Hackers use a variety of clever tricks and tactics to deceive internet users into giving up valuable personal information or downloading malware onto their devices. By understanding how these hacking techniques work, you can better protect yourself online.
Phishing
Phishing is one of the most common ways hackers trick victims. It involves sending fraudulent emails made to look like they are from a trustworthy source like a bank, credit card company, or social media site. The email will typically contain a link to a fake but convincing copy of the legitimate website designed to steal login credentials or financial information. Phishing emails often use urgency, fear, or a too-good-to-be-true offer to entice recipients to click on the malicious link without thinking it through first. Some red flags of a phishing attempt are poor spelling and grammar, generic greetings, suspicious links, requests for sensitive information over email, and threats to close accounts.
Examples of phishing
- An email alert about a compromised account that requires you to login and change your password immediately.
- A message claiming you have an unpaid invoice or package delivery that needs confirmation.
- Notifications of winning prizes, gift cards, or inheritances from lotteries you never entered.
Social Engineering
Social engineering is the art of manipulating people into divulging confidential information or taking actions that may not be in their best interest. It relies on natural human tendencies to want to help others or obey figures of authority. Hackers can use phone calls, emails, or even face-to-face interaction to pose as tech support, colleagues, or other trusted sources in order to trick their targets. For example, a hacker may pretend to be from the IT department and claim they need a password reset to fix a computer issue. Other times they will appeal to people’s sense of curiosity or greed with promises of free vacations or investment gains if they just provide some personal details. Being wary of any unsolicited contacts asking for private information is key to avoiding social engineering schemes.
Examples of social engineering
- Calls pretending to be from the IRS threatening arrest if taxes aren’t paid immediately.
- Tech support scams that say they detected a problem with your computer and need remote access to fix it.
- Requests to verify sensitive information like SSN or bank account numbers from someone claiming to be a banker.
Baiting
Baiting tactics rely on tempting users into mistakes through the promise of something desirable like free music or movie downloads. Hackers bait victims by scattering malware-infected USB flash drives or CDs in public places like parking lots where people may find them and insert them into their computers out of curiosity about the contents. They may also leave infected devices unattended at airports or cafes hoping someone will plug them in and open files. The malware then infects the finder’s computer and can spread malware further or allow the hacker remote access. Avoid plugging in any unknown devices without scanning them first. Also be wary of opening unsolicited files sent over email or social media that could contain harmful scripts or programs.
Examples of baiting
- Infected USBs labeled with enticing file names like “Employee Salaries” or “Confidential Document.”
- CDs or DVDs marked as having free software trials, music albums, or movie downloads.
- Unknown smartphone or camera memory cards left out in public places.
Quid Pro Quo
Quid pro quo attacks take advantage of a user’s willingness to exchange a favor or service in return for something they want. The hacker will pretend to offer access to an interesting website, game cheat codes, pirated movies, or some other appealing resource, but only if the victim provides login credentials, downloads a piece of software, or completes a survey first. However, the resource offered by the hacker is either fake or itself a malware payload while the site credentials, downloaded software, or survey info helps them access accounts, install viruses, or reveal personal information.
Examples of quid pro quo
- “I’ll give you the password to this premium dating site if you do a quick survey for me first.” (Survey harvests personal details.)
- “Download this flash player update first so you can watch this new movie for free.” (Update is malware.)
- “Give me your login to this site and I’ll trade you my login to a better version.” (Gains your credentials.)
Scareware
Scareware is malware that pretends to be legitimate antivirus or system cleaning software. Users are enticed into downloading and installing it through promotions on shady websites or pop-up ads claiming the user’s computer has been infected with viruses. Once installed, it either simulates virus scans designed to scare users into purchasing the full fake software or it actually installs real malware disguised as the antivirus software. Fake technical support calls also use scare tactics to get remote access or payments to remove non-existent threats. Avoid downloads from unfamiliar sites and avoid allowing remote access unless you initiated the call.
Examples of scareware
- Pop-ups with warnings like “500 viruses detected! Click here to remove threats and scan your system.”
- Browser lock screens that say your system is infected and you must call a support number to unlock it.
- “You have a serious security issue! Please provide credit card to activate protection.”
Watering Hole Attacks
Watering hole attacks target specific groups by infecting websites commonly visited by those groups. For example, hackers may compromise a news site frequented by government workers to automatically download malware onto visitors’ devices. The infection then quickly spreads within the targeted organization. Users can avoid watering holes by keeping browsers, plugins, and systems fully updated and using reputable antivirus software. Be wary of downloading programs or files from any compromised sites.
Examples of watering hole attacks
- Hackers infect the site of a trade magazine read by energy company employees.
- A travel booking site popular with executives in a certain industry is compromised.
- Sites frequented by government workers are embedded with malware traps.
Typosquatting
Typosquatting relies on internet users mistyping web addresses into their browsers. Hackers register domains containing common misspellings of popular websites in order to deceive visitors expecting to go to the correct site. For example, they may use amazon.co instead of amazon.com. The typosquatting site looks identical to the real one but downloads malware onto visitors’ devices when they land there. Typosquatting domains can also be used for phishing. Be careful when entering any web address and double check before clicking further.
Examples of typosquatting
- paypai.com instead of paypal.com
- yoitube.com instead of youtube.com
- amzon.com instead of amazon.com
Evil Twins
Evil twin attacks create fake rogue wireless access points (APs) that look like legitimate public Wi-Fi networks you may want to connect to. When users connect to the evil twin AP, all their internet traffic is intercepted, captured, and redirected through the hacker’s system allowing data theft. Evil twins are common at coffee shops and airports. You can avoid them by not auto-connecting to open networks and using trusted VPN connections that encrypt your web traffic when on public Wi-Fi.
