"I'm just a hairdresser – who would ever want to hack me?"
Cybersecurity professionals like myself get asked variations of this question all the time. It seems common sense that no-one would bother to hack a small high street hairdresser with just a handful of staff.
However, if you think about the question more deeply, there are many reasons why even small businesses may be hacked. Threat actors vary by company, location, size, type, sector and another important consideration: supply chain.
A vast number of cyber attacks, from over a decade ago until the present day, are completely automated. Someone sets up a tool that goes after a WordPress vulnerability and it goes out scanning a massive range of public IP addresses.
If you look at any websites access log, you will see various attacks, trying to attack software which is not even present. The automated script will get lucky occasionally.
If you ask an ex-black hat hacker who would want to hack a hairdresser, they will tell you one main reason: to hide their identity when they hack the real target.
Instead of using a paid VPN or proxy service, which could be corroborated back to the true IP, you can bounce the attack through many zombie servers. Hack random targets and use SSH tunnelling to confuse so it looks like x company hacked you.
Ransomware has been used to target companies and organisations of all sizes, including the NHS, large American finance firms, sheriff’s departments, and (yes) hairdressers.
I have seen this personally going after FTSE 100s website infrastructure.
Every firm has a bank account. Malware can be used to capture logins and pinch money.
Can involve spear-phishing, more general phishing, identity theft or the request of phoney invoices to be paid.
In addition to the motives above, staff records can be used to find out where someone lives in order to burgle their house.
Imagine the hairdresser offers services to Claridge's hotel – them the hackers could gain information on UHNWI clients. Let's look at two quick scenarios to better illustrate the value of hacking a small constituent of a larger supply chain:
An aerospace engineering manufacturer:
The company supplies Boeing and Airbus (which isn't giving much away since they have thousands of suppliers). They make parts for engines and sell them directly. Boeing and Airbus have a massive supply chain and perhaps the company in question has new design plans to steal, or how about the designs to the end part so someone could make it cheaper?
Multinational property management firm
They own property globally and rent out floors and offices. All the properties are known to the public and you cannot remotely steal a building. The main target then is cash, and this company has tonnes of it! They get heaps of emails requesting a money transfer to fictitious suppliers. It only takes a few to get through the spam filter for criminals' payday.
Try one of our courses:
Visit cyber.qa.com for more information on how they can help solve the Cyber Security skills gap.
Graeme joined QA in 2017 and has worked in security on and off for 15 years. His last role was as a Senior Technical Security consultant at Capgemini covering the public and private sector.
From the age of 17, he was running investigations into online scams and phishing. Today he teaches and/or has written: CEH, OSINT, CTF (conventional or OSINT), CyberFirst, practical encryption and Security+. Graeme is an avid writer with 130+ articles to his name and a chapter in a published book.
He loves thinking like a hacker to review and tweak settings with a fine-tooth comb.
More articles by Graeme
Shadow IT during Covid-19: Do not let your employees decide which apps and tools to use
11 cybersecurity tips for more secure home-working during the Covid-19 outbreak
Hostile reconnaissance: What is it and how do we stay safe?
My partner is a landscape gardener – who would want to hack me?
7 cybersecurity tips for wedding photographers – or anyone, really
Cyber Security for everyone - what we all should know
Cyber Attacks - Most of them are not as high-tech as you'd think
Cyber risks are too often ignored by management
Rise and Fall of Bitcoin
Endpoint and network firewalling needs to change