Exploiting Weaknesses

Hackers rarely get in by guessing a password at random. They look for a weakness in a system and use it to get in. That weakness can be technical, in the software itself, or human, in the people who use it.

Technical vulnerabilities

Unpatched software is a program that is still running without an update which fixes a security flaw. When a company finds a flaw it writes a patch and releases it as an update for everyone. Attackers find out about the same flaw, so they know exactly how to get in until the update is installed. For example, the computers in a college design studio still run an old version of the image-editing software: the update was downloaded months ago but never installed, so anyone who knows about the flaw can break into those machines.

Out-of-date anti-malware is a weakness because the software can only recognise malware that was already known when it was last updated. New malware is written every day, so anti-malware last updated months ago has no record of anything written since. It is still running, so the computer looks protected, but a newly written piece of malware can be installed and run with no warning appearing.

Social engineering

Social engineering means attacking the person rather than the software. The hacker manipulates you into doing something that helps them: opening an attachment that installs malware, or telling them something you are meant to keep secret. For example, someone phones the school office, says they are from the broadband company sorting out an outage, and asks for the admin password so they can test the line. Nothing technical is needed, because a person simply hands the password over.