CYBR650 Week 3

I chose an article for this week's assignment DarkReading, How End-User Devices Get Hacked: 8 Easy Ways.

The article opens with, "When it comes to scamming consumers and businesses, the most effective strategies aren't necessarily the most complex."  From experience, the vast majority of the time this is very true.  It goes on to say that attacks are often platform-based and payload matters less than delivery method.  The article goes on to describe the eight popular ways to hack end users.

Of course, the first method mentioned was Phishing.  This is the most low cost and low technical ability type of attack.  An Office document with macros enabled or a PowerShell script that overtakes system, an easy way to exploit the had to patch human factor.  Next, wireless hijacking or interception.  The article provides an example of using a "wifi pineapple" can compromise an end-user device via wireless attack.  The downside is, unlike Phishing, the attacker must me in close proximity to the target.  Then SmShing attacks which require users to click malicious links sent via text messages.  The fourth method listed was impersonation which is another social engineering attack conducted by individuals posing as a legitimate entity.

Number five, physical possession.  The article states, "Physical access to someone's system is almost always game over ..."; however, I disagree.  If the drive is encrypted, it might not be game over quite as quick as the author makes it sound.  Next, fake downloads.  While this could be an unexpected download, but more than likely it is an individual loading pirated software.  Seventh, unpatched vulnerabilities.  The article states, "Attackers frequently exploit unpatched flaws by scanning the Internet looking for vulnerabilities, or targeting specific environments, to gain entry. He cites the recent WannaCry ransomware attack as an example."  This is kind of a no brainer, open a few common ports and watch the constant probes.  Finally, client-side exploits which involves payloads sent via JavaScript, which may be injected through Tor proxies, all the way through to typo-squatting attacks that deliver malicious applets or Flash exploits when someone mis-correctly types a website address.

Not a very earth shattering article, but it does point out, as most articles do, the most popular attacks are via social engineering.  In fact, most attacks have a social engineering component.  So, while this ended up being a ho-hum article it does enforce that most attacks are simple and not some zero-day/ NSA cracking tool event.


DarkReading. (2017, June 9). How End-User Devices Get Hacked: 8 Easy Ways. Retrieved from: http://www.darkreading.com/attacks-breaches/how-end-user-devices-get-hacked-8-easy-ways/d/d-id/1329107