Threats, Attacks and How They Work

A botnet is a network of compromised machines under one controller. The owners do not know. Botnets are rented out, and they are what makes a large denial of service attack possible.

Attacks on people: social engineering

The technical controls are usually sound and the person is not, and most successful attacks begin here.

Phishing is a message that pretends to come from somebody trusted and asks for credentials or a payment. The classic is an email that appears to be from a bank with a link to a page that looks like the bank's. It engages section 66C, identity theft, and section 66D, cheating by personation using a computer resource, and chapter 1210 works those.

Spear phishing is phishing aimed at one person, using facts about them, and it is far more effective. Business email compromise is its commercial form: an email that appears to come from a director instructing a payment, or from a supplier changing its bank details, which is the fact pattern chapter 120 works.

Vishing and smishing are the same attack by voice call and by text message.

Pretexting is inventing a situation that makes the request seem normal, such as calling as the information technology helpdesk and asking a new employee to confirm a password.

None of these is a technical failure, which is why rule 8(1) of the SPDI Rules requires managerial and operational controls and not only technical ones. Chapter 230 works it.

Attacks on the machine

Unauthorised access is using a system you are not permitted to use. It may be by a stolen or guessed credential, by an unpatched weakness in the software, or by a configuration mistake such as a database left open to the internet. Section 43(a) covers accessing or securing access without permission; section 66 makes it an offence if done dishonestly or fraudulently.

Exceeding authorised access is being permitted to use a system and doing more with it than permitted. The employee who is allowed to read one customer's file and reads ten thousand is the paradigm. In India section 43 turns on "without the permission of the owner", which covers it. In the United States the same question produced the litigation chapter 630 works.

A brute force attack tries passwords until one works. A dictionary attack tries likely ones. Credential stuffing tries username and password pairs leaked from some other service, which works because people reuse passwords.

Privilege escalation is turning ordinary access into administrator access, usually by exploiting a defect.

Injection attacks send input that the receiving program treats as an instruction. The best known is SQL injection, where text typed into a form is passed to the database as part of a query, so that typing the right characters into a login box can return the entire customer table. It requires no special access at all and is still among the commonest causes of large breaches.

A man in the middle attack sits between two parties, relaying and possibly altering what each sends while both believe they are talking directly. Encrypted connections and certificate checking exist to defeat it, which is the practical reason the certificate machinery of Module II matters.

Attacks on availability

A denial of service attack sends a machine more requests than it can answer, so that legitimate users cannot get through.

A distributed denial of service attack does the same from thousands of machines at once, usually a botnet, which makes it very hard to block because the traffic looks like ordinary users.

Section 43(f) covers denying or causing the denial of access to any person authorised to access, and section 43(e) covers disrupting a computer, computer system or computer network. Against a protected system or critical infrastructure, section 66F(1)(A) makes denial of access an act of cyber terrorism where the intent or knowledge that section requires is present. Chapter 1320 works it.

Attacks on the supply chain and on infrastructure

A supply chain attack compromises a supplier to reach its customers. Software update mechanisms are the usual route, because an update is trusted by definition.

Domain name system attacks send a user to the wrong machine. In pharming, the translation of a name to an address is corrupted so that a correct address in the browser reaches an attacker's server.

Website defacement replaces the content of a page, which is often political rather than acquisitive and engages section 43(i) and section 66, and section 66F where the target and the intent bring it within cyber terrorism.

The attacks and the provisions, side by side

A worked example

A distributor in Kolhapur receives an email that appears to be from its regular supplier in Ludhiana, saying the supplier's bank account has changed. The distributor pays twenty-two lakh rupees to the new account. The money is gone.

Step one: what actually happened? Two possibilities, and they have different legal consequences. Either the supplier's mailbox was compromised and the email really came from it, or the email was spoofed and merely looked as though it did. The headers answer this, and chapter 20 explains why they must be preserved before anything else.

If the mailbox was compromised, there was unauthorised access to the supplier's system under section 43(a), probably by phishing or credential stuffing. The supplier may be exposed under section 43A if it held the distributor's information and was negligent about security, and chapter 230 supplies the standard. The fraudster is caught by sections 66, 66C and 66D.

