- This topic has 0 replies, 1 voice, and was last updated 4 months, 3 weeks ago by Oghenemarho.
- February 18, 2020 at 4:52 pm #86089Participant@oghenemarho
Hacking is an ever-present threat in today’s increasingly connected world. As more aspects of our lives begin to find their way online, and organizations start to rely more on cloud based infrastructure and services to run their operations, we provide even more incentive for hackers to evolve their techniques for intruding into our privacy and exploiting weaknesses in these online systems. According to recent statistics, there is a hacking attempt made every 39 seconds and over 300,000 new forms of malware created on a daily basis to infect and compromises online systems.
All of this increased hacking attempts is because of the growing number of vectors that are available to hackers. An attack vector in this context can be described as a pathway or method through which an attacker can gain access to a computer system or network infrastructure, in order to deliver malicious code, engage in nefarious activities or extract confidential information. Common attack vectors include, viruses, web pages, email attachments, web pop-ups, instant messaging, IoT devices, and social engineering. Each one of these becomes a vector when a vulnerability is discovered that can allow a malicious actor to use them for purposes other than what they were intended for.
One of the more commonly used attack vectors employed by hackers today is emails, simply because of how widespread email use is. An estimated 281 billion emails were sent every day in 2018 and that number can only go up as more people come online and sign up for products and services that require email addresses. In 2019, over half the world’s population made use of email services. These statistics make emails a fertile ground for hackers to use in targeting unsuspecting victims. Here are some of the ways they carry out these email based attacks:
To put is simply, spam emails are unsolicited commercial, or advertising email messages sent in large volumes, usually from unreliable sources repeatedly. Spam mails have existed for almost as long as emails themselves and have grown from being a mere annoyance to a potential security risk. As a form of advertising, spam mail is used by both reputable, well known companies, as well as less reputable, smaller companies, to advertise all manner of products and services from medicines and health supplements, to loans and even dating services. Because most of them emails contain links or attachments to the advertised product or service, hackers can also make use of spam mail to hide links to malicious websites and even malware attachments. By copying the marketing language used by other spam emails that is designed to generate interest, it’s not impossible to imagine a sizeable number of people falling victim to these carefully crafted hacking emails.
Modern email service providers have implemented anti-spam systems to protect their users from the vast majority of spam emails but even these systems are not one hundred percent effective in blocking spam. This is because sometimes of the constantly evolving nature of spam delivery systems employed by senders. random sending mail addresses, constantly changing domain names and content character substitution are just some of the ways used to evade spam filters and screening systems. Not to mention the sheer number of spam emails that are being sent everyday (over 50% of daily email traffic).
Phishing is an evolution of the spam email technique used by hackers. When phishing emails are sent, the intent of the hacker is to obtain sensitive information such as usernames, password, bank account information or credit card details, from the recipient. To do this the email is usually disguised as coming from some legitimate or trustworthy entity that the recipient will not hesitate to click on whatever links or attachments that come with the mail. This type of hacking attack focuses on the use of social engineering techniques (i.e. the psychological manipulation of a victim) rather than technical expertise, to be successful in obtaining the confidential information. A common example of a phishing attack is this:
You receive an email that is supposedly from Facebook informing you that there has been an attempt to access your account from a foreign location and you need to log in immediately to verify your account, or else it will be closed. The message also has a button asking you to click on it to verify your account and if you do click the button, you are taken to an account verification page on what looks exactly like the Facebook. Here you will be asked to enter the username to your account, your password and some other info like your email address, telephone number and so on. If you follow all the steps, enter the necessary information and submit, then congratulations, you just got phished!
What has happened is that a hacker has composed an email designed to look like it’s from Facebook, with a message that would immediately get your attention, and then included a link that goes not to Facebook itself, but a website that looks like it. All the information that you enter into this lookalike site is harvested by the hacker who can then use it to log in to your real Facebook account and do anything he likes. This is the very basic format for most phishing attacks and it can be used to gain access to all sorts of information. In fact, over 90% of all data breaches that happened in 2019 were as a result of phishing attacks and in the same period, over 76% of businesses have reported being a victim of such attacks.
The hook that makes phishing attacks one of the most effective attack vectors for hackers is because of the urgency of the action required and the fact that this action is usually targeted at humans rather than computer systems. Who wouldn’t want to protect their Facebook account from being broken into, prevent their bank from closing down their account, or update their personal information with their office HR department?
This is a more targeted form of the phishing attack. While phishing could be likened to casting out a net in order to catch as many small fish as possible, spear phishing on the other hand is like using a harpoon to hunt for whales and other massive fish. That is because spear phishing attacks are usually focused on specific individuals, group of persons or organizations and as a result, the hackers usually gather as much personal information as is available about their target, in order to increase the chances of success of their attack.
A popular form of spear phishing attacks is called Business Email Compromise (BEC). Here, hackers may spoof the email address of a high-ranking official at a company and send emails to specific members of the financial department authorizing payments or bank transfers usually in overseas bank accounts that belong to the hackers. By the time the scam is discovered, it is already too late and whatever funds were transferred are long gone. According to the US Treasury department, these kinds of attacks are costing US companies over $300 million monthly and the current targets for these attacks has gone beyond businesses to schools, universities and non-profit organizations.
Ransomware are a type of malware that works by blocking access to the victim’s data through encryption, so that an attacker can threaten to either publicly release this data or delete it unless the victim pays a ransom. The commonly used delivery method for ransomware is via email attachments disguised as official documents or pictures but designed to run malicious code when they are opened.
Ransomware attacks are growing in frequency due to the lucrative nature of the attack. There were over 180 million ransomware attacks recorded in the first six months of 2018, an increase of 229% compared to the same period in 2017. In 2015, the CryptoWall ransomware attack was estimated to have made over $18 million for the hackers using it before a way was found to defeat it. Most victims are willing to pay to have their files restored either because they do not have backups, or they would rather not have their private data leaked to the public.
With all these risks involved in using email, it probably doesn’t look like a good idea to send or receive any emails whatsoever, does it? However, vigilance and a healthy does of paranoia can help protect you from all these attacks. Always be skeptical of mails that don’t make sense even if they are from reliable sources, always confirm via another means of communication and always scan attachments before you open them.
- You must be logged in to reply to this topic.