How to Detect and Avoid the 10 Most Insidious Hacking Methods | Complete Security

In this ongoing arms race between security professionals and hackers, hackers are still finding new ways to bypass our defenses. The attacks used by famous hackers in the past are used as a starting point or even inspiration. Oftentimes, security professionals simply cannot develop new defenses as quickly as hackers develop new attacks. Since most computer users around the world are quite clueless about Internet security, many often fall victim to attacks and do not know how to avoid them.

While the information on how to stay safe on the Internet is becoming a little more common these days, these users still haven't heard of methods of using a strong password and bypassing public networks. People still use public kiosks to charge their smartphones without a second thought, and many reuse their passwords for every account they create online.

Complete Security and antivirus software provide some level of support, but not everything can be protected. Hackers are getting more cunning, and many of their methods and attacks often go unnoticed even by experienced users. Here are 10 of the most insidious hacking techniques to avoid.

1. "Relative and absolute" path exploitation

Used primarily on older versions of Windows and other early operating systems, the use of "relative and absolute" takes advantage of these operating systems to start searching over the current folder or directory when looking for a file or application. Instead of wasting time looking for files, a Windows user can simply open Windows Explorer, enter the file name, and press enter.

This video explains the difference between relative and absolute paths:

Since these older operating systems look for a file in the current directory first, this can be easily used. Already existing malware can create another, fake program with the same name and copy it to your current directory. Instead, an artificial program will be launched, potentially exposing your system to even more damage.

How can I protect myself?

This is a fairly old technique, so it won't be a big problem for most computer users. However, for those using outdated versions of Windows or other early operating systems, avoid searching through Windows Explorer. It may take longer, but finding the file or application yourself in the directory it is in is the best way to protect yourself.

2. Hidden file extensions in Windows

Windows and some other operating systems have a problem - when a file is created with two extensions, only the first will be displayed by default. Instead , a file named FemaleCelebrityWithoutMakeup.jpeg.exe will appear as FemaleCelebrityWithoutMakeup.jpeg, fooling anyone who doesn't know the file's true nature. This parameter is used by default on Windows operating systems.

It's important to note that .exe isn't the only potentially dangerous extension. For example, if you are running Java, the .jar extension can be dangerous because it launches the execution of Java programs. Other extensions that the red flags should highlight are .bat , .cmd , .com, and .sbr , among many others. These programs can be used to steal information from your computer, use your computer as a way to infect others, or even completely delete your data. Many antivirus programs can have problems with these types of files, which means that the best defence against them is to simply turn off the default setting so that the full file name and file type are displayed.

A quick Google search brings up page after page of tips, techniques and tutorials for creating fake files with multiple extensions. Some are advertised as a harmless prank on a friend, but they can easily be used for more nefarious actions.

How can I protect myself?

Although this is the default Windows setting, you can change it. After that, you just need to monitor the extensions and know what might contain something dangerous.

3.USB malware

In August 2014, a study by Karsten Nohl demonstrated the vulnerability of USB flash drives at a Black Hat conference in a crowded room. The attack he used was called BadUSB. The vast majority of USB drives are not as secure as many assume, and Nol's demonstration proved that any USB device can be invisibly corrupted by malware. It is clear that this is a huge vulnerability that does not have a simple patch. Despite Nohl's efforts to keep the code from being released publicly, two other researchers named Adam Caudill and Brandon Wilson revisited the firmware and reproduced some of the malicious qualities of BadUSB just a few months later.

They then uploaded the code to GitHub, which made the software readily available to anyone who wants to use it. The goal was to entice USB manufacturers to eliminate this vulnerability or face the wrath of millions of defenceless users.

How can I protect myself?

Since anti-virus programs do not scan the actual device firmware (which makes USB devices work as expected) but instead write memory, these threats cannot be detected. When connected to a computer, an infected USB device can track keystrokes, steal information, and even destroy data critical to the functioning of the computer. Proceed accordingly by testing devices before connecting them to your computer, and insist that your contacts do the same.

4. Internet of Things Attacks

If it is connected to the Internet and has an IP address, it can be hacked. How about hospitals that use the Internet of Things to manage defibrillators or devices that monitor vital signs?

Security around the Internet of Things, a scenario in which physical objects and even animals can be assigned an identifier or IP address, is virtually non-existent today (much like computers were in the late 1980s and early 1990s). This makes IoT devices prime targets for hackers. When the Internet of Things includes power grids, manufacturing plants, transportation, and even healthcare, any attack can be devastating.

The "Summer Wars" led by Mamoru Hosoda followed a devastating artificial intelligence attack on a global network very similar to the Internet of Things. Transport is limited, traffic congestion interferes with emergency services, and an elderly woman dies in an attack that turns off her heart monitor.

While the film is a bit more advanced with technology than we have now, it paints a very clear picture of the kind of damage that such a cyber attack can cause and the security threat posed by the Internet of Things. Fortunately, these attacks are not yet widespread. However, more and more of our devices are connected to the IoT, but these attacks could very well become widespread, incredibly destructive and even deadly.

How can I protect myself?

For smart devices, strong passwords are required. Hardly connecting devices directly to the Internet, rather than using WiFi, also adds an extra layer of security.

5. Fake wireless hotspots

Fake wireless access points (WAPs) can be installed relatively easily by hackers using only a wireless network card and a little software. Perhaps one of the simplest hacks in the trade, it depends on the WiFi needs of users in airports, cafes and cafes. All it takes is to present the hacker's computer as legitimate WAP and connect to the real WAP at the same time. Fake WAPs are often described as harmless, such as, for example, “Free wireless network at the airport. John Wayne or Starbucks Wireless Network, and often requires you to create an account first to connect.