If the email was spoofed, no computer of the supplier was touched at all. The fraudster is still caught by sections 66C and 66D, because he used another person's unique identification feature and cheated by personation using a computer resource. The supplier is not exposed, and the distributor's own verification process becomes the issue.

In both cases the general penal law applies as well, section 318 of the Bharatiya Nyaya Sanhita on cheating, and chapter 1280 shows how the two statutes work together. The money is traced through the banking system, and the Reserve Bank's directions on unauthorised electronic transactions govern the bank's position.

The point of the example is that the legal analysis did not begin with a section. It began with a technical question about which machine was accessed.

What this does NOT mean

It does not mean every attack is an offence under this Act. Section 66 requires the act to be done dishonestly or fraudulently, so a security researcher who accesses a system to report a weakness commits a contravention under section 43 and may not commit the section 66 offence at all. Chapter 1180 works the mental element.

It does not mean the classification decides the section. The names in this chapter are technical usage, not statutory categories. The Act's categories are the ten clauses of section 43 and the offences in Chapter XI, and an answer should reason from those.

It does not mean the attacker is always outside the organisation. Most serious losses involve a person who was given access, which is why least privilege matters and why section 43's test is the owner's permission rather than physical intrusion.

Quick revision

• Malware: virus (needs a user), worm (spreads itself), trojan (pretends to be useful), ransomware (encrypts and demands payment, attacking availability), spyware and keyloggers, rootkits (hide), botnets (rented networks of compromised machines).
• Social engineering: phishing, spear phishing and business email compromise, vishing, smishing, pretexting. Most successful attacks begin here, and the failure is administrative rather than technical.
• On the machine: unauthorised access, exceeding authorised access, brute force, dictionary and credential stuffing, privilege escalation, injection including SQL injection, man in the middle.
• On availability: denial of service and distributed denial of service.
• Elsewhere: supply chain attacks, DNS attacks and pharming, defacement.
• The Act's own words are computer contaminant and computer virus, defined in the Explanation to section 43.
• Section 66 needs the act to be dishonest or fraudulent; section 43 does not.

Test yourself

1. Distinguish a virus, a worm and a trojan. A virus attaches to a file or program and spreads when that file is executed, so it needs a human act. A worm spreads by itself across a network by exploiting a defect, which is why it propagates so fast. A trojan is installed deliberately by the user because it appears to be something useful, and performs a hidden function as well.

2. Which clauses of section 43 does a ransomware attack engage, and why more than one? Clause (c) if a computer contaminant or virus was introduced; clause (d) for damage to data; clause (e) for disruption of the computer, computer system or computer network; and clause (f) for denial of access to authorised persons. More than one because the single attack simultaneously introduces malicious code, alters the data by encrypting it, disrupts the system's working, and locks out the people entitled to use it.

3. What is SQL injection and why is it a lawyer's concern? Input typed into an ordinary form is passed to the database as part of a query, so that carefully chosen characters cause the database to return or alter data the user was never entitled to. It is a lawyer's concern because it requires no credential and no privileged access, so a breach caused by it is almost always attributable to the defendant's own failure to validate input, which goes directly to the negligence question under section 43A and rule 8.

4. A security researcher accesses a company's server without permission, takes nothing, and reports the weakness. What is the position? He has secured access to a computer resource without the permission of the owner, so section 43(a) is engaged and a contravention has occurred, for which compensation may be claimed if damage is shown. Section 66 requires the act to be done dishonestly or fraudulently, and on those facts neither mental element is present, so the offence is not made out.

5. Why does the analysis of a business email compromise begin with the email headers? Because the legal consequences differ according to whether the supplier's mailbox was actually accessed or the message was merely spoofed. In the first case there was unauthorised access to the supplier's system and the supplier's own security may be in issue under section 43A; in the second no computer of the supplier was touched and only the fraudster is liable. Only the headers, and the mail server logs, distinguish the two, and both are volatile.