Malware Security & Data Breach
Before we got deep into the Malware Security Breach Data Breach, we got to know what a Malware is. According to Wikipedia, Malware (a portmanteau for malicious software) is any software intentionally designed to cause damage to a computer, server, client, or computer network. A wide variety of types of malware exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, and scareware.
And then we got to know what a Security Breach is. According to Norton, Think of a security breach as a break-in. If someone smashes a window and climbs into your home, that’s a security breach. If the intruder snatches your documents and personal information and climbs back out the window, that’s a data breach
So from the both definition of Malware and Security Breach we can assume that Malware Security Breach is the use of Malware to break in to the System for a cybercriminals to gain unauthorized access to a computer system or network and steal the private, sensitive, or confidential personal and financial data of the customers or users contained within.
With most data breaches, cybercriminals want to steal names, email addresses, usernames, passwords, and credit card numbers. Though cybercriminals will steal any data that can be sold, used to breach other accounts, steal your identity, or make fraudulent purchases with. In some instances, hackers want to steal your data just to prove that they can.
Common cyberattacks used in data breaches include the following:
- Spyware
is a type of malware that infects your computer or network and steals information about you, your Internet usage, and any other valuable data it can get its hands on. Once your system is infected, the spyware sends all your personal data back to the command and control (C&C) servers run by the cybercriminals.
- Phishing
attacks work by getting us to share sensitive information like our usernames and passwords, often against normal logic and reasoning, by using social engineering to manipulate our emotions, such as greed and fear. A typical phishing attack will start with an email spoofed, or faked, to look like it’s coming from a company you do business with or a trusted coworker. This email will contain aggressive or demanding language and require some sort of action, like verify payments or purchases you never made. Clicking the supplied link will direct you to a malicious login page designed to capture your username and password.
- Broken or misconfigured access controls
can make private parts of a given website public when they’re not supposed to be. For example, a website administrator at an online clothing retailer will make certain back-end folders within the website private, i.e. the folders containing sensitive data about customers and their payment information. However, the web admin might forget to make the related sub-folders private as well. While these sub-folders might not be readily apparent to the average user, a cybercriminal using a few well-crafted Google searches could find those misconfigured folders and steal the data contained in them
Here are some example in real life of a Malware Security Breach or Data Breach:
- Yahoo
In August of 2013, cybercriminals stole data on every Yahoo user in the world—all three billion of them. The sheer size of the data breach is difficult to fathom. Over one-third of the world’s population was affected. When the attack was first revealed in 2016, Yahoo claimed only one billion of its users were affected by the data breach, later changing the figure to “all Yahoo user accounts” less than a year later. The timing couldn’t have been worse. At the time Yahoo revealed the updated data breach numbers, the company was in negotiations to be acquired by Verizon. News of the data breach allowed Verizon to scoop up Yahoo at a fire sale price. Yahoo was acquired by Verizon in 2017.
- eBay
In early 2014, cybercriminals clicked “Steal It Now” when they broke into the network of the popular online auction site and pinched the passwords, email addresses, birth dates, and physical addresses for 145 million users. One positive takeaway, financial information from sister site PayPal was stored separately from user information in a practice known as network segmentation (more on that later). This had the effect of limiting the attack and prevented criminals from getting to the really sensitive payment info.
References:
https://en.wikipedia.org/wiki/Malware
https://us.norton.com/internetsecurity-privacy-security-breach.html
