CYBER SECURITY

Cybercrime – Definition and Origins

Cybercrime refers to illegal activities that involve a computer,
networked device, or a network. These crimes can target individuals,
organizations, or even governments.
Cybercrime = Crime + Technology (especially Internet &
Computers)
Origins of the Word:
 The term "Cyber" is derived from "Cybernetics" (the science of
communication and control systems in machines and living beings).
 The term "Cybercrime" emerged in the late 20th century, with the
rise of computers and the internet.
 First used in the 1980s, initially for basic hacking and data breaches.

Why is cyber security important?

Listed below are the reasons why cyber security is so important in what’s
become a predominant digital world:
 Cyber-attacks can be extremely expensive for businesses to endure.
 In addition to financial damage suffered by the business, a data breach
can also inflict untold reputational damage.
 Cyber-attacks these days are becoming progressively destructive.
Cybercriminals are using more sophisticated ways to initiate cyber-
attacks.
 Regulations such as GDPR are forcing organizations into taking better
care of the personal data they hold.

Information Security and Cybercrime

 Information Security (InfoSec) is the practice of protecting digital
information from unauthorized access, disclosure, or destruction.
 Cybercrime is a direct threat to Information Security.
 Focus areas include:
Confidentiality
Confidentiality is about preventing the disclosure of data to
unauthorized parties. It also means trying to keep the identity of
authorized parties involved in sharing and holding data private
and anonymous.
Standard measures to establish confidentiality include:
 Data encryption
 Two-factor authentication
  Biometric verification
 Security tokens

o Integrity
Integrity refers to protecting information from being modified by
unauthorized parties. Standard measures to guarantee integrity
include:  Cryptographic checksums
 Using file permissions
 Uninterrupted power supplies
 Data backups
o Availability (CIA Triad)
Availability is making sure that authorized parties are able to
access the information when needed. Standard measures to
guarantee availability include:
 Backing up data to external drives
 Implementing firewalls
 Having backup power supplies
 Data redundancy
Types of Cyber Attacks
A cyber-attack is an exploitation of computer systems and networks. It uses
malicious code to alter computer code, logic or data and lead to cybercrimes,
such as information and identity theft.
Cyber-attacks can be classified into the following categories:
1) Web-based attacks
2) System-based attacks
Web-based attacks
These are the attacks which occur on a website or web applications. Some of
the important web-based attacks are as follows
1. Injection attacks: It is the attack in which some data will be injected
into a web application to manipulate the application and fetch the
required information. Example- SQL Injection, code Injection, log
Injection, XML Injection etc.
2. DNS Spoofing: DNS Spoofing is a type of computer security hacking.
Whereby a data is introduced into a DNS resolver's cache causing the
name server to return an incorrect IP address, diverting traffic to the
attacker’s computer or any other computer. The DNS spoofing attacks
can go on for a long period of time without being detected and can
cause serious security issues.
3. Session Hijacking : It is a security attack on a user session over a
protected network. Web applications create cookies to store the state
 and user sessions. By stealing the cookies, an attacker can have
access to all of the user data.
4. Phishing: Phishing is a type of attack which attempts to steal sensitive
information like user login credentials and credit card number. It occurs
when an attacker is masquerading as a trustworthy entity in electronic
communication.
5. Brute force: It is a type of attack which uses a trial and error method.
This attack generates a large number of guesses and validates them to
obtain actual data like user password and personal identification
number. This attack may be used by criminals to crack encrypted data,
or by security, analysts to test an organization's network security.
6. Denial of Service: It is an attack which meant to make a server or
network resource unavailable to the users. It accomplishes this by
flooding the target with traffic or sending it information that triggers a
crash. It uses the single system and single internet connection to
attack a server. It can be classified into the following: -
1) Volume-based attacks- Its goal is to saturate the bandwidth of
the attacked site, and is measured in bit per second.
2) Protocol attacks- It consumes actual server resources, and is
measured in a packet.
3) Application layer attacks- Its goal is to crash the web server
and is measured in request per second.
7. Dictionary attacks: This type of attack stored the list of a commonly
used password and validated them to get original password.
8. URL Interpretation: It is a type of attack where we can change the
certain parts of a URL, and one can make a web server to deliver web
pages for which he is not authorized to browse.
9. File Inclusion attacks: It is a type of attack that allows an attacker to
access unauthorized or essential files which is available on the web
server or to execute malicious files on the web server by making use of
the include functionality.
10. Man in the middle attacks: It is a type of attack that allows an
attacker to intercepts the connection between client and server and
acts as a bridge between them. Due to this, an attacker will be able to
read, insert and modify the data in the intercepted connection.
System-based attacks:
These are the attacks which are intended to compromise a computer or a
computer network. Some of the important system-based attacks are as
follows
 1. Virus It is a type of malicious software program that spread throughout
the computer files without the knowledge of a user. It is a self-
replicating malicious computer program that replicates by inserting
copies of itself into other computer programs when executed. It can
also execute instructions that cause harm to the system.
2. Worm: It is a type of malware whose primary function is to replicate
itself to spread to uninfected computers. It works same as the
computer virus. Worms often originate from email attachments that
appear to be from trusted senders.
3. Trojan horse: It is a malicious program that occurs unexpected
changes to computer setting and unusual activity, even when the
computer should be idle. It misleads the user of its true intent. It
appears to be a normal application but when opened/executed some
malicious code will run in the background.
4. Backdoors: It is a method that bypasses the normal authentication
process. A developer may create a backdoor so that an application or
operating system can be accessed for troubleshooting or other
purposes.
5. Bots: A bot (short for "robot") is an automated process that interacts
with other network services. Some bots program run automatically,
while others only execute commands when they receive specific input.
Common examples of bots’ program are the crawler, chatroom bots,
and malicious bots.

