Attackers rely on a wide arsenal of techniques, often chaining multiple weaknesses together. Phishing tricks users into revealing credentials or executing malicious actions through deceptive emails or pages. Spear phishing targets specific individuals with researched, personalized content, making it far more convincing. Whaling aims at executives, smishing delivers phishing via SMS, vishing uses voice calls, and Business Email Compromise (BEC) impersonates executives to authorize fraudulent wire transfers. A man-in-the-middle (MITM) attack secretly intercepts and potentially alters communication between two parties who believe they are communicating directly; TLS with valid certificate validation makes such interception extremely difficult, while certificate pinning trusts only specific certificates or public keys to defend against compromised CAs. DNS spoofing returns false DNS responses to redirect traffic, mitigated by DNSSEC, which adds cryptographic signatures to DNS records for integrity.
Malware, malicious software designed to damage systems, steal data, spy on activity, or disrupt operations, comes in many forms. Viruses attach to legitimate programs, worms self-replicate and spread without user interaction, and trojans disguise themselves as legitimate software. Rootkits stealthily hide their presence at the OS or firmware level, logic bombs activate on a trigger condition such as a date or event, and backdoors provide hidden access that bypasses normal authentication. Ransomware encrypts a victim's files and demands payment for the decryption key; security experts recommend not paying because payment does not guarantee recovery and funds criminal operations, instead isolating affected systems, restoring from backups, and reporting to authorities. Botnets, networks of compromised devices controlled by an attacker, are often used to launch Distributed Denial of Service (DDoS) attacks, which flood a target from many sources to exhaust resources, much harder to mitigate than a single-source DoS. Defenses against DDoS include anti-DDoS services such as Cloudflare and AWS Shield, rate limiting, scaling, and sinkhole routing.
Software supply chains have become prime targets. A supply chain attack compromises a software dependency or build pipeline to attack downstream users, as exemplified by the 2020 SolarWinds Orion breach that infiltrated thousands of government and corporate networks. Dependency confusion publishes a malicious package with the same name as an internal package, while typosquatting registers package names similar to popular ones, such as reqeusts versus requests, to trap users. A Software Bill of Materials (SBOM) lists the components and dependencies in a piece of software, enabling organizations to know what they are running. The secret sprawl problem arises when API keys, tokens, and passwords are scattered through code and config, becoming a common cause of breaches. Secret scanning, offered by GitHub, GitLab, and AWS, automatically detects secrets in repositories, while centralized secrets management services like HashiCorp Vault or AWS Secrets Manager store and control access to those credentials. Brute-force attacks systematically try many passwords or keys, dictionary attacks use a wordlist of likely passwords, and credential stuffing reuses leaked credentials from one site to log into another; defenses include MFA, rate limiting, breach detection services such as Have I Been Pwned, and unique passwords per site. Software updates patch known vulnerabilities that attackers actively exploit, making prompt patch management essential. Even well-designed systems can leak through indirect channels: side-channel attacks exploit information leaks such as timing or power consumption, with Spectre and Meltdown as famous CPU examples; timing attacks infer secrets from execution-time variation and are mitigated by constant-time algorithms.