Cybersecurity Threats
A threat is anything that can harm your data or systems. Knowing the common threats is the first step to stopping them.
Who Are the Attackers?
| Attacker | What they want |
|---|---|
| Scammers and cyber criminals | Money: bank details, wallet PINs, ransom payments |
| Hacktivists | To make a political point, often by defacing websites |
| Insiders | An unhappy employee who steals or deletes data |
| Script kiddies | Beginners who use ready-made tools to cause trouble |
| State-sponsored groups | Spying on governments and big companies |
Most people will never be targeted by a government. The real danger for ordinary users is everyday criminals who attack thousands of people at once.
Common Threats
Social Engineering
The attacker tricks a person instead of breaking a computer. Examples: a caller pretending to be from the bank, or a WhatsApp message from a "friend" asking for the six-digit code you just received. Phishing (next chapters) is the most common type.
Malware
Harmful software such as viruses, ransomware and spyware. It often arrives in cracked software, fake apps or email attachments.
Weak and Stolen Passwords
Attackers try common passwords or reuse passwords leaked from other websites. This is called credential stuffing.
Data Breaches
A company's database is stolen and leaked, exposing names, emails, phone numbers or passwords.
Denial of Service (DoS / DDoS)
Attackers flood a website with so much fake traffic that real users cannot reach it. This harms availability.
Insider Threats
Someone inside an organisation misuses their access, by mistake or on purpose.
Unpatched Software
Old versions of Windows, Android, WordPress plugins or routers have known weaknesses that attackers scan for.
Seeing Login Attacks in Logs
Servers record failed logins. On a Linux server, administrators can count failed SSH logins like this:
Example
grep "Failed password" /var/log/auth.log | wc -l1342
And see which IP addresses tried most often:
Example
grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -3 812 203.0.113.45
377 198.51.100.17
153 192.0.2.88These are automated bots guessing passwords. The fix is strong passwords, key-based login and tools that block repeated failures.
The IP addresses above come from ranges reserved for documentation. Real logs will show real addresses.
How Attacks Usually Happen
Most attacks follow similar steps:
- Research: the attacker collects information, often from social media
- First contact: a phishing link, a fake app, or a password guess
- Access: they get into one account or device
- Spread: they use that access to reach more accounts or computers
- Goal: steal money or data, or lock files for ransom
Breaking any step stops the attack. For example, two-factor authentication blocks step 3 even if your password is stolen.
Checking if Your Email Was in a Breach
Websites such as Have I Been Pwned let you check if your email appeared in a known data breach. Developers can also check whether a password has been leaked without sending the password itself, by sending only the first five characters of its SHA-1 hash:
Example
import hashlib
password = "pakistan123"
sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
print("Send only this prefix:", sha1[:5])Send only this prefix: FA6E8
The website returns a list of matching hashes, and your computer checks the rest locally. Your password never leaves your device.
Exercise
Exercise
An attacker calls a shop employee, pretends to be from the IT company and asks for the admin password. What type of threat is this?