Who are Cybercriminals?

Cybercriminals can be:
Type Description
Hackers Unauthorized users who break into systems
Crackers Break into systems to cause damage
Script Kiddies Inexperienced users using ready-made tools
Insiders Employees who misuse access
Use cyber-attacks for ideological or political
Cyber Terrorists
purposes
Hacktivists Protesters who hack to promote a cause
Organized Cybercrime
Professional criminals working for profit
Gangs

TYPES OF CYBER CRIMES

 1. Crime against Individual.
2. Crime against property
3. Crime against Society

Crime against Individual:

Classification of Cybercrimes
Category Examples
Against Cyberstalking, harassment, identity
Individuals theft
Against Hacking, spreading viruses, DDoS
Property attacks
Against Cyber terrorism, attacking defense
Government networks
Against Society Child pornography, hate crimes

Global Perspective on Cybercrimes

 Cybercrime is borderless. A hacker in one country can attack
another without physically being there.
 International cooperation is crucial (Interpol, UN, EU agencies).
 Global laws vary, making prosecution difficult.
 Notable global cybercrime examples:
o WannaCry Ransomware (2017) – affected 150+ countries.
o Stuxnet Worm – targeted Iran’s nuclear facilities.

Cybercrime Era: Survival Mantra for the Netizens

Netizens = Citizens of the Internet
Survival Mantra:
 Use strong passwords and update them regularly.
 Enable two-factor authentication (2FA).
 Avoid suspicious links or downloads.
 Regularly update antivirus and firewalls.
 Be aware of social engineering tactics.
 Do not share sensitive data online.

Cyber Offenses: How Criminals Plan Attacks

Stages of Cyberattack Planning:
1. Reconnaissance – Information gathering.
 2. Scanning – Identifying vulnerable systems.
3. Gaining Access – Exploiting vulnerabilities.
4. Maintaining Access – Installing backdoors, botnets.
5. Covering Tracks – Deleting logs, using anonymous channels.

Social Engineering
Definition: Manipulating people into revealing confidential information or
performing actions that compromise security.
Common Tactics:
 Phishing: Fake emails/websites
 Vishing: Voice phishing via calls
 Smishing: SMS-based phishing
 Pretexting: Pretending to be someone else

Cyberstalking
Definition: Using the internet or electronic means to stalk or harass an
individual, group, or organization.
Forms:
 Sending threatening emails
 Monitoring online activity
 Posting false accusations online
Effects:
 Psychological trauma
 Privacy invasion
 Real-world threats

Cybercafes and Cybercrimes

 Cybercafes provide anonymous access to the internet – a hotspot for
illegal activities.
 Common activities:
o Hacking
o Accessing restricted websites
o Anonymous communications
 Law enforcement now mandates ID verification in many regions for
cybercafe users.

Botnets: The Fuel for Cybercrime

Botnet = Bot + Network
  A botnet is a network of infected computers (called zombies)
controlled by a botmaster.
 Used for:
o Distributed Denial of Service (DDoS) attacks
o Sending spam emails
o Spreading malware
o Stealing data
Attack Vectors
Definition: A path or means by which a hacker gains access to a computer
or network.
Common Attack Vectors:
Vector Description
Email
Used to deliver malware
Attachments
Web Browsers Drive-by downloads
Social Media Impersonation, scams
Removable
USB-based malware
Media
Network Ports Unsecured ports as entry points
Malicious permissions
Mobile Apps
Ut 2

CYBER CRIME: Mobile and Wireless Devices

1. Introduction

Mobile and wireless devices (smartphones, tablets, laptops, PDAs) have

become essential tools for communication, business, and personal use. While
they offer convenience, they also introduce a wide range of cybersecurity
threats and challenges.

