1. Boot Sector virus: A boot sector virus stays resident by infecting the boot sector of the computer
2. MBR Virus: A Master boot record (MBR) virus infect the first physical sector of all affected disks
3. File viruses either replace or attach themselves to executable files, and most commonly found virus
4. Macro virus attaches itself to documents in the form of macros.
5. Memory viruses are viruses that execute and stay resident in memory. Trojan Horse is an example of memory virus.
6. Trojan Horse: A trojon is not a virus. The principal of variation between a Trojan horse, or Trojan, and a virus is that Trojans don't spread themselves. Trojan horses disguise themselves as valuable and useful software available for download on the internet. Trojan may work as a client software on your computer communicating with the Trojan server over the Internet.
7. Social Engineering: Social engineering is a skill that an attacker uses to trick an innocent person such as an employee of a company into doing a favor. For example, the attacker may hold packages with both the hands and request a person with appropriate permission to enter a building to open the door. Social Engineering is considered to be the most successful tool that hackers use.
8. Script file virus: Note that script files may include viruses hidden inside. Therefore, it is not wise to open any script file attachments such as file.scr or file.bat etc.
9. Malware: Malware includes computer viruses, worms, trojan horses, spyware, dishonest adware, and other malicious and unwanted software.
10. Browser Hijacker: A browser hijacker is a form of malware, spyware or virus that replaces the existing internet browser home page, error page, or search page with its own. These are generally used to force hits to a particular website.
Social Engineering involves following threats
1. Shoulder surfing: shoulder surfing refers to using direct observation techniques, such as looking over someone's shoulder, to get information. It is commonly used to obtain passwords, PINs, security codes, and similar data. Shoulder surfing is particularly effective in crowded places because it is relatively easy to observe someone as they fill out a form, enter their PIN at an automated teller machine or a POS terminal, or enter a password at a cybercafe, public and university libraries, or airport kiosks. Shoulder surfing can also be done at a distance using binoculars or other vision-enhancing devices. Inexpensive, miniature closed-circuit television cameras can be concealed in ceilings, walls or fixtures to observe data entry. To prevent shoulder surfing, it is advised to shield paperwork or the keypad from view by using one's body or cupping one's hand.
2. Phishing phone calls: Cybercriminals might call you on the phone and offer to help solve your computer problems or sell you a software license. Neither Microsoft nor our partners make unsolicited phone calls (also known as cold calls) to charge you for computer security or software fixes.
3. Social Engineering: Social Engineering threats involve gaining trust of an employee or an insider of an organization. Once they've gained your trust, cybercriminals might ask for your username and password or ask you to go to a website to install software that will let them access your computer to fix it. Once you do this, your computer and your personal information is vulnerable. You may reduce the threat due to social engineering by treating all unsolicited phone calls with skepticism and not providing any personal information on such calls.
Some of the common attacks
Zero day attack: A Zero day attack is an exploit of an operating system or software vulnerability that is unknown to and unpatched by the author of the product. The name comes from the fact that there is no warning of the attack and this is compounded by the fact that the attack will be successful until it is discovered and patched by the vendor. It does not take long for a zero day attack to be effective considering the time it takes to program a patch and get it distributed to the public. These attacks can take place between the time they are discovered and when the patch is issued.
Zombie/botnet: When discussing a Zombie and its relationship to a botnet, think of an army of zombies. With your PC as one of the potentially millions of PCs infected with the same malware and commandeered by a single host. The entity that controls the botnet can literally use the machines for a single purpose like a DDoS, Spam or malware distribution. Hundreds of billions of dollars in losses or damage can be attributed to botnets.
Brute forcing: Brute forcing (Brute Force Cracking) can be best described as cracking a username, password, or even a Wi-Fi encryption protocol or decryption key by using trial, error and result evaluation using a pre-defined set of values for the attack. Use long and complex passwords to defend against this attack.
Dictionary attacks: Dictionary attacks are a form of brute force attack that uses words found in the dictionary to attempt to discover passwords and decryption keys. Here you need to avoid words found in the dictionary for your security. It is helpful to use a mix of upper and lower case letters along with numbers and special characters (!@#$%).
Tailgating attack: Another social engineering attack type is known as tailgating or “piggybacking.” These types of attacks involve someone who lacks the proper authentication following an employee into a restricted area. In a common type of tailgating attack, a person impersonates a delivery driver and waits outside a building. When an employee gains security’s approval and opens their door, the attacker asks that the employee hold the door, thereby gaining access off of someone who is authorized to enter the company. Tailgating does not work in all corporate settings, such as in larger companies where all persons entering a building are required to swipe a card. However, in mid-size enterprises, attackers can strike up conversations with employees and use this show of familiarity to successfully get past the front desk.