Examples of evil twin attacks
- “Starbucks Wi-Fi” or “Airport Wi-Fi” rogue networks.
- Fake hotspots named after the legitimate location e.g. “Penguin Books Free Wi-Fi.”
- Access points using the same SSID as the legitimate network.
Drive-by Downloads
Drive-by download attacks target random internet visitors, unlike watering hole attacks. Hackers identify vulnerable websites with weak security and embed malicious code or links that automatically download malware to anyone that simply visits the site. The infection happens in the background without the user’s consent or interaction. Keeping your browser fully updated offers some protection against drive-by downloads, but avoiding suspicious, disreputable, or known compromised sites is key.
Examples of drive-by downloads
- Popup or redirect scripts that download malware before you even click anything.
- Ads on websites that contain hidden iframes linked to malware sites.
- Sites with lazy loading that fetch malicious content from other sites as you scroll down.
clickjacking
Clickjacking tricks users into clicking on hidden malicious links or buttons as they attempt to navigate through a legitimate website or social media profile. The hacker will overlay transparent layers containing the harmful links on top of the real pages in a way that leads users to click on them inadvertently. For example, a clickjacked “Play Video” button may really contain a link to install malware or share spam. Disable auto-loading of iframes and be very careful when clicking buttons on sketchy looking pages.
Examples of clickjacking
- Like or share buttons that are really links to malware sites.
- Invisible pop-ups that load behind the current window.
- Transparent buttons placed strategically over legitimate buttons.
Ransomware
Ransomware is a type of malware that encrypts files on a computer or mobile device until the victim pays a ransom to regain access. It often arrives through phishing emails or compromised sites that get users to download fake software updates or files. Once installed, it spreads quickly to encrypt documents, photos, databases, and even entire hard drives preventing access. Ransomware then displays payment instructions demanding cryptocurrencies like Bitcoin in exchange for the decryption key. However, even if paid, decryption is not guaranteed. The best protection is through awareness, robust backups, and updated antivirus tools.
Examples of ransomware
- CryptoLocker, CryptoWall, WannaCry
- Ransomware posing as fake antivirus software
- NotPetya, Locky, Cerber demanding Bitcoin payments
Man-in-the-Middle Attacks
Man-in-the-middle or MITM attacks allow hackers to eavesdrop on communications between two targets by secretly relaying and even altering the exchanges. The victims believe they are communicating directly when in fact the hacker is intercepting everything through a compromised router, Wi-Fi hotspot, or other method. This allows data and credentials to be stolen. Always access the internet through a VPN and avoid public Wi-Fi when conducting any sensitive online transactions to prevent MITM spying.
Examples of man-in-the-middle attacks
- Hackers setting up fake Wi-Fi hotspots to intercept connections in public places.
- Intercepting communications between a user and website to steal login credentials.
- Spying on the connection between two colleagues video chatting on an open network.
Spear Phishing
Spear phishing targets specific individuals within companies, governments, or other groups with emails tailored specifically to them. Instead of generic messages, the phishing emails use familiar names, functions, and details to appear far more legitimate, trustworthy, and harder to detect. For example, a finance employee may receive a fake internal memo from the “Chief Financial Officer” requesting confidential data. Avoiding spear phishing requires extra vigilance about sharing info or opening attachments from anyone remotely suspicious.
Examples of spear phishing
- Email from fake CEO requesting W2 and salary details from HR.
- Urgent security alert from “IT department” to change password immediately.
- Login request from “head of engineering” to access project management system.
Whaling
Whaling is a specialized form of spear phishing that exclusively targets high-profile business executives, politicians, celebrities, or other prominent figures. As the “big fish” with access to sensitive systems and data, they present lucrative opportunities for hackers. Whaling attacks use extreme convincement, such as posing as colleagues, subordinates, technical support, or other trusted roles familiar with the target’s work. This tricks the victims into sharing valuable personal or corporate details. Extra awareness of any unusual contacts or requests for information can help defend against whaling efforts.
Examples of whaling
- Fake meeting organizer from executive assistant asking CEO to confirm travel plans.
- Urgent document sent by hacker impersonating legal counsel.
- Call from “head IT guy” needing the CFO’s password to fix server issues.
Vishing
Vishing uses phone calls, voice messages, or audio recordings instead of emails to implement phishing scams and social engineering attacks. Hackers use phone based communications to establish legitimacy and urgency that emails lack when trying to manipulate potential victims. Common vishing tactics include impersonating authority figures, claiming technical problems require immediate action, or pretending to be a distressed loved one in need of money. Maintain caution sharing info or taking suggested actions over the phone.
Examples of vishing
- “Tech support” saying your iCloud was hacked and account will close without payment.
- Fake “detective” claiming a relative is in legal trouble and needs bail money.
- “Bank representative” requesting account numbers to fix an urgent problem.
Smishing
Smishing employs text messages for phishing and social engineering schemes the way vishing uses phone calls. Criminals masquerade as familiar contacts or trusted businesses through SMS to send convincing links, downloads, or warnings designed to obtain sensitive data or install malware. Smishing texts containing phrases like “verify account now” with a bad link or conveying false emergencies are common. Treat unsolicited texts requesting personal details or sketchy downloads with extreme skepticism.
Examples of smishing
- Fake delivery company texts with a bad tracking link.
- Texts pretending to be a friend in need of quick cash.
- Fake bank SMS requesting account verification to avoid closure.
Conclusion
Hackers are sophisticated, patient, and constantly innovating new ways to deceive internet users for profit or malice. But through education, vigilance, and proper online security habits like using strong unique passwords, avoiding suspicious links or attachments, keeping software up to date, not auto-connecting to open Wi-Fi, and using VPNs when on public networks, you can greatly reduce your risks and frustrate their efforts.