNet, September 18, 2008. http://www.zdnet.com/blog/security/attacker-hacking-sarah-palins-email-was-easy/1939.

  120. Cheng, Roger and McCullagh, Declan. Yahoo breach: Swiped passwords by the numbers. [Online] CNet, July 12, 2012. http://news.cnet.com/8301-1009_3-57470878-83/yahoo-breach-swiped-passwords-by-the-numbers/.

  121. Brandom, Russell. Google launches support for Security Key, a simpler kind of two-factor authentication . [Online] The Verge, October 21, 2014. http://www.theverge.com/2014/10/21/7027267/google-launches-support-for-security-key-a-simpler-kind-of-two-factor.

  122. Komanduri, Saranga, et al. Telepathwords. [Online] Microsoft Research, 2013. https://telepathwords.research.microsoft.com/.

  123. Krebs, Brian. How Companies Can Beef Up Password Security. [Online] Krebs on Security, June 12, 2012. http://krebsonsecurity.com/2012/06/how-companies-can-beef-up-password-security/.

  124. Hale, Coda. How To Safely Store A Password. [Online] Code Hale, January 31, 2010. http://codahale.com/how-to-safely-store-a-password/.

  125. Brandom, Russell. Google-backed password-killer crosses major milestone . [Online] The Verge, December 9, 2014. http://www.theverge.com/2014/12/9/7359535/google-backed-password-killer-crosses-major-milestone.

  126. Microsoft. Microsoft Security Intelligence Report. [Online] Microsoft, January-June 2012. http://download.microsoft.com/download/C/1/F/C1F6A2B2-F45F-45F7-B788-32D2CCA48D29/Microsoft_Security_Intelligence_Report_Volume_13_English.pdf.

  127. Danchev, Dancho. Report: Malicious PDF files comprised 80 percent of all exploits for 2009. [Online] ZDNet, February 16, 2010. http://www.zdnet.com/blog/security/report-malicious-pdf-files-comprised-80-percent-of-all-exploits-for-2009/5473.

  128. Perlroth, Nicole. Department of Homeland Security: Disable Java ‘Unless It Is Absolutely Necessary’. [Online] The New York Times, January 14, 2013. http://bits.blogs.nytimes.com/2013/01/14/department-of-homeland-security-disable-java-unless-it-is-absolutely-necessary/.

  129. Dormann, Will. Vulnerability Note VU#625617: Java 7 fails to restrict access to privileged code. [Online] U.S. Department of Homeland Security’s United States Computer Emergency Readiness Team (US-CERT), January 10, 2013. http://www.kb.cert.org/vuls/id/625617.

  130. IC3. Malware Installed on Travelers’ Laptops Through Software Updates on Hotel Internet Connections . [Online] Internet Crime Complaint Center (IC3), May 8, 2012. http://www.ic3.gov/media/2012/120508.aspx.

  131. Keizer, Gregg. Is Stuxnet the ‘best’ malware ever? [Online] Computerworld, September 16, 2010. http://www.computerworld.com/s/article/9185919/Is_Stuxnet_the_best_malware_ever_.

  132. Simonite, Tom. Black Hat: More Internet-Scale Bugs Are Likely Lurking. [Online] MIT Technology Review, August 11, 2014. http://www.technologyreview.com/news/529981/black-hat-more-internet-scale-bugs-are-likely-lurking/.

  133. Wallace, Gregory. Apple pushes out first-ever automatic security upgrade for Mac. [Online] CNNMoney, December 23, 2014. http://money.cnn.com/2014/12/23/technology/security/apple-automatic-security-upgrade/index.html.

  134. Gross, Doug. Researchers: We can hack an iPhone through the charger. [Online] CNN, June 4, 2013. http://www.cnn.com/2013/06/03/tech/mobile/hack-iphone-charger/index.html.

  135. Federal Trade Commission. Android Flashlight App Developer Settles FTC Charges It Deceived Consumers. [Online] Federal Trade Commission, December 5, 2013. http://www.ftc.gov/news-events/press-releases/2013/12/android-flashlight-app-developer-settles-ftc-charges-it-deceived.

