Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There are so many common vulnerabilities out there, so how is it that every Wordpress blog, for example, isn't hacked into often?

It seems like the security community is overly paranoid, unless the law is the only thing deterring skilled hackers.

Which one is it?

share|improve this question
2  
If you are proposing an argument that the computer crime laws prevent computer crime and computer fraud, then you don't understand any one of the following 3 things: a) computers and associated computer technology, b) law, or c) criminals –  atdre Nov 17 '10 at 22:50
    
@atdre - No, I'm asking if it's the case that laws prevent cybercrime. –  Moshe Nov 17 '10 at 23:24
3  
"laws prevent cybercrime"? Heh: without laws, there would be no crime.... And there are many laws out there about "unauthorized access" that are so broad as to endanger the good guys. See e.g. the famous case of Randall Schwartz v Intel. I visited the trial and it was scary! Thankfully it finally came to a better resolution 11 years after his conviction. This isn't the place to discuss the situations where the question is whether it should be a crime in the first place, but it's often an important question. –  nealmcb Jul 16 '11 at 16:04

7 Answers 7

up vote 12 down vote accepted

From a purely objective view, I don't think there is any evidence showing that cyberlaws are having a large impact on computers not being cracked. It's too easy to avoid prosecution (jurisdiction) and it's too easy to automate mass cracking.

On a more subjective view, I think the cyberlaws do keep the highly skilled security professionals honest, because the risk isn't worth it compared to their careers. You could argue that the laws are limiting the pool of people that might launch sophisticated attacks, making it easier put enough defense in place to stop the most likely attacker.

share|improve this answer
  1. Evidenced by the number of misconfigured PCs a lot of people do not have the ability even though it seems incredibly easy.
  2. The big names don't tend to have these simple vulnerabilities as they hire very good admins and use proprietary gear. This is important as no hacker really cares about cracking someone's personal blog unless they have a vendetta against them.
  3. A lot of people with the ability are simply apathetic. Cracking a site may be a fun challenge if you're a comp sci student but if you work in IT it just feels like unpaid work.

I Don't think the law really has anything to do with it apart from high profile government sites (CIA,NSA,FSB ect).

share|improve this answer

First of all, let's stop calling it hacking..we're confusing people. It's cracking (Thank you medias!)

Second, the law has never stopped the criminals from ever doing any criminal act whether online or offline. Websites, and servers, don't get cracked because they aren't interesting to the attackers and/or a tad bit too secure for the script kiddies out there scanning every possible IP they can put their (virtual) hands on.

And third, I don't believe there is such a thing as an overly paranoid security community, it would be like saying that the CIA is overly-precocious.

share|improve this answer
1  
Actually, Georges, despite what we would like to call it, because the majority of people call it hacking, that is the proper term. That said, I've changed the title to reflect your thoughts. Thanks for your answer. –  Moshe Nov 20 '10 at 22:44
5  
Moshe, I'm sorry but I don't think the proper term is defined "because the majority of people call it hacking". Hacking is all about breaking and making things (breaking as in purposeful deconstruction to discover the inner workings of something). It is the proper term for what I just described because that's the word that was first used for it before the media 'kidnapped' and turned it into what it is now. –  Georges Duplessy Nov 20 '10 at 23:20

One reason is discoverability. If your Wordpress blog isn't highly-ranked in the search engines, then the attackers will only get to it after they've done all the more popular ones. The reasons are twofold:

  • the attackers are only going to find sites that can be found;
  • malware "consumers" are only going to find sites that can be found.

So not only is the blog not easy for the attackers to detect, but the benefit of 0wning it is low.

Does the law deter hackers? That depends on how averse to risk the hackers are. Assuming rational would-be criminals, then the punishments exacted under the judicial system would be good deterrents. However, if you just assumed rational would-be criminals, then you did it wrong.

share|improve this answer

Here are my two coins:

  1. security never can be "overly paranoid" or "too much" - unfortunately the situation quite often is opposite;
  2. the law has no effect on hackers - unless they got caught, it exists only on paper;
  3. many things do happen without our awareness - and sometimes we got acknowledged too late, if even do;

Why do hackers hack?

  • to show-off or to rebel, very often deface is the primary goal;
  • for money - to collect botnets, to sell web-shells, to sell dedicated servers, etc.;
  • just for fun or to help, how do often act whitehats;

When do hackers can break into? This is only the question of time that depends on the knowledge and skills of hacker. Also, would like to add, that even if your tiny homepage looks worthless to be hacked - it can be hacked just accidentally. Hackers (or script-kiddies in this case) do use mass-iframers, other automated tools that in the case of improper server configuration (or if the hacker has gained root rights on the server) just blindly does their dirty work, thus touching every site. So, be careful, watch your logs and sleep well.

share|improve this answer
2  
Security can of course be too much. One recent example are the pornoscanners. If you build a security system, you always have to weigth between usability (in a broader sense) and security. –  qbi Nov 18 '10 at 0:43
    
I would say that this is the case of improper protective measures realization that leads to loss of usability and starts to be just annoying feature. Security is not only "when" and "where", but also "how". –  anonymous Nov 18 '10 at 10:28
1  
Of course security can be "too much"! Consider, for example, having to log in to this site by using a custom certificate built by combining information sent to you via multiple channels (postal mail, email, sms, bank transaction verification code). And then consider having to revew that certificate every month. Very secure, sure, but probably a bit too much considering the use... –  Ilari Kajaste Nov 19 '10 at 10:47
    
The law can have an deterring effect on crackers, whether or not they get caught. Whether it does in reality is another question, but the theory of the deterring effect is a pretty solid argument. –  Ilari Kajaste Nov 19 '10 at 10:48
1  
I think the only way you can assert that there can never be too much security, is to suggest that there is a way to keep adding security without adding additional cost. I don't think it is possible to keep increasing the security without increasing the cost (ie: every unit of security has a non-zero cost). So even if you have proper implementation at each layer, at some point the cost doesn't make sense for what you are securing. When that happens, i think you can say you have too much security. –  rox0r Nov 19 '10 at 20:09

I think its the confluence of two aspects:

  • Most people are actually pretty trustworthy, in that they wouldnt break a site just because they can. Sure, the sheer number of bad guys out there IS scary, but there are more GOOD users than BAD users. Btw, this includes more SITES than bad guys to hack them all.
  • Most sites don't have much value worth hacking for. Nowadays most bad guys are hacking to get something in return, not just "cuz its fun" or "to show that I can". What would defacing some arbitrary blog benefit them? Even they have to show ROI... (with the exception of script kiddies, who ARE often scared of repercusions...)

But as @qbi said, if you're going to do something wrong, laws usually won't stop you (especially laws without teeth). Also, the paranoia relates to sites of value, and the level of countermeasures that are appropriate to that value: do a security analysis first.

share|improve this answer

In general it would be possible that some attacker with enough resources could hack into every Wordpress blog. But attackers just scan for vulnerable software and attack them. Usually they download some script, enter an IP range and begin to "attack". When they run their software long enough and given that they have an exploit for every version of Wordpress (or any other software), they could attack any installation out there.

I don't think that the security community is overly paranoid, because if you run a vulnerable version of any software it is just a question of time until it will be attacked. Usually laws won't stop attackers. If you look at attacks you'll see them from a broad amount of different countries. Any has different laws.

Usually you should do a security analysis and decide from that what countermeasures you need.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.