Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/16/2015
05:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

7 Deadly Sins That Get Users Hacked

How users and their endpoints are leveraged by the bad guys to eventually find their way to critical data
Previous
1 of 8
Next

Common knowledge has it that users are the weakest link in the IT risk management world—particularly negligent or uneducated users. But how exactly are the bad guys taking advantage of this ignorance or lack of care to break into users' endpoints and corporate accounts? Many of their methods involve just a little bit of psychological sleight of hand because phishing and social engineering tend to play a part in most attacks. Here are some of the worst ways users make themselves open to the onslaught.

 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
pawan14
50%
50%
pawan14,
User Rank: Apprentice
6/8/2015 | 4:21:42 AM
Re: Username/password is main problem
The long we continue to user Username/password combination the worse these situation will get. 
SashKhe
50%
50%
SashKhe,
User Rank: Apprentice
4/23/2015 | 7:27:30 AM
Re: Username/password is main problem
If people would start using key-patterns instead of letter patterns as password, that would help too.
Example, "draw" a circle on your keyboard, every second key pressed is with shift - you just made a strong password that's as easy to remember as looking at your keyboard.
SashKhe
50%
50%
SashKhe,
User Rank: Apprentice
4/23/2015 | 7:24:54 AM
Re: Username/password is main problem
Don't forget the salt.
MarkSitkowski
50%
50%
MarkSitkowski,
User Rank: Moderator
4/20/2015 | 11:40:45 PM
Re: Username/password is main problem
I agree - and so do thousands of others, probably.

Thing is, it's not even necessary to send anything meaningful. Imagine, that you have a secret word, which only you know. Now imagine you are presented with an alphabet, under which is a random array of 0's and 1's. You enter the pattern corresponding to your secret word, which won't be the same next time you login, as the 0's and 1's are random.

Oh, yes, just in case anyone is listening on the network, you don't send the solution, you just send its SHA256 hash.

Isn't that better than passwords?
cyclepro
50%
50%
cyclepro,
User Rank: Strategist
4/20/2015 | 9:07:04 AM
hacking
One other way that was not mentioned is through Instant Messaging.

 

I always just delete any messages where I do not recognize the person.

 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/18/2015 | 11:11:24 AM
Re: Fake phone calls
Nice tactic. You can also tell them what a good service they acre providing and you want to send kudos to their bosses if they can provide phone number for that. You never know, they may be providing real number of their boss.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/18/2015 | 11:07:50 AM
Re: Fake phone calls
I tend to do the same thing, not answering any unknown and waiting for voice message for the number I do not recognize. It is safer and saving time that way.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/18/2015 | 11:05:40 AM
Re: Fake phone calls
I like the idea, keeping them on the line until they hang up. Or giving the all the fake information so they can continue their effort.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
4/18/2015 | 11:02:35 AM
Username/password is main problem
The long we continue to user Username/password combination the worse these situation will get. Today, most common attacks are phishing and social engineering attacks on the end-users side, even these attacks are the results of the fact tags we use username/password combination. We need to find out a way to get rid of it or move the next level such as two or three factor authentication.
SmarterThanTheAverageBear
50%
50%
SmarterThanTheAverageBear,
User Rank: Apprentice
4/17/2015 | 7:55:31 PM
Re: Fake phone calls
Tell them your boss wants to hear more about their services and you are going to forward their call to him then forward them to the FBI/NSA or one of the otgher alphabet soups :)
Page 1 / 2   >   >>
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Is Zero Trust the Best Answer to the COVID-19 Lockdown?
Dan Blum, Cybersecurity & Risk Management Strategist,  5/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13485
PUBLISHED: 2020-05-25
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
CVE-2020-13486
PUBLISHED: 2020-05-25
The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.
CVE-2020-13482
PUBLISHED: 2020-05-25
EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
CVE-2020-13458
PUBLISHED: 2020-05-25
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action.
CVE-2020-13459
PUBLISHED: 2020-05-25
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.