🔐 Cyber Security Lesson 02 — Threats & Attacks

1. Malware Types

2. Phishing Attacks

Phishing = Fake email/website နဲ့ credentials ခိုးတာ

Types:
📧 Email Phishing   — Mass fake emails (PayPal, bank, etc.)
🎯 Spear Phishing   — Targeted specific person/company
🐋 Whaling          — CEO/executives ကို target
📱 Smishing         — SMS phishing
📞 Vishing          — Voice call phishing

Example phishing email:
┌─────────────────────────────────────────┐
│ From: support@paypa1.com                │
│ Subject: Your account will be suspended │
│                                         │
│ Click here to verify: http://paypa1.ru  │
└─────────────────────────────────────────┘
⚠️ Clues: Misspelled domain, Urgency, Suspicious link

3. Social Engineering

Social Engineering = Human psychology ကို exploit လုပ်တာ

Techniques:
🎭 Pretexting    — Fake identity (IT support လို ဟန်ဆောင်)
🤝 Baiting       — USB drive ချပစ် (curiosity exploit)
🔄 Quid Pro Quo  — Help offer → info ယူ
🚪 Tailgating    — Physical access (secure area ဝင်)
⏰ Urgency       — "ချက်ချင်း လုပ်ဖို့ လိုတယ်!" pressure

Example:
"IT Support ကနေ ဖုန်းဆက်တာပါ။ Server maintenance
လုပ်နေတာ password ကို verify လုပ်ရဦးမယ်..."
→ Real IT ဟာ password မတောင်းဘူး!

4. DoS / DDoS Attacks

DoS  = Denial of Service (one source)
DDoS = Distributed DoS (thousands of sources/botnet)

Goal: Server/Service ကို overwhelm ဖြစ်အောင် → DOWN ဖြစ်

Types:
📦 Volume-based  — Bandwidth flood (UDP/ICMP)
🔗 Protocol      — SYN flood (TCP handshake exhaust)
🌐 Application   — HTTP flood (Layer 7, hardest to detect)

DDoS impact:
- Website DOWN → revenue loss
- Record: 3.47 Tbps (Microsoft Azure, 2021)

5. Man-in-the-Middle (MITM)

MITM = User ↔ Server ကြားကနေ communication intercept

Scenarios:
☕ Public WiFi (coffee shop) → Attacker same network
🔀 ARP Spoofing → Traffic redirect
🌐 DNS Spoofing → Fake website ညွှန်

HTTP:
User → "username=ko&password=1234" → [ATTACKER sees!] → Server

HTTPS:
User → [encrypted] → [ATTACKER sees gibberish] → Server

6. Common Attack Summary