There is a part of me that finds hackers, or cyber-criminals, of fascinating interest. Whether it’s the clandestine nature of their ‘profession’ or the untapped genius with which some of them operate that I find curious, I do not know.
On the flip side, I am fully aware of the devastating damage they can cause to both individuals and organizations, and that no matter how much technological knowhow they possess there is no escaping the fact they are corrupt law-breakers and thieves.
Admittedly, I am probably someone who is all too easily taken in by the often exciting portrayals of cyber-hackers in various Hollywood movies (think The Social Network, Wargames, Blackhat) and, in reality, I know real-life hacking can be slow, tedious work that that often returns little financial gain (if any) for what can be weeks of testing and experimenting.
With all of this in mind, I decided to take a closer look at the world of cyber-criminals to try and get to the bottom of just what it is that motivates them to do what they do and ultimately shed a little light on who appears to be most at risk of an attack. Is it the lure of breaching a multimillion dollar company? Do they dream of the ‘big pay out’ that can set them up for a millionaire lifestyle? Or are they simply trying to ‘earn’ enough money to survive?
It’s pretty clear that most hackers are driven by some form of financial gain. However, recent reports have revealed some contrasting findings in terms of how ‘big’ a gain they are either chasing or able to secure.
According to ‘Flipping the Economics of Attacks’ by Palo Alto Networks and the Ponemon Institute 67% of UK hackers admitted that money is their main incentive for their criminality, although the same research revealed that the average UK cyber-criminal makes just over £20,000 per year (an average of £8600 per attack). These are not excessive amounts of money and are lower than I would have expected, especially when you consider a cybersecurity professional can earn up to four-times that much. This suggests that cyber-hackers are more likely to focus their efforts on quick, easy targets with realistic financial payouts.
After all, more than half (54%) of UK respondents said that it takes less than 24 hours for an experienced criminal to plan and carry-out an attack against an organization with a ‘typical’ IT security structure, with 60% admitting that if the time it takes to perform an attack were to increase by less than two days (40 hours), they would be deterred and move onto another target. Here are our first clues into how hackers work: they are opportunists who like to act quickly to target organizations with weak IT security infrastructures.
It was interesting, then, when I stumbled across an article by the Financial Times reporting a recent upsurge in the number of cyber-attacks carried out against the very wealthy and those who manage their own finances. According to the report, security group Kroll discovered hackers are using networking sites such as LinkedIn to search and identify people with significantly well-paid jobs and then targeting them with malicious attacks to trick them into transferring money. This suggests a shift in technique, with hackers abandoning traditional mass-phishing exercises and focusing on specific targets. A possible reason for this is that it is becoming more common for people, especially pensioners, to have full access to their finances.
David Flower, MD EMEA, Carbon Black, told Infosecurity:
“It’s fair to say that both high net worth individuals and those that manage their wealth are at a significant risk from hackers. The individuals themselves will always represent an attractive target, particularly for phishing attacks on their endpoints. If a hacker gains access, they could find themselves with a wealth of blackmail material, or information that could let them gain access to funds, so they will always be an attractive and potentially weaker target – particularly if they hit their home server or desktop.”
Kroll investigated attacks that ranged in value from a few thousand pounds to multimillion pound scams, with cyber-crime estimated to have cost the national economy in excess of £30 billion, figures that significantly contrast those put forward in ‘Flipping the Economics of Attacks’. So, here we have another insight into the minds of cyber-criminals which suggests that far from being satisfied with targeting simple IT infrastructures for small, quick profits many do harbor a desire to secure the elusive ‘big pay out’.
Whilst Flower agrees that the very wealthy are a key target for cyber-criminals, he also comments on risks surrounding the wider sphere of financial influence, explaining that brokers, financial advisors, and even personal assistants are also potential targets. He says:
“By targeting non-executive staff within the wealth chain, whether a broker, or admin assistant, with a malicious email or similar, cyber-criminals can potentially gain access to a server and by extension, millions of pounds worth of financial data.”
One thing that both reports do is highlight two specific targets that hackers seem to be focusing on.
Firstly, findings from ‘Flipping the Economics of Attacks’ clearly show that because cyber-criminals are so concerned with how long an attack takes to carry-out, organizations whose security infrastructure is deemed to be ‘less mature’ are at greater risk as they can be breached quicker. In contrast, companies that take active steps to share threat intelligence with peers, adopt a prevention-first approach and invest in appropriate technologies that slow the progress of cyber-breaches are far more likely to avoid becoming victims of an attack.
Moving on to the article by the Financial Times, we can also see that hackers are using inventive techniques to pinpoint wealthy individuals, often cloning their email addresses and fraudulently instructing for money to be moved from one account to another. Therefore, people working within board-level roles should be mindful of the amount of information they share on sites like LinkedIn.
Whatever their motivation, cyber-hackers are becoming more sophisticated in their techniques and the prevalence of attacks appears to be on the rise.
Flower added:
“It is safe to say that this is a battle that isn’t going to be won any time soon but if cyber-criminals are able to exploit human vulnerabilities for ‘quick wins’, IT needs to step in and provide safeguards that allow for human weakness.”