Cybersecurity Attack Vectors
├── 1. Buffer Overflow Attacks
│ ├── Stack Overflows
│ ├── String Overflows
│ ├── Heap Overflows
│ └── Integer Overflows
│
├── 2. Internal Attacks
│ ├── Emails
│ ├── Mobile Phones
│ ├── Instant Messengers
│ ├── FTP Uploads
│ ├── Dumpster Diving
│ └── Shoulder Surfing
│
└── 3. DoS (Denial of Service) Attacks
├── Ping of Death
├── Teardrop
├── SYN Flooding
├── Land Attacks
├── Smurf Attacks
├── UDP Flooding
├── Hybrid DoS Attacks
├── Application Specific Attacks
└── Distributed DoS (DDoS) Attacks
Buffer overflow attacks are a classic yet serious type of security vulnerability, especially in low-level languages like C and C++. These attacks happen when a program writes more data into a memory buffer than it was meant to hold. But why is that so dangerous?
In most systems, memory is organized in predictable ways. If too much data spills into the wrong place, it can overwrite critical information — like where the program should go next. In some cases, attackers can even insert their own code and take control of the program.
Let’s break down the different ways buffer overflows can happen, and how attackers use them.
The stack is where your program stores local variables and keeps track of function calls. It works like a stack of plates — last-in, first-out (LIFO). A stack overflow occurs when too much data is pushed onto this stack.
This is one of the most common and dangerous types of buffer overflow. That’s why unsafe
functions like gets() or strcpy() (which don’t check input size) are
avoided in secure coding.
String overflows are a type of buffer overflow where unbounded input overflows a string buffer. These are especially common in C-style strings (null-terminated character arrays).
One of the first big internet worms — the Morris Worm — used string overflow to spread. That’s
why functions like strncpy() and proper input validation are important.
The heap is used for dynamically allocated memory — the kind created with malloc()
or new. Heap overflows happen when data written to the heap goes beyond its
allocated space.
Heap overflows are trickier to exploit than stack overflows, but just as dangerous. Luckily, modern protections like heap canaries help detect and prevent them.
Integer overflows occur when a calculation exceeds the maximum value a variable type can store. Alone, they aren’t buffer overflows — but they often lead to one.
These bugs are easy to overlook but can be a stepping stone to more serious vulnerabilities.
Developers and security teams use several strategies to prevent buffer overflows. Here’s how they keep things safe:
These attacks aren’t just theoretical. Let’s look at some famous real-world cases where buffer overflows caused serious damage:
finger service on Unix to execute remote code and
spread rapidly.
These examples show that buffer overflow vulnerabilities can affect any system — from personal computers to massive web servers. That’s why secure coding, proper testing, and memory protection features are absolutely essential.
When we think of cyberattacks, we often picture hackers trying to break in from the outside. But surprisingly, some of the most serious security threats come from within the organization itself. These are known as internal attacks — and they’re especially risky because the attacker usually has legitimate access and is trusted.
Internal threats can come from employees, contractors, or even careless behavior. Let’s take a closer look at how common tools like emails, mobile phones, or even trash bins can be misused to compromise security.
Email is a vital tool for communication — and unfortunately, it’s also one of the easiest ways for insiders to cause damage.
To stay protected, organizations rely on tools like email monitoring, employee training, and data loss prevention (DLP) systems.
Smartphones are everywhere — and while they make life easier, they also introduce security risks inside the workplace.
That’s why many companies use Mobile Device Management (MDM) solutions and limit phone use in sensitive areas.
Messaging tools like Slack, WhatsApp, or Microsoft Teams help teams communicate faster — but they can also become invisible routes for data leaks.
Even innocent-looking messages or links can lead to serious issues if not properly monitored.
FTP (File Transfer Protocol) is used to transfer files quickly — but it can also be misused by insiders.
Secure alternatives like SFTP, along with access control and logging, can help stop this kind of misuse.
Not all threats involve computers. Dumpster diving means going through physical trash to find sensitive materials that were thrown away carelessly.
Simple steps like shredding documents and using secure disposal bins can prevent such risks.
Sometimes, all an attacker needs is to quietly watch someone at work. Shoulder surfing involves observing a person as they enter passwords, view sensitive data, or type private information — often without realizing they're being watched.
Using screen privacy filters, auto-lock settings, and training employees to stay alert can reduce this kind of risk.
Internal attacks aren’t always high-tech hacks — they’re often subtle, everyday actions that go unnoticed. What makes them dangerous is that the person involved often knows the system and already has access.
