2017 has been a dramatic year for website hacks, in terms of both espionage and commercial exploitation. Hackers are more sophisticated than ever, and are using the weapons at their disposal to pursue political ideologies, as well as net themselves significant income.
Major hacking victims in 2017
Here are a few of the major victims of hackings in 2017.
One of America’s most powerful spy agencies, the NSA has developed a number of hacking tools of its own in order to collect data on various targets. A hacker organisation called The Shadow Brokers tapped into the NSA’s network, stealing incredibly valuable data whilst also releasing the exploit tools that the NSA used to break into third party software – potentially giving other hackers access to millions of customers’ data on other third party websites.
The UK’s National Health Service
A strain of ransomware called WannaCry spread like a plague earlier during May 2017, infecting everything from individual computers and small businesses, through to major corporations and critical organisations, such as the UK’s National Health Service. As the ransomware was holding the computers to ransom, emergency rooms and other operations within the UK’s hospitals were unable to operate, critically delaying many vital medical procedures.
Cloudflare is a Cloud service provider which offers performance and security services to 6 million websites, including major ones used by huge numbers of people, such as Fitbit and OKCupid. A bug in the Cloudflare platform was found to be leaking sensitive customer data at random, and wasn’t discovered until 6 months after the glitch began in September 2016.
How do hackers gain access to websites?
One of the major challenges that website managers face is the sheer number of ways that hackers can get access to a website. As the complexity of what websites can do increases, and as people place more and more sensitive data into websites, the avenues for hacking become increasingly varied, and can range from simple exploits in the software that the website runs on, through to grand social engineering strategies.
Common ways to hack a website
A couple of the major attacks against websites include:
Without a doubt the most common type of attack, primarily because it’s so easy to execute, a DDOS Attack involves overloading a website by sending so much traffic to it in such a short time that the server can’t handle the strain, and the website becomes unavailable to everyone. This in itself is more an irritant than anything else, but a hacker can then exploit the time that the website is down to further compromise it once it gets back up, and that’s where the danger lies.
Social Engineering requires limited technical skill, which is what makes it so dangerous. It’s a strategy that hackers use to get information such as passwords to an organisation’s network by pretending to be someone else. They might call a staff member, for example, putting on the role of a tech support person and requesting the password of that staff member to run some checks on the system for them. Of course, once they’ve got the password, the hackers then have access to the entire network.
Cross-Site Scripting is when an application, URL “get request”, or file packet is sent direct to a web browser window and bypasses the validation process. It’s a deceptive strategy that targets end users and convinces them that the compromised page of a website is a legitimate one and, thinking they are on a legitimate website, a user will then trust when a popup window asks for credit card, or other sensitive information. It is incredibly common – 50% of web application assessments encountered a vulnerability that would allow for cross-site scripting in 2016.
What gets stolen in a hack?
In the event of a hack, a lot of sensitive data can be stolen very quickly. When Kiandra IT “hacked” networks of customers to test the security of the system, in many cases it was possible to compromise the entire network, and collect all the data, in under 24 hours. Concerningly, these “compromised” organisations often were unaware of what was going on, or were very slow to respond, with minimal alerting and no incident response policies in place to know how to respond to attacks.
Having your website hacked can be a significant PR and customer relations headache, which is why it’s important to be vigilant and proactive in ensuring that security holes are minimised, and, when a hack does occur, it’s dealt with quickly. It’s always a good idea to keep a robust investment in your organisation’s security, and develop a clear plan for addressing security breaches before one occurs – that way in the unfortunate event of a breach your organisation can address it quickly and calmly.
Speak to the experts at Kiandra today about how our security applications can keep your sensitive data secure.