2. Proliferation of Mobile and Wireless Devices

 Rapid growth in smartphone users and internet-connected mobile

devices.

 Increased usage of Wi-Fi, Bluetooth, 4G/5G, and other wireless

technologies.

 Bring Your Own Device (BYOD) trend in organizations adds security

complexity.

 Mobile apps and cloud services increase exposure to cyber risks.

3. Trends in Mobility

 Enterprise Mobility: Employees access business data via mobile

devices.

 Cloud Integration: Seamless syncing with cloud platforms.

 IoT Integration: Smart devices connect to mobile networks.

 Remote Work Culture: Higher demand for secure mobile access.

 Mobile Payments: Use of mobile wallets like Google Pay, Apple Pay.

4. Credit Card Frauds in Mobile and Wireless Computing Era

 Phishing & Smishing: Fake messages/emails to steal card data.

 Malicious Apps: Apps that secretly collect financial data.

  Public Wi-Fi Risks: Data interception over unsecured networks.

 Man-in-the-Middle Attacks (MITM) during mobile transactions.

 SIM Cloning and OTP Interception.

5. Security Challenges Posed by Mobile Devices

 Device Loss/Theft: Sensitive data at risk.

 Unsecured Wi-Fi: Easy target for attackers.

 Jailbreaking/Rooting: Weakens built-in security.

 Outdated OS or Apps: Vulnerable to known exploits.

 Malware & Spyware: Hidden in apps or links.

6. Registry Settings for Mobile Devices

Mobile devices do not use traditional Windows-style registries, but they have
configuration files or settings to manage security.

 Android: Uses files like [Link], SQLite DBs for app data.

 iOS: Uses property lists (.plist files) for settings.

 Enterprises use Mobile Device Management (MDM) to configure

and control device settings remotely (e.g., encryption, app restrictions,
etc.)

7. Authentication Service Security

 Biometric Authentication: Fingerprint, face recognition.

 Two-Factor Authentication (2FA): Adds OTP layer.

 Single Sign-On (SSO): Used in enterprise apps.

 OAuth/OpenID: Secure third-party authentication.

Challenges:

 Biometric Spoofing

 Session Hijacking
  Insecure Token Storage

8. Attacks on Mobile/Cell Phones

 Phishing & Smishing

 Bluetooth Hacking (Bluejacking, Bluesnarfing)

 Rogue Apps with spyware or ransomware.

 Trojan Horse Apps

 SIM Jacking: Control over phone number.

 Keylogging via malicious apps

 Network Spoofing (Fake Wi-Fi)

9. Mobile Devices: Security Implications for Organizations

 Risk of data leakage via personal apps.

 Shadow IT: Unauthorized apps or services.

 Legal and compliance issues (e.g., GDPR, HIPAA).

 Device diversity complicates security enforcement.

 Vulnerabilities from third-party apps.

10. Organizational Measures for Handling Mobile Devices

 Mobile Device Management (MDM) systems:

o Remote wipe

o Device encryption

o Policy enforcement

 Mobile Application Management (MAM) for app-specific controls.

 Enforcing strong password policies.

 Mandating regular updates and patch management.

 Use of VPNs for secure access.

11. Organizational Security Policies and Measures in Mobile
Computing Era

 Acceptable Use Policies (AUP) for mobile access.

 Enforce data encryption for storage and transmission.

 Access control based on user roles.

 Security awareness training for employees.

 Regular audit and compliance checks.

 Incident response strategies for mobile threats.

 Implement containerization to separate work and personal data.

Conclusion

The growing reliance on mobile and wireless devices brings convenience but
also increases the threat surface. Organizations and individuals must adopt
robust security measures to protect against mobile-related cyber crimes.
Ut 3

TOOLS AND METHODS USED IN CYBERCRIME

1. Introduction

Cybercriminals use various sophisticated tools and techniques to exploit

vulnerabilities in systems, steal data, and disrupt services. Understanding
these methods helps in devising better security mechanisms.

2. Proxy Servers and Anonymizers

 Proxy Servers: Act as intermediaries between the user and the

internet, hiding the user's IP address.

 Anonymizers: Specialized proxy services that mask identity to

maintain anonymity online.

 Used by cybercriminals to:

o Hide location

o Evade detection

o Conduct illegal activities anonymously

3. Phishing

 Fraudulent attempts to obtain sensitive information by pretending to

be a trustworthy entity (via email, SMS, fake websites).