  136. Fouda, Amir. Security Protection. [Online] Microsoft Malware Protection Center, September 7, 2011. http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Security+Protection.

  137. Gross, Doug. Virus found in fake Android version of ‘Angry Birds: Space’. [Online] CNN, April 12, 2012. http://www.cnn.com/2012/04/12/tech/gaming-gadgets/angry-birds-virus-android/index.html.

  138. Halliday, Derek. Security Alert: SpamSoldier. [Online] Lookout Mobile Security, December 17, 2012. https://blog.lookout.com/blog/2012/12/17/security-alert-spamsoldier/.

  139. Goldman, David. You can’t change the color of Facebook - it’s a virus. [Online] CNNMoney, August 11, 2014. http://money.cnn.com/2014/08/11/technology/social/facebook-color-change/index.html.

  140. Bell, Karissa. Fake ‘Flappy Bird’ Apps Are Infecting Androids With Malware. [Online] Mashable, February 12, 2014. http://mashable.com/2014/02/12/flappy-bird-malware/.

  141. Perez, Sarah. Apple & Google Begin Rejecting Games With “Flappy” In The Title. [Online] TechCrunch, February 15, 2014. http://techcrunch.com/2014/02/15/apple-google-begin-rejecting-games-with-flappy-in-the-title/.

  142. Messmer, Ellen. Pirated mobile Android and Apple apps getting hacked, cracked and smacked. [Online] Network World, August 20, 2012. http://www.networkworld.com/news/2012/082012-pirated-app-malware-261702.html.

  143. Microsoft Security Intelligence Report. Deceptive Downloads: Software, Music, and Movies. [Online] Microsoft. [Cited: January 24, 2013.] http://www.microsoft.com/security/sir/story/default.aspx#!deceptive_downloads.

  144. Smith, Aaron. Aaron’s rental stores in anti-spying accord. [Online] CNNMoney, October 13, 2013. http://money.cnn.com/2013/10/23/technology/aarons-ftc-computer/index.html.

  145. Boscovich, Richard Domingues. Microsoft Disrupts the Emerging Nitol Botnet Being Spread through an Unsecure Supply Chain. [Online] The Office Microsoft Blog, September 13, 2012. http://blogs.technet.com/b/microsoft_blog/archive/2012/09/13/microsoft-disrupts-the-emerging-nitol-botnet-being-spread-through-an-unsecure-supply-chain.aspx.

  146. Microsoft. Microsoft Safety Scanner. [Online] Microsoft. [Cited: January 24, 2013.] http://www.microsoft.com/security/scanner/en-us/default.aspx.

  147. Dredge, Stuart. How you could become a victim of cybercrime in 2015. [Online] The Guardian, December 24, 2014. http://www.theguardian.com/technology/2014/dec/24/cybercrime-2015-cybersecurity-ransomware-cyberwar.

  148. Kirk, Jeremy. Chinese iOS devices fall prey to invasive WireLurker malware. [Online] PCWorld, November 6, 2014. http://www.pcworld.com/article/2844292/apple-mobile-devices-in-china-targeted-by-wirelurker-malware.html.

  149. Martin, Douglas. Joybubbles, 58, Peter Pan of Phone Hackers, Dies. [Online] The New York Times, August 20, 2007. http://www.nytimes.com/2007/08/20/us/20engressia.html.

  150. Chen, Brian X. Get Ready for 1 Billion Smartphones by 2016, Forrester Says. [Online] The New York Times, February 13, 2012. http://bits.blogs.nytimes.com/2012/02/13/get-ready-for-1-billion-smartphones-by-2016-forrester-says/.

  151. Goldman, David. Your smartphone will (eventually) be hacked. [Online] CNNMoney, September 12, 2012. http://money.cnn.com/2012/09/17/technology/smartphone-cyberattack/index.html.

  152. Norton. Cybercrime Report 2011. [Online] Symantec Corporation, 2012. http://now-static.norton.com/now/en/pu/images/Promotions/2012/cybercrime/assets/downloads/en-us/NCR-DataSheet.pdf.

