Computer crime - Forms of Attack

The growing economic value of information, products, and services accessible through computer systems has attracted increased attention from opportunistic criminals. In particular, the many potential vulnerabilities of online systems and the Internet have made computer crime attractive and pose significant challenges to professionals whose task it is to secure such systems.

The motivations of persons who use computer systems in unauthorized ways vary. Some hackers primarily seek detailed knowledge of systems, while others (often teenagers)
seek “bragging rights.” Other intruders have the more traditional criminal motive of gaining access to information such as credit card numbers and personal identities that can be used to make unauthorized purchases (see identity theft). Computer access can also be used to intimidate (see cyberstalking and harassment), as well as for extortion, espionage, sabotage, or terrorism (see cyberterr orism).


Attacking and defending information infrastructure is now a vital part of military and homeland security planning (see information warfare). According to the federal Internet Crime Complaint Center, in 2006 the most commonly reported computer-related
crime was auction-related fraud (44.9 percent), followed by nondelivery of goods (19 percent)—these no doubt reflect the high volume of auction and e-commerce transactions.

Various forms of financial fraud (including identity theft) make up most of the rest.
The new emphasis on the terrorist threat following September 11, 2001, has included some additional attention to cyberterrorism, or the attack on computers controlling key infrastructure (including banks, water and power systems, air traffic control, and so on). So far ideologically inspired attacks on computer systems have mainly mounted to simple electronic vandalism of Web sites. Internal systems belonging to federal agencies and the military tend to be relatively protected and isolated from direct contact with the Internet.

However, the possibility of a crippling attack or electronic hijacking cannot be ruled out. Commercial systems may be more vulnerable to denial-of-service attacks (see below) that cause economic losses by preventing consumers from accessing services.

Surveillance-based attacks involve scanning Internet traffic for purposes of espionage or obtaining valuable information. Not only businesses but also the growing number of Internet users with “always-on” Internet connections (see broadband) are vulnerable to “packet-sniffing” software that exploits vulnerabilities in the networking software or operating system. The main line of defense against such attacks is the software or hardware firewall, which both “hides” the addresses of the main computer or network and identifies and blocks packets associated with the common forms of attack (see firewall).

In the realm of harassment or sabotage, a “denial of service” (DOS) attack can flood the target system with packets that request acknowledgment (an essential feature of network operation). This can tie up the system so that a Web server, for example, can no longer respond to user requests, making the page inaccessible. More sophisticated DOS attacks can be launched by first using viruses to insert programs in a number of computers (a so-called botnet), and then instructing the programs to simultaneously launch attacks from a variety of locations.

Computer viruses can also be used to randomly vandalize computers, impeding operation or destroying data (see computer virus). But a virus can also be surreptitiously inserted as a “Trojan horse” into a computer’s operating system where it can intercept passwords and other information, sending them to the person who planted the virus. Viruses were originally spread through infected floppy disks (often “bootleg” copies of software). Today, however, the Internet is the main route of access, with viruses embedded in e-mail attachments. This is possible because many e-mail and other programs have the ability to execute programs (scripts) that
they receive. The main defense against viruses is regular use of antivirus software, turning off scripting capabilities unless absolutely necessary, and making a policy of not opening unknown or suspicious-looking e-mail attachments as well as messages that pretend to be from reputable banks or other agencies.

see phishing and spoofing.