Is the law the only thing stopping many sites from being hacked/cracked?

Question

There are so many common vulnerabilities out there, so how is it that every Wordpress blog, for example, isn't hacked into often?

It seems like the security community is overly paranoid, unless the law is the only thing deterring skilled hackers.

Which one is it?

Answer 1

From a purely objective view, I don't think there is any evidence showing that cyberlaws are having a large impact on computers not being cracked. It's too easy to avoid prosecution (jurisdiction) and it's too easy to automate mass cracking.

On a more subjective view, I think the cyberlaws do keep the highly skilled security professionals honest, because the risk isn't worth it compared to their careers. You could argue that the laws are limiting the pool of people that might launch sophisticated attacks, making it easier put enough defense in place to stop the most likely attacker.

Answer 2

First of all, let's stop calling it hacking..we're confusing people. It's cracking (Thank you medias!)

Second, the law has never stopped the criminals from ever doing any criminal act whether online or offline. Websites, and servers, don't get cracked because they aren't interesting to the attackers and/or a tad bit too secure for the script kiddies out there scanning every possible IP they can put their (virtual) hands on.

And third, I don't believe there is such a thing as an overly paranoid security community, it would be like saying that the CIA is overly-precocious.

Answer 3

I think its the confluence of two aspects:

• Most people are actually pretty trustworthy, in that they wouldnt break a site just because they can. Sure, the sheer number of bad guys out there IS scary, but there are more GOOD users than BAD users. Btw, this includes more SITES than bad guys to hack them all.
• Most sites don't have much value worth hacking for. Nowadays most bad guys are hacking to get something in return, not just "cuz its fun" or "to show that I can". What would defacing some arbitrary blog benefit them? Even they have to show ROI... (with the exception of script kiddies, who ARE often scared of repercusions...)

But as @qbi said, if you're going to do something wrong, laws usually won't stop you (especially laws without teeth). Also, the paranoia relates to sites of value, and the level of countermeasures that are appropriate to that value: do a security analysis first.

Answer 4

One reason is discoverability. If your Wordpress blog isn't highly-ranked in the search engines, then the attackers will only get to it after they've done all the more popular ones. The reasons are twofold:

• the attackers are only going to find sites that can be found;
• malware "consumers" are only going to find sites that can be found.

So not only is the blog not easy for the attackers to detect, but the benefit of 0wning it is low.

Does the law deter hackers? That depends on how averse to risk the hackers are. Assuming rational would-be criminals, then the punishments exacted under the judicial system would be good deterrents. However, if you just assumed rational would-be criminals, then you did it wrong.

Answer 5

In general it would be possible that some attacker with enough resources could hack into every Wordpress blog. But attackers just scan for vulnerable software and attack them. Usually they download some script, enter an IP range and begin to "attack". When they run their software long enough and given that they have an exploit for every version of Wordpress (or any other software), they could attack any installation out there.

I don't think that the security community is overly paranoid, because if you run a vulnerable version of any software it is just a question of time until it will be attacked. Usually laws won't stop attackers. If you look at attacks you'll see them from a broad amount of different countries. Any has different laws.

Usually you should do a security analysis and decide from that what countermeasures you need.

Answer 6

Here are my two coins:

1. security never can be "overly paranoid" or "too much" - unfortunately the situation quite often is opposite;
2. the law has no effect on hackers - unless they got caught, it exists only on paper;
3. many things do happen without our awareness - and sometimes we got acknowledged too late, if even do;

Why do hackers hack?

• to show-off or to rebel, very often deface is the primary goal;
• for money - to collect botnets, to sell web-shells, to sell dedicated servers, etc.;
• just for fun or to help, how do often act whitehats;

When do hackers can break into? This is only the question of time that depends on the knowledge and skills of hacker. Also, would like to add, that even if your tiny homepage looks worthless to be hacked - it can be hacked just accidentally. Hackers (or script-kiddies in this case) do use mass-iframers, other automated tools that in the case of improper server configuration (or if the hacker has gained root rights on the server) just blindly does their dirty work, thus touching every site. So, be careful, watch your logs and sleep well.

Answer 7

1. Evidenced by the number of misconfigured PCs a lot of people do not have the ability even though it seems incredibly easy.
2. The big names don't tend to have these simple vulnerabilities as they hire very good admins and use proprietary gear. This is important as no hacker really cares about cracking someone's personal blog unless they have a vendetta against them.
3. A lot of people with the ability are simply apathetic. Cracking a site may be a fun challenge if you're a comp sci student but if you work in IT it just feels like unpaid work.

I Don't think the law really has anything to do with it apart from high profile government sites (CIA,NSA,FSB ect).