If you ask the majority of people what they think a hacker is, the likely description would probably look something like Hugh Jackman in Swordfish, who is forced to hack into a government bank account by a rogue agent, played by John Travolta.
In reality, hackers are often organized into cybergangs whose sole purpose is to commit crimes such as identity theft, stealing company secrets and extortion. Hacking is big business, with an active market in stolen access to sensitive information, bank accounts and personal identity data. (See right-hand box for an illustration of how the hacking system functions.)
Whether a hacker works alone or in a group, often a top goal is to capture computers and turn them into zombie PCs, also known as bots, under the control of the hacker. A common way of accomplishing this is through an e-mail asking the recipient to click on a link. That action downloads a code that remains dormant and undetectable by virus-checking software until it is triggered.
As the hackers capture increasing numbers of computers they develop an Army of PCs, known as a botnet, which can be used for many criminal activities, not least of which is a denial of service (DOS) attack that can disable a computer or your company's entire network, effectively disabling your organization.
A DOS attack generally is aimed at preventing an Internet site or service from functioning effectively and typically targets banks and credit card payment gateways. Essentially, the attack forces the victim either to reset or consume its resources, prevent it from providing services or blocking communication between users.
Hackers United
The threat to your personal computer or company network is probably larger than you imagine.
Modern hacking normally starts with someone who writes a script or program that is able to exploit a weakness in a computer operating system or application such as Internet Explorer or Safari, Microsoft Word and Excel, as well as Adobe PDF documents. The programs are then uploaded onto special sites where they are downloaded by hackers who run the scripts to build botnets.
When the botnets are completed, the builders advertise how many zombie PCs they have in their network and their ability to run scripts and sell the malware to the highest-bidding criminal gang that then runs the attack to harvest the data they want.
Once gathered, there's a market for the information. For example, batches of credit card numbers may be sold for prices determined by the type of card. Standard credit cards are cheaper than gold or corporate cards.
Similarly, the price for access to bank accounts varies according to how much money is in the account. The sellers often provide a guarantee to replace credit cards that don't work or are reported as stolen.
Common methods of these attacks include:
- Flooding a network with external communications requests, preventing legitimate traffic;
- Disrupting connections between two machines, blocking access to a service;
- Preventing a targeted individual from accessing a service, and
- Disrupting service to a targeted system or individual.
Defense: Employees should never click on e-mail attachments, particularly if they don't know the sender, or on links to unfamiliar websites.
Here are four additional common ways hackers can breach your company's network security and how you can defend against them:
1. Worms and Trojans:
These programs are subtly different from botnets as the goal is to install malware, or malicious software, such as:
- Viruses that can cause a loss of data, destroy files on a hard disk, and vandalize Web pages.
- Spyware that can collect such personal information as Internet surfing habits, display unwanted ads and redirect advertising revenues to the creator of the program.
- Keyloggers that record every stroke made on a keyboard and send that information to the hacker, facilitating the theft of logins, passwords and sensitive data.
Defense: Prohibit employees from clicking on attachments or opening e-mails from unfamiliar sources. They also should be banned from using peer-to-peer file-sharing programs or downloading files from such social networking sites.
2. Transportable Data:
USB drives, iPods, MP3 players and Smart phones have massive storage capacities and can be used as flash drives or external drives. A thief needs only to plug one of these devices into a computer's USB port to steal large amounts of data at incredible transfer rates without detection.
Defense: Employees should report any incident of an external device connected to a machine on your organization's network. Limit staff access to only the data they need to do their job and watch audit logs of sensitive information, If someone is downloading, say, a customer list, red flags should go up.
3. Laptops:
These are essential business tools for many organizations. But the data on a stolen laptop may be far more valuable than the machine itself. Password protection is not enough; all a thief needs to do is boot the machine from an external drive or CD to get around the password.
Defense: Limit the information stored on laptops to only what is necessary for a job or a project. Encrypt all sensitive information. To bolster security, require employees to put critical information on a flash drive or other external, encrypted storage device and carry it separately from the laptop.
4. Outsourcing:
If your company is outsourcing, a lot of customer or client information and sensitive internal data is being shared with people outside the company. Without proper controls, you run the risk of fraud, data or intellectual property theft and breaches of confidentiality, among other things.
Defense: Deal only with reputable, well-known outsourcing companies, check references and perform due diligence on that business's security safeguards, comparing them to those used by your own organization. Contracts should include clauses that will help prevent any disputes over the ownership of intellectual property and the transfer of data as well as address usage and return of data.
Consult a professional with experience in technology or legal issues to help insure that your company's data and computer network remain uncompromised.
@ Copyright 2017 All Rights Reserved.
Brought to you by Cycrest Systems, Inc
For more IT information, check out our bi-weekly newsletter here: Click here for the whole newsletter