Kids IT Lab No.11 | Security

Intro to How Cyberattacks Work

"A major company's site went down in a DDoS attack." "A hospital halted operations after a ransomware infection." The cyberattacks you hear about in the news follow a handful of basic patterns. This article walks through the most common attack types so you can understand the news — and know what to protect.

What Is a Cyberattack?

A cyberattack is a broad term for using computers or networks to illegally access, steal from, or disrupt the systems and data of organizations or individuals. Attackers are motivated by three main goals: money (ransom, card numbers), information (personal data, trade secrets), and disruption or harassment (taking down services). Attackers range from lone criminals to organized gangs to groups tied to nation-states.

Cyberattacks are not usually the movie version where a genius breaks in instantly. In reality, most intrusions happen through small gaps: unpatched software, reused passwords, or a phishing email clicked by accident. That is exactly why learning how attacks work is not about copying them — it is about understanding where to build your defenses.

Six Common Attack Patterns

Major Cyberattacks: Goals, Targets, and Notable Examples Source: IPA "Top 10 Information Security Threats," various news reports Attack Goal Main targets Notable examples DDoS Service disruption Crash the website Recovery costs, lost revenue Corp & gov websites E-commerce, banks, games 2022 Russian gov sites 2018 GitHub attack Ransomware Financial gain Demand ransom payment Millions to hundreds of millions Hospitals, gov, large corps Orgs with thin backups 2022 Osaka hospital 2017 WannaCry SQL injection Data theft Extract data from DB Personal info, card numbers Outdated websites Poorly secured forms 2011 Sony Pictures 77M records via SQL flaw Phishing Info theft Fake site collects credentials Passwords, card numbers General public Teens are targeted too Tens of thousands/month Anti-Phishing Council Japan Spear phishing Secret theft Long-term targeting of one org Tech secrets, blueprints Large corps, defense Research institutions 2015 Japan Pension Service 1.25M records leaked Supply chain attack Indirect intrusion Use a vendor to reach the target Entry through smaller firms Subcontractors of large orgs Smaller firms with weaker security 2020 SolarWinds incident Penetrated U.S. government ▶ For individual teens, phishing is by far the most common encounter. Most others target organizations.
Figure 1: Major cyberattack comparison. Teens most often encounter phishing; other attacks mainly target organizations.

How DDoS Works

How SQL Injection Works (with Real Code) Typing special characters into an input box can "overwrite" database commands × Vulnerable code (classic login handler without protection) # Pattern commonly seen in old PHP/Python code user = request.get("user") # from input field pwd = request.get("pass") sql = "SELECT * FROM users WHERE name='" + user + "' AND pass='" + pwd + "'" ↑ Concatenating user input directly into SQL = dangerous What an attacker types user: admin'-- pass: anything ○ Safe approach (using a placeholder) cursor.execute("SELECT * FROM users WHERE name=? AND pass=?", (user, pwd))
Figure 2: SQL injection example. Concatenating user input directly into SQL lets attackers bypass authentication.

A DDoS (Distributed Denial of Service) attack floods a target server with simultaneous requests from thousands to millions of hijacked PCs and IoT devices (such as security cameras), crashing it under the load — like a shop that cannot handle 100,000 customers arriving in one second. Home routers and older security cameras can become part of a botnet without the owner knowing, so keeping firmware updated is not someone else's problem.

How SQL Injection Works

SQL injection involves entering special characters into a login form to extract data from a website's database. For example, typing something like password' OR '1'='1 can bypass the password check on a site with poor defenses. Attacks like this are tried against web services worldwide every day, and data breaches from vulnerable sites continue to occur.

On the defense side, the key is never treating user input as raw SQL commands. Using placeholders or prepared statements ensures that user input is treated as data, not as executable commands. When building any web app, never treat login forms or search fields as low priority.

How Teens Can Defend Themselves

Personal defense comes down to the basics covered in previous articles: update your OS and apps, use strong passwords and two-factor authentication (2FA), avoid suspicious links, and do not log into accounts on public Wi-Fi. Most cyberattacks exploit gaps in these basics. Get the basics right and you block the vast majority of attacks targeting individuals.

If you want to study attacks as a learning exercise, use only legal practice environments — CTF competitions, learning virtual machines, web apps you built yourself, or bug bounty programs that explicitly authorize testing. Testing on school networks, a friend's site, a company login page, or any network outside your own home is potentially illegal even if your curiosity is innocent.

Common Pitfalls

Common Misconceptions About Cyberattacks
  • Thinking "I'm just a teen, nobody targets me." Mass-distribution attacks are non-discriminatory — age does not matter.
  • Trusting antivirus software completely. Zero-day attacks can bypass detection.
  • Testing attack tools out of curiosity. In Japan, unauthorized access violates the Unauthorized Computer Access Prohibition Act, and there are many cases of teens being prosecuted.

How Will This Help You in the Future?

Understanding how cyberattacks work is the first step toward becoming a defensive engineer, not an attacker. Security knowledge applies to web development, networking, cloud, school IT management, and almost every other IT field. Learning the basic attack patterns as a teen, and competing in CTF (Capture The Flag) events, gives you concrete stories to tell when applying to schools or jobs.

Take Action Today

Start with 3 steps
  1. Visit JPCERT/CC or IPA's website and check the latest attack news once a month.
  2. Update the firmware on your PC, smartphone, and home router to the latest version.
  3. Look up "picoCTF" — a security competition designed for teens — and try it if you're interested.

Summary

Cyberattacks include DDoS, SQL injection, ransomware, zero-day exploits, spear phishing, and supply chain attacks. At the personal level, keeping your OS updated, using strong passwords, enabling 2FA, and avoiding suspicious links blocks the vast majority of attacks. Never test attack tools against real systems — practice only in legal environments, and the skills you build will open up strong career paths.

Check Why learn how attacks work?

Related articles

PreviousAre USB Drives Dangerous? NextWhy Do Data Leaks Happen? RelatedHow Does the Internet Work? RelatedThe Road to Becoming an IT Engineer
← Back to Security