Defacing Websites, Destroying Data, and Other Acts of Digital Destruction

UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 13.6 Free with a free account

Defacing Websites, Destroying Data, and Other Acts of Digital Destruction

Ethics in Technology · Chapter 13: Digital Espionage, Online Threats, and the Science of EncryptionSection 13.6 · lesson 83 of 11611 min · free with a free account

← Spying in the Digital World: How Organizations and Nations Steal Secrets ElectronicallyNext lesson: Stealing Digital Assets: From Financial Fraud to Identity Theft and Beyond →

Earn 3 college credits for Ethics in TechnologyRecommended for credit by NCCRS · Computer Science 195 · self-paced · one payment, lifetime access
Enroll in Ethics in Technology · $250 →Download the syllabus (PDF)

In this lesson

Visible defacement, destructive malware, delayed sabotage, and resilient recovery.

  • Explain why attackers deface websites and damage visitor trust.
  • Compare destructive malware and data theft using the two historical incidents.
  • Explain delayed logic bombs and sabotage through insider access.
  • Connect preparation, detection, containment, restoration, and review.

Free study notes

Get this lesson's notes by email

The key points and 4 practice questions with answers, in your inbox. One email, free.

One email. Unsubscribe in one click.

Transcript

Everything said in the video, section by section (1,341 words). Read along, or search it.

Chapter 13

Acts of Digital Destruction

Some attacks seek visible disruption rather than a quiet foothold. Website defacement changes what visitors see. Wiper malware destroys data or system files. A logic bomb can postpone harmful action until a condition is met. Insiders can misuse access they already possess. This lesson compares those forms of digital destruction. We will examine Shamoon in twenty twelve and Sony Pictures in twenty fourteen. These historical incidents show how operational damage can spread across an organization. We will also distinguish destructive effects from information theft. Finally, we will connect preparation, detection, containment, restoration, and review. Protected backups and actual restoration tests matter before a crisis; the recovery plan must also support safe rebuilding and continued operations.

Website Defacement

A Visible Message Can Cause Damage Beyond the Page

Website defacement is an unauthorized change to a site’s appearance. An attacker can replace normal content with a message, image, or slogan. Visibility is part of the purpose. The message may express a political or ideological position. It can embarrass the organization or demonstrate that access was gained. The damage can extend beyond the page itself. Visitors may question what else was changed. They may hesitate to enter personal or payment information. Replacing page content can sometimes be technically straightforward. However, the cause still needs investigation, and confidence may take longer to rebuild. A restored appearance does not by itself establish that the website is safe; distinguish repairing visible content from resolving the incident.

Wiper Malware

Destruction Threatens Data and the Ability to Operate

Wiper malware is designed to destroy or corrupt data. It can overwrite files and important system information. Damage to startup information can prevent a computer from operating normally. That objective differs from quietly copying information for unauthorized use. The distinction concerns the function, not an absolute separation between incidents. Destruction and theft can occur together. Stolen information can be exposed while systems are also disabled. The resulting harm includes operational disruption and loss of confidentiality. Damage may happen rapidly after activation. Its speed and recoverability depend on the systems, attack, and recovery resources. A destructive component does not establish that nothing was stolen; assess both missing availability and any unauthorized disclosure.

Historical Examples

Shamoon and Sony Show the Scale of Operational Disruption

Shamoon appeared in twenty twelve in the energy sector. The source describes a major Middle Eastern company’s business network. The malware overwrote files and master boot records. Tens of thousands of affected computers could no longer start normally. Image data was used in destructive overwriting. That does not establish that an image appeared during startup. The Sony Pictures incident occurred in twenty fourteen. Destructive malware made thousands of computers inoperable and caused serious business disruption. Stolen internal information was also exposed, and threatening messages appeared on employee screens. Both examples show how unusable business systems can create an organizational crisis. They are historical examples of scale and overlapping harm; every destructive attack does not follow the same timetable or produce identical consequences.