From emails and mobile devices to physical trash and peeking eyes, there are many ways an insider threat can take shape. That’s why building a strong defense means not just using the right tools, but also creating a culture of awareness among employees.
Internal Attacks: Security threats from within an organization by trusted insiders like employees or contractors.
Internal Threat Sources: Can arise from misuse of emails, phones, messengers, file uploads, or careless behavior.
Email Risks: Insiders may send confidential data or fall for phishing disguised as internal communication.
Phone Risks: Can be used to capture confidential data or transfer files via USB/Bluetooth or malicious apps.
Messenger Risks: Sensitive data can be shared in chats or used by attackers to coordinate breaches.
FTP Risks: Used to transfer confidential data to external servers without detection.
Physical Threats: Sensitive info like reports, USBs, or passwords may be retrieved from trash.
Visual Snooping: Attackers may observe passwords or sensitive data in public or shared spaces.
Imagine trying to enter a shop, but someone keeps blocking the doorway so customers can’t get in. That’s exactly what a Denial of Service (DoS) attack does to websites or online services — it overwhelms them with fake traffic or corrupted requests, preventing real users from accessing them.
DoS attacks come in various types, each targeting the system in a unique way. Let’s explore some of the most common kinds and how they work.
Ping is a basic network tool that sends a small message to another computer to check if it’s reachable and how fast it responds. It’s like tapping someone on the shoulder to see if they’re there.
The Ping of Death attack sends very large or broken ping messages that a computer can’t handle properly. Normally, a computer easily responds to pings, but when bombarded with these oversized or damaged packets, it can freeze or crash. Imagine getting confusing or incomplete messages repeatedly until your brain just stops working—that’s what this attack does to a computer.
Here, data packets are broken into fragments but not properly reassembled by the target system. When the system tries to put the pieces back together, it fails and may crash. It’s like trying to fit jigsaw pieces that simply don’t belong together — pretty frustrating, right?
This attack exploits how two computers start communication through a "three-way handshake." The attacker sends many half-open connection requests but never completes them. This leaves the server waiting, eventually running out of resources to serve legitimate users.
This keeps repeating until the server can’t handle any more real connections.
A Land Attack fools a computer by sending a network request where the source and destination IP addresses are exactly the same. This confuses the system, making it try to communicate with itself over and over without stopping. It’s like calling your own phone number and getting stuck in an endless loop of ringing and answering your own call.
This clever attack spoofs the attacker’s IP address and sends ping requests to multiple devices, asking them all to reply to the victim’s IP address. The victim is then flooded with replies from hundreds or thousands of devices.
In this attack, the target is flooded with numerous UDP packets sent to random ports. The system looks for applications to handle these packets but, failing to find any, sends back error messages that quickly consume resources.
Some attackers combine several attack methods simultaneously — like SYN flooding mixed with ping floods or other techniques. These hybrid attacks are harder to detect because they use multiple strategies to overwhelm the system.
These attacks target specific applications — such as a web server, database, or login page — rather than the entire network. They overload the part of the app that handles the most work, causing it to slow down or become unusable.
DDoS attacks are like DoS attacks on steroids. Instead of one attacker, a network of many compromised devices (called a "botnet") flood the target simultaneously. Imagine hundreds of people trying to enter a small shop at once — no one else can get in, and the system collapses.
Protecting against DoS and DDoS attacks is essential because these attacks don’t just crash websites — they cost money, damage trust, and sometimes even disrupt critical services.
DoS Attack: Overwhelms websites or services with fake traffic or corrupted requests to block legitimate access.
Types of DoS Attacks: Various methods target systems differently to cause disruption.
1. Ping of Death: Floods system with oversized or malformed ping packets causing crashes or freezes.
2. Teardrop Attack: Sends fragmented packets that the system fails to reassemble, causing crashes.
3. SYN Flood: Sends many half-open connection requests, exhausting server resources.
Effect: Server is left waiting, denying legitimate connections.
4. Land Attack: Sends packets with identical source and destination IPs, causing system to loop endlessly.
5. Smurf Attack: Spoofs attacker IP to send ICMP requests to multiple devices, flooding victim with replies.
6. UDP Flood: Sends many UDP packets to random ports causing resource exhaustion from error replies.
7. Hybrid DoS: Combines multiple attack methods simultaneously to evade detection and increase impact.
8. Application-Specific Attack: Targets specific applications to overload and disrupt service.
9. DDoS Attack: Uses many compromised devices (botnet) to flood target, causing system collapse.
Protection Importance: DoS/DDoS attacks cause downtime, financial loss, reputational damage, and service disruption.