  153. Constantin, Lucian. Android threats growing in number and complexity, report says. [Online] Computer World, May 14, 2013. http://www.computerworld.com/article/2497483/malware-vulnerabilities/android-threats-growing-in-number-and-complexity--report-says.html.

  154. Bell, Ian. Commwarrior.A Virus Targets Cell Phones. [Online] Digital Trends, March 9, 2005. http://www.digitaltrends.com/mobile/commwarriora-virus-targets-cell-phones/.

  155. Gold, Jon. Researchers reveal new rootkit threat to Android security. [Online] Network World, July 2, 2012. http://www.networkworld.com/news/2012/070212-android-malware-260627.html.

  156. Cowley, Stacy. NFC exploit: Be very, very careful what your smartphone gets near. [Online] CNNMoney, July 26, 2012. http://money.cnn.com/2012/07/26/technology/nfc-hack/index.htm.

  157. Limer, Eric. Crazy New Exploit Can Brick Samsung Phones or Steal All Their Data. [Online] Gizmodo, December 16, 2012. http://gizmodo.com/5968879/crazy-new-exploit-can-brick-samsung-phones-or-steal-all-their-data.

  158. Kirk, Jeremy. Android Botnet Abuses People’s Phones for SMS Spam. [Online] CIO, December 17, 2012. http://www.cio.com/article/724237/Android_Botnet_Abuses_People_s_Phones_for_SMS_Spam.

  159. Krebs, Brian. A Closer Look: Perkele Android Malware Kit. [Online] Krebs on Security, August 19, 2013. http://krebsonsecurity.com/tag/perkele/.

  160. Ashford, Warwick. Researchers discover new Android Trojan. [Online] Computer Weekly, April 4, 2013. http://www.computerweekly.com/news/2240180810/Researchers-discover-new-Android-Trojan.

  161. Kelly, Heather. SIM card hack inspires quick fix by carriers. [Online] CNN, August 1, 2013. http://www.cnn.com/2013/08/01/tech/mobile/sim-card-hack/index.html.

  162. Talbot, David. Hacked Feature Phone Can Block Other People’s Calls. [Online] MIT Technology Review, August 26, 2013. http://www.technologyreview.com/news/518646/hacked-feature-phone-can-block-other-peoples-calls/.

  163. Constantin, Lucian. D’oh! Basic flaw in WhatsApp could allow attackers to decrypt messages. [Online] PC World, October 9, 2013. http://www.pcworld.com/article/2053480/doh-basic-flaw-in-whatsapp-could-allow-attackers-to-decrypt-messages.html.

  164. Wallace, Gregory. Apple issues fix for security risk. [Online] CNNMoney, February 23, 2014. http://money.cnn.com/2014/02/23/technology/mobile/apple-iphone-security-hole/index.html.

  165. Xue, Hui, Wei, Tao and Zhang, Yulong. Masque Attack: All Your iOS Apps Belong to Us. [Online] FireEye, November 10, 2014. https://www.fireeye.com/blog/threat-research/2014/11/masque-attack-all-your-ios-apps-belong-to-us.html.

  166. Strazzere, Tim. The new NotCompatible: Sophisticated and evasive threat harbors the potential to compromise enterprise networks. [Online] Lookout, November 19, 2014. https://blog.lookout.com/blog/2014/11/19/notcompatible/.

  167. Timberg, Craig. German researchers discover a flaw that could let anyone listen to your cell calls. [Online] The Washington Post, December 18, 2014. http://www.washingtonpost.com/blogs/the-switch/wp/2014/12/18/german-researchers-discover-a-flaw-that-could-let-anyone-listen-to-your-cell-calls-and-read-your-texts/.

  168. Merica, Dan. Five things you need to know about U.S. national security. [Online] CNN, July 29, 2012. http://security.blogs.cnn.com/2012/07/29/five-things-you-need-to-know-about-u-s-national-security/.

  169. Goldman, David. Watching porn is bad for your smartphone. [Online] CNNMoney, February 11, 2013. http://money.cnn.com/2013/02/11/technology/security/smartphone-porn/index.html.