 Methods include:

o Spear Phishing: Targeted attacks.

o Whaling: Targeting high-profile individuals.

 Goal: Steal login credentials, financial information.

4. Password Cracking

 Techniques to guess or decrypt passwords:

 o Brute Force Attack: Trying all possible combinations.

o Dictionary Attack: Using common words and passwords.

o Rainbow Table Attack: Using precomputed hashes.

 Tools: John the Ripper, Hashcat.

5. Keyloggers and Spywares

 Keyloggers: Software or hardware that records keystrokes to capture

passwords, messages.

 Spyware: Software that secretly monitors user activity, collects data.

 Spread via infected downloads, emails, or malicious websites.

6. Viruses and Worms

 Virus: Malicious code that attaches to files/programs and spreads

when executed.

 Worm: Self-replicating malware that spreads across networks without

user intervention.

 Effects:

o Data corruption

o System slowdown

o Network congestion

7. Trojan Horses and Backdoors

 Trojan Horse: Malware disguised as legitimate software that tricks

users into installing it.

 Backdoor: Secret access point created by malware for attackers to

remotely control the system.

 Trojans can open backdoors for further exploits.

8. Steganography

 Technique of hiding data within other files (images, audio, video).

 Used to secretly transmit malicious code or confidential information

without detection.

9. DoS and DDoS Attacks

 Denial of Service (DoS): Flooding a server with excessive requests to

make it unavailable.

 Distributed DoS (DDoS): Multiple compromised systems (botnets)

launch attacks simultaneously.

 Causes downtime, loss of revenue.

10. SQL Injection

 Exploiting vulnerabilities in web applications by injecting malicious SQL

code.

 Allows attackers to:

o Retrieve, modify, or delete database data.

o Bypass authentication.

 Prevented by input validation and parameterized queries.

11. Buffer Overflow

 Attack where excess data overruns a buffer’s boundary in memory.

 Can allow attackers to execute arbitrary code or crash systems.

 Exploits poorly written programs.

12. Attacks on Wireless Networks

 Exploits on Wi-Fi networks include:

o Eavesdropping: Intercepting wireless traffic.

 o Rogue Access Points: Fake APs to capture data.

o Man-in-the-Middle Attacks.

o WEP/WPA Cracking: Breaking weak encryption standards.

PHISHING AND IDENTITY THEFT

1. Introduction to Phishing

 A cyber attack aimed at tricking users into providing personal

information.

 Common forms:

o Emails pretending to be from banks, social media, online

services.

o Fake websites resembling legitimate ones.

 Used to steal login credentials, credit card info, and personal identity
data.

2. Identity Theft (ID Theft)

 Unauthorized use of someone’s personal information for fraudulent

purposes.

 Types:

o Financial Identity Theft: Using info to commit fraud or theft.

o Criminal Identity Theft: Using someone else’s identity while

committing crimes.

o Medical Identity Theft: Using another’s medical info.

 Methods include:

o Phishing

o Data breaches

o Social engineering
Summary: Cybercriminals employ a wide array of tools and methods—from
phishing and password cracking to complex attacks like SQL injection and
DDoS—to compromise security. Awareness and strong countermeasures are
critical in defense.
Ut4

UNDERSTANDING COMPUTER FORENSICS

1. Introduction

 Computer Forensics: The process of identifying, preserving,

analyzing, and presenting digital evidence in a legally acceptable
manner.

 Helps in investigating cybercrimes and digital disputes.

 Involves recovering data from computers, networks, mobile devices,

and storage media.

2. Digital Forensics Science

 A branch of forensic science focused on digital devices.

 Combines knowledge from law, IT, and investigative techniques.

 Ensures data integrity and evidentiary standards.

3. The Need for Computer Forensics

 Cybercrime rise: hacking, data theft, fraud.

 Electronic evidence is volatile and can be easily altered.

 Provides critical support for legal cases and internal investigations.

 Helps in incident response and risk mitigation.

4. Cyber Forensics and Digital Evidence

 Digital Evidence: Any data stored or transmitted electronically that

can be used in court.

 Includes emails, files, logs, internet history, chat messages.

 Requires careful handling to avoid tampering.

 Must maintain authenticity, integrity, and admissibility.

5. Forensics Analysis of E-Mail

 Examination of headers to trace origin and route.

 Analysis of email body for content and attachments.

 Detect phishing attempts, spoofing, and malicious payloads.

 Recovery of deleted emails if possible.