Without questioning, users tend to enter commonly used email addresses, usernames, and passwords, and once connected, many send protected information such as passwords and banking information. From there, it's only a matter of time before a hacker starts checking this information on Facebook, Amazon, or iTunes.

How can I protect myself?

While public Wi-Fi networks can seem like a godsend to the on-the-go worker, they cannot be trusted. Better to be safe than sorry here. If you absolutely must use public Wi-Fi, consider using a VPN to protect any information. sent over the network.

6. Stealing cookies

Cookies are small pieces of data in the form of text files that are used by websites to identify you when you browse their site. These cookies can track you during one or more visits. When a cookie is identified by a website, it can save your login status. While this is convenient for frequent website visitors, it is also convenient for hackers.

Despite stealing cookies since the advent of the Internet, browser add-ons and software make it much easier for hackers to steal cookies from unsuspecting users. Cookie theft can also be used in conjunction with fake WAP so that hackers can collect as much information and data as possible. In fact, a hacker can easily take over a session by using your cookies as their own. Even encrypted cookies are not immune to these attacks.

Meanwhile, if you are a webmaster and your site's encryption protection has not been updated in several years, your users may be at risk of stealing cookies.

How can I protect myself?

The best way here is to avoid public or unsecured networks. If you have access to an Android smartphone and enough mobile data, you can create your own private router using your phone. while on the move.

7. Google Glass Hacks

Google Glass developed by Google, is a wearable technology that uses optical head-mounted display technology. Already a matter of concern from many privacy advocates, the possibility of Google Glass being hacked by cybercriminals further calls into question the security of the device.

When Google Glass is hacked, cybercriminals can see everything you see. If you are on the phone and type in your bank or email password, hackers will see it too. The idea that Google Glass can be hacked is not heard by many; in fact, it is much more common to refer to users using Google Glass to record other people's conversations or watch others enter passwords.

As more companies prohibit the use of Google Glass on their premises, device users often avoid or deny access to businesses until devices are removed. However, the likelihood that Google Glass will be hacked by cybercriminals who can literally see with your eyes still remains, and the risk can only increase as new applications are developed and used more widely. Currently, physical access to a device is required in order to jailbreak it, although it is less difficult than many people think.

How can I protect myself?

The best thing you can do to protect yourself is not to let someone else handle your Google Glass, and refrain from wearing it when dealing with personal information.

8. Sponsored government of malware

Yes, governments create malware, and it's not just China or Russia. When Edward Snowden leaked the NSA documents , he revealed last year that there are two NSA-sponsored operations, code-named MYSTIC and SOMALGET, that are taking over the mobile networks of several countries. Metadata is collected about every call to and from these countries, while Afghanistan and the Bahamas are among the territories where audio recordings of a telephone call are recorded and stored.

In 2011, it was discovered that numerous systems belonging to both the European Commission and the European Council had been compromised using a zero-day exploit. Two years later, there was another attack targeting Belgacom, Belgium's partly state-owned mobile network. Five months later, another high-profile attack took place, this time targeting the famous Belgian cryptographer Jean-Jacques Queisquater. Finally, in 2014, the spyware tool used in all three attacks was identified and named "Regin" by Microsoft. In addition, other leaked documents from 2010 indicate an NSA-sponsored operation aimed at the EU Commission and Council. Other documents indicate the existence of malware used by the NSA to target more than 50,000 computer networks.

It was also reported that ISIS is using malware to target and expose Syrian civilian journalists who criticize the group. With ISIS trying to attract hackers, many, including FBI Director James Comey, fear that a terrorist group is preparing to launch a cyberattack on the United States.

The Chinese and Russian governments have long been accused of developing or endorsing malware distributed on the Internet. China's lower police forces have even unwittingly admitted to using malware to spy on citizens. However, the Chinese government has denied involvement in any network hacking scheme, including accusations made by US officials .

How can I protect myself?

Government-sponsored malware can be a little more difficult to defend against yourself. It is no coincidence that malware is being used to monitor security cameras and collect material in other countries. The best thing you can do is protect your computer and network and hope for the best.

9. Baited Attacks

Old bait. Offer someone what they want and then trade it for something they don't want, preferably without their knowledge. These attacks often take the form of ad space sold on websites and acquired by shady companies. A company wishing to buy an ad space provides the site administrator with a harmless, harmless link that can be replaced after the ad has been launched. The ad may also link to a legitimate website that is programmed to redirect you to a much more malicious site.

It is not uncommon for an ad or site to be programmed to be benign when visited by an administrator, which usually delays the time it takes to find the problem and fix it.

Another technique of decoy-and-switch attacks is that a developer offers something free to millions of users, such as a pageview counter at the bottom of a website, which can be easily replaced with malicious JavaScript redirection.

How can I protect myself?

Although bait and bait attacks have been around for many years, they are still incredibly difficult to defend against. Anything you haven't done yourself can be used against you. But for people who can't do such things on their own, their best bet is to look for reputable companies only when selling ad space or when looking for pageview counters.

10. Social engineering

We like to think that we are strong-willed, that we cannot manipulate information. We're too smart for that, we tell ourselves. Nothing can pass us by, we insist.

Social engineering, from a security perspective, is manipulating and deceiving people in order to harm or gain access to their information. It is often used in conjunction with other types of exploits, even convincing people to ignore proper security procedures. Social engineering tactics can be used to convince people to download email attachments or to click on strange links that appear in our friends' messages.

Scareware, which also relies on social engineering, looks like a Windows warning, often posing as a registry cleaner or antivirus software, claiming that threats or vulnerabilities have been found on your system. Users who see this are prompted to install software to "fix" the problem. However, there may be something wrong with your computer, and some installed programs may even have devastating consequences for your system.