8

There is a saying that, rather than finding a vulnerability in a strong security system, the hacker is more likely to hack into your system by social engineering, physically breaking into the room the server is in, getting help from an insider, or even physically forcing you to compromise, etc, or any other way bypassing the software system.

Count phishing as a form of social engineering, this seemed quite convincing. But is it (or its negative) supported by any statistical data, say in the following cases?

  1. For any hack.
  2. For systems where the administrators supposedly know security enough.
  3. For valuable targets.
  4. Maybe others.
Improve this question
4
  • 3
    Only amateurs attack machines; professionals target people. -- Bruce Schneier This is because your defense is only as strong as its weakest point, and that weakest point is almost always going to be a person. Having said that, your question's too broad to answer. Define "hack". Is it a hack when a jealous lover tries to access his/her partner's Facebook account or smartphone? And then how would you go about collecting data on hacks or attempted hacks? Most aren't even noticed, let alone reported, so any stats you do get would have a massive hole and bias built into them.
    – HopelessN00b
    Apr 18, 2016 at 20:40
  • @HopelessN00b Yes, so I only expect answers for at least one case, such as for a type of valuable targets. But I don't think stats for Facebook hacks are completely infeasible, just probably inaccurate. They have logs if a known security hole is fixed. And a few websites have alternative measures to prevent access even if the password is correct. That's not successful hacks and sometimes even not attempted hacks, but the data may represent something.
    – user23013
    Apr 19, 2016 at 4:19
  • @HopelessN00b I know the point and even hope it is true. But 1. One hack because of a security hole sometimes is replicable everywhere around the world. The fact that even amateurs could do that only makes it more common. 2. Sometimes the admins are not qualified for setting up good security even though they are supposed to.
    – user23013
    Apr 19, 2016 at 4:26
  • @HopelessN00b - you can sample differently. Buy second hand phones and see what has happened to them. The SANS health care report I mentioned below used detection of outgoing malicious traffic to detect compromised health institutes. There will be holes, such as people who blank their phones before selling, but these can be so rare the stats would still be valid or at least useful.
    – Michael
    Apr 19, 2016 at 8:21

1 Answer 1

Reset to default
4

Simple answer. That's no longer true, malware attacks are now most common. However that doesn't mean they are most important to everyone.

Various bodies like SANS/CERT and so on publish statistics of incidents they handle (for example UK Cert Q3 2015 report). Key quote:

malware is, and remains, the greatest threat to cybersecurity.

And that seems to be clear across almost all domains and reports. After that Phishing is almost universally listed second. This doesn't match with the (old) conventional wisdom that most attacks are social because most malware attacks are now automated. Instead of targeting one chosen machine, they are part of an massive automated attack looking for victims that match a given vulnerability.

By definition, however the statistics only cover the "unsuccessful" cases where the hackers get caught or don't even try to hide. For example there is a lack of reported cases where hardware was compromised during delivery. That's probably because people only just started looking. Apple seems to be a target for this and started checking all circuit boards. Soon we might find out that it's an important case. Or maybe they won't choose or be able to tell us:

Many of the organizations were compromised and, therefore, out of compliance for months, and some for the duration of the study—meaning they never detected their compromises or outbound malicious communications, nor did they acknowledge warnings from the Norse response team. - quote from SANS health care report - nobody will ever investigate these cases

However the whole statistical approach is misleading. It's "think like an engineer" instead of "think like an attacker". The majority of malware is randomly attacking everyone and don't particularly care who they get. For them the weakest link is the computer with the worst security. Probably, because they are working in big companies who actually hire security people, most security people should be more worried about a targeted attacker such as an employee or overseas competitor who will be more likely to use a social attack simply because the cost of entry is lower than writing custom malware. Even if an attacker is using malware for compromise, they may need to get it past your firewall. They compromise one machine via a phishing mail and then 1000 more inside your company with a worm. Does that count as one phishing attack and 1000 malware attacks? In the statistics it does.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .