Script-based Cyber Attacks

The process of identifying and establishing attribution and motive in both cyber-attacks and counter attacks is often a problematic/challenging process. This is largely due to events often being undocumented and unverified, because of the uncertainty regarding their timing, extent, cause, and specific mechanisms of execution. Yet such attacks can upend critical infrastructure and impair their ability to avail key information for during crucial national events such as an election. The very borderless nature of cyberspace means that adversaries could be " thousands of miles away or in the very next cubicle at work, or both! " Cases that pertain to hacking should, therefore, pay special attention to the unknown hackers operating from both the outside and inside and play close attention to both domestic and international realms in their lines of inquiry. A targeted organization " s insiders are a much greater threat and can do far greater damage as they already have some level of access, means, and opportunity to hack. They can directly contribute to increased vulnerability, in a myriad of ways, including the creation of backdoors in systems which they can then exploit when stakes are high. By drawing upon Zimbabwe " s 2018 election as a case study, this paper painstakingly attempts to connect the dots between seemingly disparate cyber threats that took place on 1 August 2018 and to provide an analysis that positions them in their appropriate context in order to establish a connection, attribution, and motive. It also assesses the impact such events had on the election outcome. This will contribute to an evidence-based threat model which examines multiple attack vectors like data weaponization and white hat hacking for political reasons in the context of censorship and resistance in cyberspace. While the paper does not generate definitive conclusions on the events that occurred in Zimbabwe, the systematic analysis opens up new lines of inquiry in understanding the Zimbabwean attack vectors and related situations elsewhere.

‘Web-based Cyber Attacks’ for leaking private
information or making target system to denial of
service (DoS) are arising. Traditional Web-based
cyber attacks hide malwares in the Web pages to
make it install and make the client under control.
Nowadays, however, these attacks have evolved to
‘Script-based Cyber Attacks’ which infect the
visitors just by accessing a certain Web page, not
using malwares. Traditional Web-based cyber
attacks can be protected by detecting malwares, but
script-based cyber attacks cannot be protected by
the former method because no malwares are
detected. Therefore, new architecture is necessary to
prevent malicious behaviors on Web browsers. In
this paper, a protection architecture is introduced to
detect the connection requests for URLs which are
used by the attacker, to detect Web pages which
have malicious scripts, and to prevent the execution
of the malicious JavaScript codes.

Recent web-based cyber attacks are evolving into a new form of attacks such as private information theft and DDoS attack exploiting JavaScript within a web page. These attacks can be made just by accessing a web site without distribution of malicious codes and infection. Script-based cyber attacks are hard to detect with traditional security equipments such as Firewall and IPS because they inject malicious scripts in a response message for a normal web request. Furthermore, they are hard to trace because attacks such as DDoS can be made just by visiting a web page. Due to these reasons, it is expected that they could result in direct damages and great ripple effects. To cope with these issues, in this article, a proposal is made for techniques that are used to detect malicious scripts through real-time web content analysis and to automatically generate detection signatures for malicious JavaScript.