science

Web threat

Web threat is a science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Web threat rather than just read about it. In short: A web threat is any threat that uses the World Wide Web to facilitate cybercrime. Web threats use multiple types of malware and fraud, all of which utilize HTTP or HTTPS protocols, but may also employ other protocols and components, such as links in email or IM, or malware attachments or on servers that access the Web.

Key takeaways

Web threat belongs to science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Web threat to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Web threat from memory before moving on to harder problems.

Reference excerpt

A web threat is any threat that uses the World Wide Web to facilitate cybercrime. Web threats use multiple types of malware and fraud, all of which utilize HTTP or HTTPS protocols, but may also employ other protocols and components, such as links in email or IM, or malware attachments or on servers that access the Web. They benefit cybercriminals by stealing information for subsequent sale and help absorb infected PCs into botnets. Web threats pose a broad range of risks, including financial damages, identity theft, loss of confidential information/data, theft of network resources, damaged brand/personal reputation, and erosion of consumer confidence in e-commerce and online banking. It is a type of threat related to information technology (IT). The IT risk, i.e. risk affecting has gained and increasing impact on society due to the spread of IT processes.

Reaching path Web threats can be divided into two primary categories, based on delivery method – push and pull. Push-based threats use spam, phishing, or other fraudulent means to lure a user to a malicious (often spoofed) website which then collects information and/or injects malware. Push attacks use phishing, DNS poisoning (or pharming), and other means to appear to originate from a trusted source. Precisely-targeted push-based web threats are often referred to as spear phishing to reflect the focus of their data gathering attack. Spear phishing typically targets specific individuals and groups for financial gain. In other push-based web threats, malware authors use social engineering such as enticing subject lines that reference holidays, popular personalities, sports, pornography, world events and other hot topics to persuade recipients to open the email and follow links to malicious websites or open attachments with malware that accesses the Web. Pull-based web threats are often referred to as “drive-by” threats by experts (and more commonly as “drive-by downloads” by journalists and the general public), since they can affect any website visitor. Cybercriminals infect legitimate websites, which unknowingly transmit malware to visitors or alter search results to take users to malicious websites. Upon loading the page, the user's browser passively runs a malware downloader in a hidden HTML frame (IFRAME) without any user interaction.

Growth of web threats Giorgio Maone wrote in 2008 that "if today’s malware runs mostly runs on Windows because it’s the commonest executable platform, tomorrow’s will likely run on the Web, for the very same reason. Because, like it or not, the Web is already a huge executable platform, and we should start thinking of it this way, from a security perspective." The growth of web threats is a result of the popularity of the Web – a relatively unprotected, widely and consistently used medium that is crucial to business productivity, online banking, and e-commerce as well as the everyday lives of people worldwide. The appeal of Web 2.0 applications and websites increases the vulnerability of the Web. Most Web 2.0 applications make use of AJAX, a group of web development programming tools used for creating interactive web applications or rich Internet applications. While users benefit from greater interactivity and more dynamic websites, they are also exposed to the greater security risks inherent in browser client processing.

Examples In September 2008, malicious hackers broke into several sections of BusinessWeek.com to redirect visitors to malware-hosting websites. Hundreds of pages were compromised with malicious JavaScript pointing to third-party servers. In August 2008, popular social networking sites were hit by a worm using social engineering techniques to get users to install a piece of malware. The worm installs comments on the sites with links to a fake site. If users follow the link, they are told they need to update their Flash Player. The installer then installs malware rather than the Flash Player. The malware then downloads a rogue anti-spyware application, AntiSpy Spider. by humanitarian, government and news sites in the UK, Israel and Asia. In this attack the compromised websites led, through a variety of redirects, to the download of a Trojan. In September 2017, visitors to TV network Showtime's website found that the website included Coinhive code that automatically began mining for Monero cryptocurrency without user consent. The adoption of online services has brought about changes in online services operations following the advancement of mobile communication techniques and the collaboration with service providers as a result, the online service technology has become more conductive to individuals. One of the most recent mobile technological wonders The Coinhive software was throttled to use only twenty percent of a visiting computer's CPU to avoid detection. Shortly after this discovery was publicized on social media, the Coinhive code was removed. Showtime declined to comment for multiple news articles. It's unknown if Showtime inserted this code into its website intentionally or if the addition of cryptomining code was the result of a website compromise. Coinhive offers code for websites that requires user consent prior to execution, but less than 2 percent of Coinhive implementations use this code. German researchers have defined cryptojacking as websites executing cryptomining on visiting users' computers without prior consent. With 1 out of every five hundred websites hosting a cryptomining script, cryptojacking is a persistent web threat.

Prevention and detection Conventional approaches have failed to fully protect consumers and businesses from web threats. The most viable approach is to implement multi-layered protection—protection in the cloud, at the Internet gateway, across network servers and on the client.

See also Asset (computing) Attack (computing) Botnets Browser security Countermeasure (computer) Cybercrime Cyberwarfare Denial-of-service attack High Orbit Ion Cannon IT risk Internet safety Internet security Low Orbit Ion Cannon Man-in-the-browser Rich Internet applications Threat (computer) Vulnerability (computing) Web applications Web development

References

Worked examples

Example 1 — a first encounter with Web threat

Start with the simplest possible case. Write down what Web threat claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Web threat before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Web threat ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Web threat

In research: Web threat appears in science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Web threat in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Web threat is common in secondary-school and first-year university syllabi. It links to neighbouring topics Cybercrime, Cyberwarfare, Internet security, so understanding it makes those chapters shorter.
In everyday life: Look for Web threat outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Ask Teacher Smith questions about this articleOpens your AI tutor with a question about “Web threat” →

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Web threat in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Web threat means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Web threat out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Web threat in simple terms?

Why does Web threat matter?

Because it connects several science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Web threat?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Web threat.