6. Digital Forensics Life Cycle

1. Identification: Detecting and locating potential evidence.

2. Preservation: Securing and protecting the evidence from alteration.

3. Collection: Gathering data in a forensically sound manner.

4. Examination: Using tools to extract relevant information.

5. Analysis: Interpreting data to understand what happened.

6. Presentation: Reporting findings clearly for legal proceedings.

7. Decision: Based on findings, deciding next actions (e.g., prosecution).

7. Chain of Custody Concept

 Documentation process to track evidence from collection to

presentation.

 Records who collected, handled, transferred, and stored evidence.

 Ensures evidence integrity and helps prevent tampering

accusations.

8. Network Forensics

 Captures and analyzes network traffic data.

 Used to investigate cyberattacks, data breaches, and intrusions.

 Tools monitor packet data, IP addresses, timestamps.

  Helps reconstruct attack timelines and identify perpetrators.

9. Approaching a Computer Forensics Investigation

 Define scope and objectives.

 Secure the scene to prevent evidence loss.

 Create forensic images (bit-by-bit copies) of storage media.

 Use write-blockers to prevent data modification.

 Apply forensic tools and document all steps meticulously.

 Maintain strict chain of custody.

FORENSICS AND SOCIAL NETWORKING SITES

1. Security and Privacy Threats

 Social networks collect vast personal data.

 Threats include identity theft, cyberstalking, social engineering attacks.

 Malware distribution via social media.

 Privacy risks due to data sharing and third-party app integrations.

2. Challenges in Computer Forensics

 Huge volume and diversity of data.

 Encryption and anti-forensics techniques used by criminals.

 Cloud storage complicates data retrieval.

 Jurisdictional issues across different countries.

 Rapidly evolving technology demands constant skill upgrades.

Summary: Computer forensics plays a vital role in cybercrime investigation

by extracting and preserving digital evidence. However, the complexity of
digital environments, especially social networks, presents unique challenges
that forensic experts must navigate carefully.
Ut 5

INTRODUCTION TO SECURITY POLICIES AND CYBER LAWS

1. Need for an Information Security Policy

 Defines rules and practices to protect organizational data.

 Ensures confidentiality, integrity, and availability of information.

 Helps in risk management and compliance with laws.

 Sets clear responsibilities for employees.

 Provides guidelines for incident handling and response.

 Builds trust with customers and partners.

2. Introduction to Indian Cyber Law

 Governed mainly by the Information Technology Act, 2000 (IT

Act).

 Provides legal framework for electronic governance and cybercrime

prevention.

 Covers offenses like hacking, identity theft, cyber terrorism, data

protection.

 Establishes penalties and legal procedures for cyber offenses.

 Evolved with amendments and related regulations to address emerging

cyber threats.

3. Objective and Scope of the Digital Personal Data Protection Act

2023

 Aims to protect personal data of individuals in digital space.

 Regulates how personal data is collected, stored, processed, and

shared.

 Establishes rights for data principals (users) and obligations for data
fiduciaries (organizations).
  Ensures transparency and accountability in data handling.

 Applies to all digital platforms operating in India.

 Promotes data security, privacy, and user consent mechanisms.

4. Intellectual Property Issues

 Protection of creations of the mind: inventions, literary works, designs,

symbols.

 Prevents unauthorized use or duplication.

 Encourages innovation and creativity.

 Important in the digital age due to ease of copying and distribution.

5. Overview of Intellectual Property Related Legislation in India

 Patents Act, 1970: Protects inventions and new processes.

 Copyright Act, 1957: Protects literary, artistic works, software,

music, films.

 Trademarks Act, 1999: Protects brand names, logos, and symbols.

 Designs Act, 2000: Protects industrial designs and aesthetics.

 Enforcement through courts and Intellectual Property Offices.

6. Patent

 Exclusive rights granted to an inventor for a limited period (usually 20

years).

 Protects new inventions, processes, or improvements.

 Requires novelty, inventiveness, and industrial applicability.

 Allows patent holder to prevent others from making, using, or selling

the invention.

7. Copyright
  Protects original literary, artistic, dramatic, and musical works.

 Covers software code, books, music, films, paintings.

 Provides exclusive rights to reproduce, distribute, perform, or display

the work.

 Duration usually life of author + 60 years.

8. Trademarks

 Distinctive signs, logos, or names used to identify goods or services.

 Helps consumers identify the source and quality.

 Can be renewed indefinitely.

 Prevents unauthorized use that causes confusion or damages brand

reputation.

Summary

Information Security Policies provide organizational safeguards, while Indian

Cyber Laws and the Digital Personal Data Protection Act regulate legal
aspects of cyberspace and data privacy. Intellectual Property laws protect
creators’ rights, fostering innovation and trust in digital environments.