Delayed Sabotage

A Logic Bomb Waits for a Condition Before Acting

A logic bomb is malicious code that waits for a specified condition. It may remain dormant after being planted. A date, a removed file, or an account-related change can activate it. The harmful action might delete files, corrupt a database, or disable software. These examples explain delayed activation rather than give an implementation procedure. The delay separates the planting of code from its visible consequences. The responsible person may have left before damage occurs. Investigators therefore need to examine earlier changes and access. The most recent user is not automatically responsible. Dormancy can complicate discovery and attribution. It does not make investigation impossible, and harmful code can sometimes be identified and neutralized before activation.

Insider Sabotage

Legitimate Access Can Be Misused for Unauthorized Damage

Insider sabotage uses access associated with a trusted role. The person may be an employee, contractor, or administrator. A departed worker can remain a risk if old access persists. Permission to administer a system does not authorize deliberate damage. Source examples include deleting data and planting delayed malicious code. Disabling backups can make later damage harder to reverse. The initial access may resemble ordinary administration. That resemblance can make misuse difficult to recognize. Some cases involve anger over termination, demotion, or a workplace dispute. These circumstances alone do not establish guilt or a universal motive. Evaluate authorization, actual changes, and supporting evidence; trusted-role access explains opportunity rather than proving that a particular person committed sabotage.

Business Continuity

Recovery Capability Matters Before an Incident Begins

Business continuity concerns keeping operations going or recovering after disruption. A destructive attack can damage services before it is recognized. The organization then needs practical recovery capability. Prevention remains valuable, but cannot replace readiness for failure. A response plan clarifies responsibilities, communication, and priorities. Recovery resources must support the operations that matter. Restoring one page or computer may leave other essential services unavailable. Resilience also includes learning from what happened. Working backups are central to restoring damaged data. Coordination and safe rebuilding support the return to operation. Prepare before a crisis, rather than discover during the incident that the required people, data, or recovery resources are unavailable.

Recovery Activities

Review Feeds the Next Round of Preparation

The source presents five activities as a repeating recovery cycle. Prepare means maintaining tested backups and a response plan. Detect means identifying destructive activity as early as possible. Contain means limiting spread and further damage. Restore means rebuilding systems and recovering data from clean backups. Review means studying what happened and strengthening defenses. Review feeds the next round of preparation. The activities can overlap and repeat. They are not five rigid phases required in every organization. Learning can improve decisions while a response is still underway. Use the model to connect readiness, urgent action, safe recovery, and improvement; a one-time repair does not complete every recovery need.

Prepare and Protect

A Stored Copy Is Not Yet Proof of Reliable Restoration

A backup copy must be protected from the incident it is meant to remedy. Malware can damage accessible recovery copies. An insider may also try to disable or destroy them. Appropriate separation can include offline protection. The exact arrangement depends on the organization’s systems and needs. Regular restoration tests provide evidence that recovery works. A copy can exist while important data is missing or restoration fails. Testing can also reveal that recovery takes too long. Maintain and exercise response plans alongside backup practices. An untested copy leaves an unverified assumption about restoration. Discovering failure before a crisis gives the organization time to improve; discovering it during a destructive incident can leave very limited options.

Detect, Contain, Restore, Review

Stop Further Harm and Verify a Safe Return to Operation

Detection seeks to identify harmful activity promptly. Containment aims to limit further damage or spread. Isolating affected systems can support that purpose. Choices must also account for critical services and operational safety. Restoration rebuilds systems and recovers data from clean backups. Recovering files alone does not establish that malicious access is gone. Planted code or the original weakness may still need attention. Responsible responders address the cause and validate restored services. Monitoring can reveal renewed harmful activity. Review identifies improvements to defenses, plans, and recovery capability. Follow established response procedures and preserve relevant evidence; safe recovery and investigation can proceed together as the facts become clearer.

