Worked Examples
Detailed analysis of security threats and attacks
How to Use These Examples
Study each worked example to understand how attacks work, their purpose, and how to identify them.
Example 1: Analysing a Phishing Email
Scenario
A user receives this email. Analyse it to identify phishing indicators.
From: accounts@amaz0n-security.com
Subject: Your Order #298-4827591 Cannot Be Shipped
To: customer@email.com
Dear Valued Customer,
We were unable to process payment for your recent order. Your account has been temporarily limited.
To restore access to your account and complete your order, please verify your payment information immediately:
http://amaz0n-verify.suspicious-domain.com/account/verify
If you do not verify within 24 hours, your order will be cancelled and your account may be permanently suspended.
Amazon Customer Service
Analysis
Step 1: Check the sender's email address
accounts@amaz0n-security.com
- 🚩 Uses "0" (zero) instead of "o" in "amazon"
- 🚩 Domain is "amaz0n-security.com" not "amazon.com"
- Legitimate Amazon emails come from @amazon.com or @amazon.co.uk
Step 2: Analyse the greeting and tone
- 🚩 Generic greeting "Dear Valued Customer" - real companies use your name
- 🚩 Creates urgency and fear ("temporarily limited", "permanently suspended")
- Pressure tactics are a key social engineering technique
Step 3: Examine the link
http://amaz0n-verify.suspicious-domain.com/account/verify
- 🚩 Uses HTTP, not HTTPS (no encryption)
- 🚩 Domain is "suspicious-domain.com" - not Amazon
- 🚩 "amaz0n-verify" is just a subdomain to trick users
- Legitimate Amazon links would go to amazon.com or amazon.co.uk
Step 4: Conclusion
Verdict: This is a PHISHING email
Attack type: Social Engineering
Purpose: Steal login credentials and/or payment information
Action: Delete the email. If concerned about an order, go directly to amazon.com and log in there.
Example 2: Understanding SQL Injection
Scenario
A website has a login form. The backend code constructs a SQL query like this:
query = "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'"
Explain how an attacker could exploit this vulnerability.
Analysis
Step 1: Normal login attempt
User enters: Username: alice Password: mypassword
SELECT * FROM users WHERE username='alice' AND password='mypassword'
Result: Returns Alice's record only if both username AND password are correct.
Step 2: Attack attempt
Attacker enters: Username: ' OR '1'='1 Password: ' OR '1'='1
SELECT * FROM users WHERE username='' OR '1'='1' AND password='' OR '1'='1'
Result: '1'='1' is ALWAYS true, so this returns ALL users!
Step 3: Why this works
| Original Query Part | With Injected Code | Effect |
|---|---|---|
username='alice' |
username='' OR '1'='1' |
Always true (bypass username check) |
password='mypassword' |
password='' OR '1'='1' |
Always true (bypass password check) |
Step 4: Other possible attacks
Delete all users:
'; DROP TABLE users; --
Extract all data:
' UNION SELECT * FROM credit_cards --
Summary
Vulnerability: User input is directly inserted into SQL without validation
Purpose: Bypass authentication, steal data, modify/delete records
Prevention: Use parameterised queries, input validation, prepared statements
Example 3: DDoS Attack on an Online Store
Scenario
On Black Friday, an online retailer's website becomes unavailable. Their network monitoring shows:
- Normal traffic: 10,000 requests per minute
- Current traffic: 5,000,000 requests per minute
- Requests coming from 50,000+ different IP addresses worldwide
- Many requests from IoT devices (cameras, routers)
Analyse this attack.
Analysis
Step 1: Identify the attack type
Attack: DDoS (Distributed Denial of Service)
- Traffic is 500x normal levels
- Coming from many different sources (distributed)
- Purpose is to make the service unavailable (denial of service)
Step 2: Identify the source
Source: A botnet of compromised IoT devices
- 50,000+ unique IP addresses suggests a large botnet
- IoT devices (cameras, routers) are often poorly secured
- Device owners likely don't know their devices are infected
Step 3: Assess the impact
| Impact Type | Description |
|---|---|
| Immediate | Website completely unavailable to customers |
| Financial | Lost sales on busiest shopping day of the year |
| Reputation | Customers lose trust, may shop elsewhere |
| Long-term | Need to invest in DDoS protection infrastructure |
Step 4: Possible motives
- Extortion: "Pay us to stop the attack"
- Competition: Rival business sabotage
- Hacktivism: Protest against the company
- Distraction: Cover for another attack (data theft)
Example 4: Ransomware Infection
Scenario
An employee receives an email with an attachment called "Invoice_March.pdf.exe". After opening it, the following sequence occurs:
- Nothing appears to happen initially
- 30 minutes later, files start becoming inaccessible
- File icons change to a padlock symbol
- A message appears demanding payment
Explain what happened at each stage.
Analysis
Stage 1: Initial Infection
The attachment "Invoice_March.pdf.exe"
- Appears to be a PDF but is actually an executable (.exe)
- Uses double extension to trick users
- This is a Trojan - disguised as legitimate file
Stage 2: Preparation (30-minute delay)
During this time, the ransomware:
- Disables security software (antivirus)
- Deletes shadow copies (Windows backup points)
- Scans for valuable files (documents, photos, databases)
- Connects to attacker's server to get encryption key
- Spreads to network drives and other connected computers
Stage 3: Encryption
The ransomware encrypts files:
- Uses strong encryption (typically AES-256)
- Targets documents, images, videos, databases
- Changes file extensions (e.g., .encrypted, .locked)
- Only the attacker has the decryption key
Stage 4: Ransom Demand
Typical ransom message:
- Demands cryptocurrency payment (Bitcoin, Monero)
- Includes deadline with increasing price
- Threatens permanent deletion if not paid
- May provide "proof" by decrypting one file free
Summary
Attack chain: Social Engineering (email) → Trojan → Ransomware
Purpose: Extort money by holding data hostage
Prevention: Don't open unexpected attachments, keep backups offline, train staff to recognise threats
Practice Problems
Practice 1: Identify the Attack
A company's security logs show login attempts from a single IP address trying these passwords in sequence: 123456, password, qwerty, letmein, admin123, welcome1...
What attack is this and what type of technique is being used?
Practice 2: Man-in-the-Middle
A user connects to a public WiFi network called "Free Airport WiFi". They visit their bank's website, but the padlock icon doesn't appear. They enter their credentials anyway. Later, money is stolen from their account.
What type of attack occurred and how did it work?
Practice 3: Social Engineering
An attacker calls a company's IT helpdesk: "Hi, this is Mike from the London office. I'm locked out of my account and I have an important presentation in 10 minutes. Can you reset my password to something temporary?"
What social engineering technique is being used?