from when i was kid until today , i still have this idea that hacking is someone knows your ip address then he magically control your device and take a copy of your data. without even sending you a file or a software to install , then i saw in cve website that there are some vulnerabilities on android such as when a file is loaded and arbitrary code can be executed on your device , the word when a well crafted file is loaded seems scary , that mean for me that visiting a websites can lead to load this crafted file as a image or others , what i do want to know , is hacking really that easy ? just when a file is loaded it will execute code on your device ?
closed as too broad by Matthew, vidarlo, pri, A. Hersean, AndrolGenhald Apr 18 at 14:41
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Yes, in theory attacking a device can be as "easy" as to make you visit a malicious page with your browser. Or just connecting to a WIFI access point, having bluetooth enabled when an attacker or a malicious device is near you, opening a trusted application and somehow making it load malicious data, etc. There are a lot of attack vectors you might not be aware of. For example, your computer might load malicious code directly from compromised official repositories as part of some automatic process (like updates). In this case to get hacked all you have to do is update your software, and your system will download a malicious update. This is called "supply chain attack", and here's a recent example (about Asus PCs): https://arstechnica.com/information-technology/2019/03/hijacked-asus-software-updates-installed-backdoor-on-at-least-0-5-million-pcs/
Generally though it's not "easy" to hack a device if the usual security advice has been followed: keeping the OS and every application up-to-date, only install trusted software from official trusted sources, configure everything properly (disable services you don't need, close ports, use strong passwords, etc.) and so on. If you follow the best security practices, hacking your device becomes much harder. Exactly how "easy" or how "hard" will depend on your threat model and your security controls. For example, it might still be easy for a government agency to attack your device (they might be able to exploit serious unknown vulnerabilities, called "zero-day"), but a random guy from the Internet (like a script kiddie) will probably have a hard time trying to attack you.
No one can just "read" anything from your computer/smartphone via the internet. Your computer/smartphone has to actively send it to them.
This being said, there are many applications running on your computer/smartphone that are designed to send data to others through the internet, just like your browser, when it is sending your request to view a certain web page or your messaging client when you send a message or check the server if there are new messages.
For your convenience, many of these applications will not ask your permission everytime they send something to the internet, but they will permanently listen to the internet for legitimate requests and reply to them.
But how does an application distinguish between legitimate requests and malicious requests? This is the tricky part and if developers made a mistake here, attackers can find and exploit it.
So, what increases your risk of "getting hacked"?
- having many applications running that communicate with the internet
- using many "convenient" features like automatic installation, automatic loading of media contents, etc.
- Using old versions of your applications (and your operation system). When software developers get word of security breaks in their software they usually try to fix them asap and release a new fixed version.
So, don't litter your devices with useless, outdated applications. Always update your operation system and the applications you need and remove those you don't need.