Key Terms

Distinguish the Visible Effect, Delayed Mechanism, and Recovery Goal

Website defacement describes unauthorized visible changes to a site. Wiper malware emphasizes destruction or corruption. A logic bomb describes delayed activation by a specified condition. Insider sabotage describes deliberate damage through trusted-role access. Business continuity concerns continued operation or recovery after disruption. These concepts describe different aspects of an incident. An insider can plant a logic bomb. Its action can be destructive. A destructive incident can also expose stolen information. The categories therefore need not exclude one another. Explain the mechanism, outcome, and recovery goal separately; one label does not establish all the facts or every consequence of the incident.

Review and Apply

Explain Visibility, Destruction, Delay, and Recovery Readiness

Defacement is visible because attention can serve the attacker’s purpose. The message can make a statement, embarrass an organization, or demonstrate access. A wiper destroys or corrupts, while theft copies information without authorization. Those effects can coexist. Shamoon and Sony illustrate disruption when many business computers become unusable. A logic bomb can activate long after it was planted. That delay complicates tracing but does not make it impossible. Insiders may already have access, yet sabotage exceeds legitimate authorization. Restoration tests show whether backup assumptions hold in practice. Preparation, detection, containment, clean restoration, and review support resilience. Protected backups matter before the crisis; coordinated recovery and improvement help the organization return to operation and reduce future harm.

About Ethics in Technology at UPI Study

Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses

Compare: Cybersecurity vs Ethics in Technology · Which ethics course?

Why take it here

Why students take Ethics in Technology with UPI Study

The right and wrong of the digital worldEthics in Technology looks at the choices technology forces on people and organizations: security and privacy, surveillance and the law, big data, hacking and cyber warfare, malware and breaches, intellectual property, cybercrime, encryption, artificial intelligence and responsible digital citizenship. It suits computer science, information technology and business degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Defacing Websites, Destroying Data, and Other Acts of Digital Destruction

What is website defacement, and why do attackers do it?
Website defacement is an unauthorized change to a site's appearance, replacing normal content with an attacker's message, image, or slogan. Attackers do it to make a political or ideological statement, embarrass the organization, or show off their access. The damage goes beyond the page, because visitors may wonder what else was changed and hesitate to enter personal or payment information. Restoring the page does not prove the site is safe; the cause still needs investigation.
What is wiper malware, and what did Shamoon and the Sony Pictures attack show?
Wiper malware is designed to destroy or corrupt data, overwriting files and startup information so computers cannot run normally. Shamoon hit Saudi Aramco in 2012, wiping about 30,000 computers, and the 2014 Sony Pictures attack disabled thousands of computers while also leaking stolen internal data. Both showed how unusable systems become an organization-wide crisis, and the Sony case showed that destruction and data theft can occur together.
What is a logic bomb?
A logic bomb is malicious code that stays dormant until a set condition triggers it, such as a date, a deleted file, or a change to a particular account. It might then delete files, corrupt a database, or disable software. Because planting and activation are separated in time, the person responsible may have left before damage appears, which is why insiders sometimes use them. The delay complicates investigation but does not make it impossible.
Why should backups be tested and kept separate from the main network?
Backups should be separated and tested because destructive malware or a malicious insider can delete or corrupt any backup it can reach, and an untested backup may be incomplete or too slow to restore. Offline or otherwise isolated copies protect against that. Regular restoration tests prove recovery actually works before a crisis. Restoring data alone is not the end: responders must also remove planted code, fix the original weakness, and monitor restored systems.

About the Ethics in Technology course

How many college credits is Ethics in Technology?
Ethics in Technology (Computer Science 195) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Ethics in Technology cost and what is included?
$250, paid once, with lifetime access: all 116 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. It is sold on its own and is not part of UPI Study PRO.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Ethics in Technology take?
It is self-paced with no deadlines. The 116 lessons total about 28 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Ethics in Technology.

116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Ethics in Technology →Download the syllabus
Ethics in Technology
3 credits · NCCRSEnroll →