Why Systems Are Attacked

Every attack has a motive behind it, and the motive shapes what the attacker does. Two motives that are easy to confuse are attacking for fun or for the challenge and attacking for recognition. Neither attacker is usually trying to make money.

Fun and the challenge

Some people attack systems because working out how to get past the security is interesting. The aim is to put their abilities to the test, try out something they have just learned, or prove to themselves what they can do. Others simply want to know whether access is possible at all.

For an attacker like this, the win is getting in. They may take nothing and change nothing once they are inside, because the experience of defeating the security was the whole point.

Recognition and respect

Other attackers want to be noticed. They want people to see what they achieved and to be impressed, so they often choose a target that will be talked about. That might be a large, well-known organisation, or a site that matters to a group they want to impress, such as a fan-run wiki for a cult TV series or a national gaming tournament's leaderboard. Being talked about brings the attacker more attention than breaking into a system nobody discusses.

Because the aim is publicity, this attacker usually wants their success to be seen. For example, someone who gets into a retailer's customer accounts page might post a screenshot of the admin view on a forum, instead of quietly copying members' email addresses.

The motive matters because it tells you what the attacker was after. An attacker chasing a challenge is satisfied by reaching the system, while an attacker chasing recognition needs other people to hear about it – the achievement only counts once it has been seen.

Industrial espionage is the theft of confidential knowledge from an organisation — its business information, trade secrets or intellectual property — so that a rival can gain an advantage from it. The attacker is not after publicity or personal satisfaction; the target is knowledge that another company would pay for.

What gets stolen

• Business information — everyday records that would help a rival, such as a customer list, next season's prices or confidential sales figures.
• Trade secrets — a confidential method or recipe that gives the organisation its edge, such as the process used to make a sports drink or the settings used on a factory machine.
• Intellectual property — designs, inventions and software that belong to the organisation, such as the plan for a new bike lock or the source code of an app.

Why it happens

The motive is competitive advantage. A rival that obtains a design can skip the expensive development stage and release its own version, saving time and money. Stolen price plans let a rival undercut the original company, so customers switch. Sales figures show which customers to approach and what deals to offer. The thief may work for the rival, or may be an outsider who is paid to steal the knowledge.

For example, a company that designs escape rooms is planning three new rooms. A designer copies the plans and passes them to a rival opening in the next town. The rival opens with the same puzzles a month earlier, so the first company loses the customers who wanted to try something new.

This is not the same as breaking in for fun or to show off: there the attacker wants the challenge, while here the information itself is worth something to a rival.

Financial gain is a common motive for attacking a computer system. The attacker wants to make money, either by selling something they have stolen or by getting an organisation to pay them. Financial gain is the motive; stealing data or breaking into systems is how the attacker goes about it.

Extortion means gaining money by force, threats or pressure. In a cyber attack, the attacker demands a ransom — a payment made under threat — and holds on to something the organisation values, such as its data, its systems or its reputation. They may refuse to hand back stolen records, keep control of servers and workstations, or leave a service unusable until the money arrives. For example, an attacker who finds a way into the booking system of a chain of driving schools might threaten to publish how they did it, so that anyone could copy the trick, unless the schools pay. The schools may pay to protect their reputation, keep customers' details safe and avoid the fines that follow a loss of personal data.

Selling stolen data

Stolen data can also be sold, often to organised criminals. That gives the attacker a financial return without the original organisation paying anything. Organised criminals may pay hackers for stolen data because they can use it for fraud and other crimes, so there is a market for the records an attacker can take.

The financial motive shapes the attack. An attacker who wants a payment or a sale may steal records, hold systems to ransom or threaten to release private information. Not every attack is about money — some are for fun, a challenge or a grudge — but a financially motivated attacker is focused on getting paid.

A personal attack is an attack driven by a grudge or personal grievance. The attacker believes they have been treated unfairly by an organisation or by one person, so they want to cause harm, embarrassment or inconvenience. They are not mainly trying to make money.

The attacker might be a customer, a supplier, or anyone who believes the organisation has treated them badly. Because they already know something about how the organisation works, they can spot a weakness that an outsider would miss. For example, someone who has used a bike shop's website has seen that its password reset form asks only for a date of birth. They could use that weakness to get into another customer's account and change the delivery address, which inconveniences the customer and embarrasses the shop.

Sometimes a personal attack is aimed at one person rather than the whole organisation. A member who was removed from a sports club's team might get into the club secretary's email account, because the password is the name of the secretary's dog and everyone in the club knows it. They could then send unpleasant messages to other members. The aim is to upset or inconvenience that individual because of a personal disagreement.

Disruption is any attack that prevents an organisation from operating normally. The attacker's aim is not mainly to steal information: it is to stop services working or to make the organisation's data unreliable.

Disruption usually shows itself in one of two ways. A service can be made unavailable, or stored information can be altered so that staff can no longer trust it.

• An attacker repeatedly enters wrong passwords for a tennis club's court-booking site, so members' accounts lock and they cannot book a court for the whole weekend.
• Someone edits the stock figures for a bike shop so the system claims 40 helmets are in the warehouse when only 4 are there. Staff order the wrong amounts and customers are let down at the counter.

Targets and reasons

Disruption is a reason in its own right: the attacker wants to stop the organisation working, not to steal from it. The target does not have to be a business. A college, a health clinic, government services and political groups can all be disrupted in the same way, because each relies on systems that must keep working.

Disruption can hit organisations of every size. A small charity and a supermarket chain can both be disrupted: their systems simply stop being usable.

What it costs the organisation

Loss of earnings comes first. If a café chain's payment terminals are down for a whole afternoon, customers who cannot pay tend to leave, and some never return. Reputation is the second cost. A service that keeps failing looks careless, so customers may move to a competitor and may not trust that organisation with their details again.

Data and information theft is the crime of stealing data because the data itself is worth something, and it is one of the main reasons a system is attacked. The attacker is not trying to prove they can break in — they want the records held on the system, because those records can be used or sold. Details that point to a real person are the most wanted, since they can be turned into fraud.

A record only has to link a few facts about you to be useful: enough for a criminal to open an account, pass a security check or spend money in your name. Single records are worth little, so stolen data is traded in bulk on a black market, where criminals buy and sell files of records. The person who took the data may never use it; passing it on is the whole point.

Data theft often leads to two other crimes:

• Identity theft — someone uses another person's details to pretend to be them, for example to open accounts or take out credit. The victim usually finds out only when a bill or a refused loan arrives.
• Extortion — stolen data is used to pressure a person or an organisation into paying money. The attacker threatens to release what they hold unless they are paid, so the data is blackmail material.

For example, a tennis club stores details of players, parents and volunteers so it can collect fees. An attacker copies the whole database. One buyer uses a parent's details to take out a mobile contract in that parent's name, which is identity theft. Another buyer emails the club with a page of the records and threatens to publish the lot unless £2,000 is paid, which is extortion. Both crimes harm the people in the records as well as the club.

The aim here is to get hold of the information, not to stop the service running. An attack that mainly stops normal operation is a disruption attack, a separate reason for attacking a system.