Here's how hackers are stealing your data

(Image credit: Kym Winters)

While it's true that attackers are developing more complex viruses and malware all the time, increasingly and often forgotten, the biggest security threat to businesses does not actually come from software, but from human beings themselves.

Companies can build the most secure infrastructure in the world to protect their data from external threats, with solutions such as firewalls, VPNs and secure gateways, but that doesn't mitigate the risk of threats, malicious or otherwise, from within the organisation itself. This low-tech way of hacking has become increasingly popular in recent years, with well-known brands falling victim to fraudsters contacting junior finance administrators requesting funds after doing a little LinkedIn investigating.

The genesis of any human-led cyber security threat is social engineering; the act of manipulating confidential data from an individual. Sure, hackers could infect a network with malware and go in through the back door, or better still, they could just trick an employee into giving out a password and stroll right in through the front without raising any alarm bells. Once a hacker has an individual's password, there is little you can do to stop them, since their activity will appear to be authorised.

Social engineering techniques have had to become more sophisticated over the years as the average user has become savvier to the traditional methods hackers use. So hackers are now having to be smarter in the ways that they obtain data. In a business sense, something as simple as tricking a user into clicking a malicious link can give the attacker access to the entire network. People know to ignore emails from pleading strangers who are in desperate need of bank details, but when that email comes from someone you know, you are much less likely to click 'Mark as spam'.

Shoulder surfing
'Shoulder surfing' is the simple act of one person observing someone typing their password. There is precedent of this happening. A disgruntled or soon-to-be-leaving employee could casually stand behind a desk and observe other employees typing their passwords. This simple act might lead to unauthorised access, which could be disastrous to a business.
Passwords on Post-it notes
Even easier than memorising a password observed over a shoulder, internal threats can come from employees writing down passwords and sticking them to their computer monitors – yes, that actually happens. Obviously this makes it incredibly easy for someone to obtain login details that could then be used to defraud or infect a company. The good news is that this carelessness is easy to rectify.
Thumb drives inserted into computers
Employee machines can be infected with keylogging software loaded onto a simple USB drive. An attacker would just have to sneak the USB drive into the back of a computer, and they'd have access to the personal details and passwords of the user.

TIP: To avoid these internal threats, businesses should educate their employees with security courses and communications on the importance of being vigilant with their passwords. Password manager software like KeePass or Dashlane can securely store passwords, so you don't have to remember all of them. Alternatively, you can also lock down the USB ports of your workstations to prevent unauthorised devices from being accessed via USB altogether. This approach does need to be considered carefully however, because it makes every workstation much less flexible and increases the workload for the IT department, since every new USB device will require approval before it can be used.

Similar to social engineering, baiting methods trick users using information obtained about the person. For example, a hacker could check social media sites and learn that the target has an interest in Game of Thrones. That knowledge gives the attacker some bait. Instead of a generic email, the attacker could send the target an email that says 'Click here to watch the latest Game of Thrones episode'. The user is more likely to click the button which, of course, is actually a malware link, and not the most recent episode of Game of Thrones.

Similarly, with so much information listed publicly on LinkedIn, it can also be easy for attackers to research a reporting structure, target a junior pretending to be the CEO and request a transfer of funds to a particular account. As farfetched as that may seem, there are well known incidents of this taking place. Eavesdropping is a similar method, with attackers listening to business conversations in coffee shops, on public transport and even as a supplier in an office environment.

Another way attackers are tricking users into downloading malware from emails is through unsubscribe buttons. By law, every marketing email must contain an unsubscribe link so that consumers can opt out of receiving communications. An attacker could send repeated emails to a user that look like special marketing offers from a clothing company (or similar). The emails looks harmless enough, but if the user is not interested in the company, or thinks the emails are too frequent, they can press the unsubscribe button to stop receiving emails. Except in this hacker's phishing email, clicking the unsubscribe button actually downloads the malware.

The key take-away is to stay vigilant and up-to-date on the array of methods that hackers may use to steal your data. Educate your employees so they are aware of the techniques listed in this article that may be used to acquire content, such as their login details or personal data. Encourage employees to question anyone they don't recognise, and to be aware of anyone listening to conversations or shoulder surfing.

Thank you for reading 5 articles this month* Join now for unlimited access

Enjoy your first month for just £1 / $1 / €1

*Read 5 free articles per month without a subscription

Join now for unlimited access

Try first month for just £1 / $1 / €1

TOPICS

Simon is general manager and financial director at Fasthosts.

Here's how hackers are stealing your data

02. The low-tech internal threat

03. Baiting

04. Unsubscribe buttons

Get your ticket for Generate New York now

Related articles