Cybersecurity guide for developing countries II.2.4 Defacement attacks A defacement attack is carried out by replacing the victim’s web page with another, where the content of the new page (e.g. pornographic, political) will depend on the hacker’s motives. One variation on this type of attack involves redirecting users to a decoy website that looks exactly the same as the one they were accessing, where they are asked to disclose their credit card information, for example. This is done in phishing attacks, for example. The content of websites can also be defaced for purposes of disinformation (to influence events, sow uncertainty, manipulate public opinion, etc.). These are semantic attacks, which subvert the meaning of the information content, and fall into the category of infowar. II.2.5 Spoofing attacks All TCP/IP (transmission control protocol/internet protocol) protocols can be corrupted and used to breach system security. Protocols and mechanisms that transport data through a network are equally at risk. Thus, it is possible to hijack a TCP session during a client-server working session. TCP functions by establishing a logical connection between two correspondents and supporting the exchange of application data between the two. To connect distributed applications, TCP uses port numbers, the logical identifiers of applications. Some are fixed, reserved for particular programs, and well-known by the users; others are allocated dynamically during the connection, according to a specific algorithm. A TCP port number attack involves guessing or predicting the next port numbers to be allocated for data exchange in order to use them in the place of the legitimate user, effectively hijacking them. This makes it possible to pass through firewalls and establish a “secure” connection between two entities (the hacker and the target). Meanwhile, the legitimate remote user’s access to the facility is of course blocked, but it is simple enough just to send him a message saying that the requested system is inactive. User datagram protocol (UDP) is a level 4 (transport), connectionless protocol. It is an alternative to using TCP for the rapid transfer of a small volume of data. UDP communications are not subject to any control mechanisms, so there are no checks for identification, flow or error. As a result, anyone can use the IP address of an authorized system user in order to penetrate it. UDP session theft can take place without alerting the application servers. Since the functioning of the various protocols is public information, it is relatively easy to misuse them, for example to generate false packets in order to overwhelm a network, in a denial-of-service attack. This illustrates the need for security in relation to the availability of networks and services. Hackers exploit protocols and their limitations to: – paralyse networks; – redirect IP packets to a false destination (their own, for example); – overload systems by deluging them with junk messages; – prevent a sender from transmitting data; – take control of the flow of packet transmission, impeding the circulation of network traffic and degrading its performance (reliability, dependability, etc.). Cyberattacks 45