  170. Simonite, Tom. Browser Exploit for Android Highlights Google’s Update Problem. [Online] MIT Technology Review, February 14, 2014. http://www.technologyreview.com/news/524631/browser-exploit-for-android-highlights-googles-update-problem/.

  171. Sengupta, Somini. U.S. Military Hunts for Safe Smartphones for Soldiers. [Online] The New York Times, June 22, 2012. http://bits.blogs.nytimes.com/2012/06/22/u-s-military-hunts-for-safe-smartphones-for-soldiers/.

  172. Griggs, Brandon. Meet the ‘NeRD,’ the Navy’s new e-reader. [Online] CNN, May 8, 2014. http://www.cnn.com/2014/05/08/tech/gaming-gadgets/navy-nerd-e-reader/index.html.

  173. FCC Smartphone Security Checker. [Online] FCC. [Cited: January 25, 2013.] http://www.fcc.gov/smartphone-security.

  174. Souppourison, Aaron. iPhone lockscreen can be bypassed with new iOS 6.1 trick. [Online] The Verge, February 14, 2013. http://www.theverge.com/2013/2/14/3987830/ios-6-1-security-flaw-lets-anyone-make-calls-from-your-iphone.

  175. Peterson, Scott. Exclusive: Iran hijacked US drone, says Iranian engineer (Video) . [Online] The Christian Science Monitor, December 15, 2011. http://www.csmonitor.com/World/Middle-East/2011/1215/Exclusive-Iran-hijacked-US-drone-says-Iranian-engineer-Video.

  176. Zaragoza, Sandra. Spoofing a Superyacht at Sea. [Online] The University of Texas at Austin, July 30, 2013. http://www.utexas.edu/know/2013/07/30/spoofing-a-superyacht-at-sea/.

  177. Rutkin, Aviva Hope. “Spoofers” Use Fake GPS Signals to Knock a Yacht Off Course. [Online] MIT Technology Review, August 14, 2013. http://www.technologyreview.com/news/517686/spoofers-use-fake-gps-signals-to-knock-a-yacht-off-course/.

  178. Gallagher, Ryan. FBI Accused of Dragging Feet on Release of Info About “Stingray” Surveillance Technology. [Online] Slate, October 19, 2012. http://www.slate.com/blogs/future_tense/2012/10/19/stingray_imsi_fbi_accused_by_epic_of_dragging_feet_on_releasing_documents.html.

  179. Nohl, Karsten. Mobile self‐defen. [Online] Security Research Labs, December 27, 2014. http://events.ccc.de/congress/2014/Fahrplan/system/attachments/2493/original/Mobile_Self_Defense-Karsten_Nohl-31C3-v1.pdf.

  180. Sandi National Laboratories. Sandia builds self-contained, Android-based network to study cyber disruptions and help secure hand-held devices . [Online] Sandi National Laboratories, October 2, 2012. https://share.sandia.gov/news/resources/news_releases/sandia-builds-self-contained-android-based-network-to-study-cyber-disruptions-and-help-secure-hand-held-devices/.

  181. IMDb. CSI: Cyber. [Online] IMDb, 2015. http://www.imdb.com/title/tt3560060/.

  182. Perlroth, Nicole. Hackers in China Attacked The Times for Last 4 Months. [Online] The New York Times, January 30, 2013. http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html.

  183. Symantec. Symantec Statement Regarding New York Times Cyber Attack . [Online] Symantec, January 31, 2013. http://www.marketwire.com/press-release/symantec-statement-regarding-new-york-times-cyber-attack-nasdaq-symc-1751586.htm.

  184. Goldman, David. Your antivirus software probably won’t prevent a cyberattack. [Online] CNNMoney, January 31, 2013. http://money.cnn.com/2013/01/31/technology/security/antivirus/index.html.

  185. Poeter, Damon. NBC.com Hacked, Infected With Citadel Trojan. [Online] PC Magazine, February 21, 2013. http://www.pcmag.com/article2/0,2817,2415735,00.asp.

  186. Peterson, Andrea. Everything you need to know about Yahoo’s security breach. [Online] The Washington Post, January 6, 2014. http://www.washingtonpost.com/blogs/the-switch/wp/2014/01/06/everything-you-need-to-know-about-yahoos-security-breach/.

  187. Kelly, Heather. Is the government doing enough to protect us online? [Online] CNN, July 31, 2012. http://www.cnn.com/2012/07/25/tech/regulating-cybersecurity/index.html.

  188. CNN Political Unit. Investigation opened into hacked Bush family e-mails. [Online] CNN, February 8, 2013. http://politicalticker.blogs.cnn.com/2013/02/08/investigation-opened-into-hacked-bush-family-emails/.

  189. Ablon, Lillian and Libicki, Martin C. Wild Wild Web: For Now, Cybercrime Has the Upper Hand in Its Duel with the Law. [Online] The RAND Corporation, Summer 2014. http://www.rand.org/pubs/periodicals/rand-review/issues/2014/summer/wildweb.html.

  190. Nieva, Richard. Big banks stage mega-cyberattack drill. [Online] CNN, July 18, 2013. http://money.cnn.com/2013/07/18/technology/security/bank-cyberattack/index.html.

  191. Gaudin, Sharon. DARPA chief leaves Pentagon for Google job. [Online] Computerworld, March 13, 2012. http://www.computerworld.com/s/article/9225156/DARPA_chief_leaves_Pentagon_for_Google_job.

  192. Dugan, Regina. Regina Dugan: From mach-20 glider to humming bird drone. [Online] TED, March 2012. http://www.ted.com/talks/regina_dugan_from_mach_20_glider_to_humming_bird_drone.html.

  193. Segall, Laurie. Facebook pays $40,000 to bug spotters . [Online] CNNMoney, August 30, 2011. http://money.cnn.com/2011/08/30/technology/facebook_bug_bounty/index.htm.

  194. Facebook. Bounty. [Online] Facebook. [Cited: January 25, 2013.] http://www.facebook.com/whitehat/bounty/.

  195. —. White Hats. [Online] Facebook. [Cited: January 25, 2013.] http://www.facebook.com/whitehat/.

  196. Pepitone, Julianne. Google awards $60,000 prize for Chrome hack. [Online] CNNMoney, October 10, 2012. http://money.cnn.com/2012/10/10/technology/security/google-chrome-hacker-prize/index.html.

  197. Kersey, Jason. Chrome Releases. [Online] Google, October 10, 2012. http://googlechromereleases.blogspot.com/2012/10/stable-channel-update_6105.html.

  198. Simonite, Tom. How to Exchange Encrypted Messages on Any Website. [Online] MIT Technology Review, November 5, 2014. http://www.technologyreview.com/news/532186/how-to-exchange-encrypted-messages-on-any-website/.

  199. Robertson, Jordan. Why Sony’s Plan to Foil PlayStation-Type Attacks Faltered. [Online] Bloomberg, December 5, 2014. http://www.bloomberg.com/news/2014-12-05/why-sony-s-plan-to-foil-playstation-type-attacks-faltered.html.

  200. Frates, Chris and Devine, Curt. Government hacks and security breaches skyrocket. [Online] CNN, December 19, 2014. http://www.cnn.com/2014/12/19/politics/government-hacks-and-security-breaches-skyrocket/.

  201. O’Toole, James. #StealMyIdentity: Fraudsters use paycheck selfies to steal bank details. [Online] CNNMoney, October 29, 2014. http://money.cnn.com/2014/10/29/technology/social/instagram-identity-theft/index.html.

Download references

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Newton Lee .

Rights and permissions

Reprints and permissions

Copyright information

© 2015 Springer International Publishing Switzerland

About this chapter

Cite this chapter

Lee, N. (2015). Cyber Attacks, Prevention, and Countermeasures. In: Counterterrorism and Cybersecurity. Springer, Cham. https://doi.org/10.1007/978-3-319-17244-6_10

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-17244-6_10

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-17243-9

  • Online ISBN: 978-3-319-17244-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics