Joshua Hammer: My name’s Joshua Hammer. I’m a sales operations manager here. A little bit about me. Oh, look at that. It’s Hackerman. What about him? He’s awesome, right? And he can hack time and space. If he hacked you, you’d never find him. And we’re all a bunch of noobs compared to him, so. Honestly though, let’s see. My name’s Joshua. I’ve been with Sucuri here for four years. I’m a sales operation manager, I’m married to a beautiful wife with two wonderful daughters and I love games, video games, board games, security, and laughing. I like to have fun.
Joshua
Hammer: So
what are we going to do? We’re going to go over a little about who
these guys are, what they do, whether they’re targeted hacks versus
what are random hacks, what SEO attacks are, and of course the ever
popular question, why me? Really though, one of the things that
hackers are going after is, well, they want their name out there.
They want that fame, right? Or we always see these wonderful hacked
pages that says hacked by and they give you the group name or hacked
by this individual. It’s because they’re trying to get their name out
there with the other groups that are out there and they want that rep
with their team.
Joshua
Hammer: So,
want to talk a little bit about random versus targeted attacks before
we get into more about why they’re attacking, but most of the attacks
that happen out there are random. They’re completely automated,
script based, bot attacks that target the weakest link and move on.
Not to say that there aren’t targeted attacks out there. There are
definitely targeted attacks. They’re just not as common as the random
attacks out there. Some of the targeted attacks you’ll find are
politically motivated attacks. These are ones that they’re trying to
spread the word. They’re hacktivists. They want to get their message
out there and so they’ll target different sites. You see a lot of
that in the US around election time, right? It’s always talking about
how Russia has targeted our systems, and take aim at our midterms,
and our primaries, and our president one because of the hackers and
that kind of stuff. I’m not saying it doesn’t happen. It definitely
happens out there, but whether or not it plays a big role, don’t
know.
Joshua
Hammer: Maybe
you made somebody mad and that’s why they targeted you. There was a
hack a few years ago on an epilepsy site. I’ve got a link to the news
article on the slide there, but basically this site where all these
people go to that have epilepsy for help on how to manage the
symptoms and the problems. And somebody hacked the site and changed
the frequency of the display to cause epileptic seizures. Great
people, right? Apparently somebody they knew had epilepsy, made them
mad and they thought that was the best revenge, is to hack an
epilepsy site and cause seizures for all the people that were
visiting the site. Fantastic. But the primary motivation and the most
popular motivation is of course money. That’s what people want, is
they want to earn money via these hacks.
Joshua
Hammer: When
we talk about money, we’re talking about SEO hacks and these are
hackers that go out there and they will push up SEO rankings of
sites, but they do it in an illegal manner by hacking other sites and
putting links to the site over to this site. We call it black hat
SEO. You’ll see a bunch of blog posts about it, but it’s really
basically search engine optimization hacking. You’re hacking other
sites to help boost an individual site. You’ve got data theft, of
course. Everybody talks about data theft. Things such as email
addresses can sell for big money on the black market because
companies use these email addresses to spam out there and get the
information, usernames, passwords, all that kind of stuff. It’s sold,
so it’s all money in the bank.
Joshua
Hammer: Credit
card scraping, big one coming up here with the holidays in December.
In November, credit card scraping becomes very popular. They pull the
credit card information, email it to a dummy email account, and pull
that information from that email account, and sell those credit card
numbers out there. Another thing that we’ve seen done with credit
card scraping is they’ll hide the credit card information right in an
image. I thought that one was amazing. If you looked at the code on
the image on the website, it had all the credit card numbers right
there on the image. Anybody could grab it if they just knew to look
at the code behind the image, but credit card scraping will make
money. So that’s another reason to hack.
Joshua
Hammer: Redirect
links perhaps sending you to a different website, so you get a
referral bonus for sending so many people to this website. Well,
rather than actually building a page that refers people over to this
website, why not just hack a site and anybody who comes to that site
gets referred over? I remember once in chat, I came across a redirect
link issue. A person who did children parties and he was a clown, his
site was redirecting to porn, so not a great thing for them. Hurt his
reputation, but in the end the hacker makes money off of it.
Joshua
Hammer: Advertising
spam, wonderful popups. We all love the popups that come up every
once in a while when we’re cruising the net and you come to an
infected site and you get like 300 different advertising popups, it
starts yelling at you. Really a popular hack. And cryptocurrency
mining, and what I mean by that is Bitcoin and those other kind of
things. Recently, it’s become harder to mine for cryptocurrency.
Companies are actually not making money. The cost of the electricity
and the machines and everything costs more than what you find with
cryptocurrency. Well, I can cut that cost. If I started to start
using your hosting server and your, basically, processing power to
mine the currency, then I’m not paying those costs. Instead, I’m
getting it for free, so I can mine that currency and make some money.
Joshua
Hammer: Really,
most of these attacks though are completely automated, right, because
for me to sit here and to hack a site, it’s going to take me a lot of
time. And let’s face it, to hack one site, it’s going to take a lot
of time. I may be able to do it, I may not, it depends. For me to
write a script that goes out to the internet and scans thousands upon
thousands upon thousands of sites and goes, okay, these 300 sites are
out of date and they all have the same vulnerability, that’s going to
take me a few minutes. Right? So now I’ve got thousands of sites with
a vulnerability and a lot of these sites, to be honest, the
vulnerability are known issues and there’s already programs that we
can download that infect those known issues.
Joshua
Hammer: So
then the hacker doesn’t even have to know what they’re doing. They
just execute a program and in the program they give them a list of
all these sites that have the known issues and the program starts
infecting the sites for them. So now they’ve got all these sites, it
makes it real easy, and that’s why automated is the big thing. So why
me? Why do you pick me out of everybody? Well, it’s not targeted.
It’s that random effect. It just so happens that you were the weakest
link, you were the low hanging fruit, and congratulations, you got
hacked. I want to say Google blocklists something like 18,000 sites
or something like that a day. It’s an an unreal number of sites that
they blocklist and there are only blocklisting a percentage of the
sites that have malware out there and it’s a low percentage of what
they’re actually blocklisting.
Joshua
Hammer: So
the number of sites that get hacked a day is astronomical. It’s
unreal. And so, basically if you were hacked, it was because you were
low hanging fruit. Chances are you didn’t really make somebody mad,
you just got lucky and one of those programs they wrote, you got
scanned and it pulled, which is fantastic, right? That’s all what we
want to hear. I was lucky, I won the lottery. Yes. But unfortunately,
it wasn’t a good lottery. It was a lottery of being hacked.
Joshua
Hammer: So
what can we do to prevent this? Make it harder for them. There was a
post that Tony did a long time ago and, we probably should redo this
post, but he talks about the difference between security and ease of
use. And he says that the two definitely don’t go hand-in-hand. If
you talk to me about two factor authentication, I use it on
everything. I hate two factor authentication with a passion because I
hate having to have my phone wherever I go. But it’s a level of
security that makes it a little bit harder for me to use. So you’ve
got to find that balance of what are you willing to do versus what
will secure the site. And by making it just a little bit harder for
the, oh lovely. Making it a little bit harder for the end user can
make your site a whole bunch more secure.
Joshua
Hammer: So
with that, I know it was a short series, but I want to hear from you.
What kind of questions, comments, concerns, or wisecracks do you
have?
Speaker
2: Speaking
of wisecracks, you didn’t bring out your mask?
Joshua
Hammer: I
didn’t bring out my mask.
Speaker
2: Oh,
that’s okay. Okay. We have actually a few, let’s see here. Oh, in the
chat was the, that probably you kind of saw that come through, is
about bug bounty programs. [crosstalk 00:10:36]
Joshua
Hammer: Bug
bounty programs are fantastic. So yeah, those are the white hat
hackers basically finding the bugs out there. Many companies do bug
bounties and where you go in, you hack in, you find the bug, you
don’t do anything with it. You just find the opening and you give
that to the company and the company will pay for it. A lot of
companies do that. I know we used to do it. I don’t know if we still
are though, to be honest with you. It was a program that I think got
depreciated at some point. Doesn’t mean we won’t be back with new
iterations when we put up new changes to the firewall, but yeah,
HackerOne I think is the name of a website that offers a lot of bug
bounties.
Speaker
2: Okay,
cool. Good to know. The Ethical Hackers, huh?
Joshua
Hammer: Yes.
Speaker
2: We
also have Tomas, I believe it is, saying his website was copied a few
times and he received many back links from the copied website to his
original one. And is there an effective way to block scraping website
content and images?
Joshua
Hammer: So
that’s a hard one. We had somebody in chat not too long ago that was
talking about the same thing and you can put in blocks to prevent
people from right clicking and copying. Unfortunately, that doesn’t
prevent everything because developer tools, I can just hit f12 and
and I didn’t right click, but I can still copy all the code there,
which is great. Right? But the vast majority of the things that are
doing that are bots. So a good firewall that’s in place that blocks
those bots will prevent most of those kinds of issues. Of course, I’m
bias. I’m going to tell you that the Sucuri Firewall is one of the
best because, well, it is and because, well, I’m biased. But if
you’re not using ours, use another firewall that prevents bad bots
and you’ll see that that will be reduced drastically. Because for the
most part, just like many humans, hackers are lazy and if you make it
a little bit harder for them, they’re not going to waste their time
on you. They’re going to go and find somebody else that’s easier to
get to.
Speaker
2: Definitely
makes sense. Perfect. Let’s see. Love that, well, you opened up, you
said biased.
Joshua
Hammer: Yeah,
no, I’m definitely biased. I work here, but I’ll be honest, I do
competitor shopping in those kinds of things too and I still think
we’re the best.
Speaker
2: They
can do that. Do some competitive shopping and see.
Joshua
Hammer: Absolutely.
I noticed in chat, we’ve got another one from Raphael. Is there a way
to keep our websites away from those random attacks, scans, bots, et
cetera, blocked by agent Id? Absolutely. I’ll point to a firewall
again because the firewall is going to be your best bet, but really
make sure your sites are up-to-date. A large number of sites that get
attacked are ones that are out of date, and the reason that is, is
because each of those updates are security updates, right? Well, when
they tell you, hey, this is what’s changing in the site, we’ve done a
security update to prevent this exploit, what they basically told the
world is, by the way, on this outdated version, there’s an exploit
and here’s the exploit and this is how you attack it, right?
Joshua
Hammer: So
if you don’t keep your stuff up-to-date, basically there’s a
dictionary of all these exploits that are out there that can now be
used or exploited. The main thing I’m going to tell you there is if
you have three sites under your hosting account, if any one of those
three sites is out of date, than all of your sites are at risk
because of cross-site contamination. You may have a site on there you
forgot about and it gets attacked. Well, now your good site that
you’ve been spending all of your time and money on, it’s just as
vulnerable because they’re already in the hosting environment.
Speaker
2: Do
you see Lawrence in there? Was that another one?
Joshua
Hammer: What
is the advantage of having a firewall on your website? Well, for one,
a firewall is going to be able to block a lot of the bots, so a lot
of the automated attacks are going to be denied just by having that
firewall. Another thing is it’s going to help prevent your site from
being hit because maybe you couldn’t update your site on day one,
you’ve got to test it and you’ve got plugins that may need to be
updated or changed with the new security update. A firewall, or at
least a good firewall, is going to prevent attacks from those known
exploits because it’ll virtually patch your site. So to the rest of
the world, your site will look up-to-date and when they go through
the firewall and they try to exploit one of those outdated things, it
won’t be able to do it because the firewall is going to block it for
you.
Speaker
2: Beautiful.
Warren, I think, hopefully we answered your questions because you had
a few. SEO hacking, you see that?
Joshua
Hammer: Yup.
Same thing. Keep your sites up-to-date and, well, put up a good
firewall. Those are going to be the the answers to most of how to
prevent that. Keep your site up-to-date, put up a good firewall,
reduce the number of plugins. If you want to get really security
conscience, start separating your sites. Functional isolation. So if
you’ve got a hosting account on that hosting account, you should have
one website, right? And then if you want a second website, you should
put them under. You can use the same company, just a different
hosting account, because now they’re their own buckets. So rather
than trying to secure an entire house, you’re securing one room and
that makes it a lot easier.
Speaker
2: I
also see, speaking of hosting, is it, what do you think on hosting?
Do they really protect you? Some people are asking that.
Joshua
Hammer: It
depends on the host, right? So there’s an old saying in sales,
nothing cheap is good and nothing good is cheap and you get what you
pay for, don’t you? So if you’re paying for $5.00 hosting, right? How
much security do you expect to get for five bucks? Probably not a
lot. If you’re paying 30 or $40 and they include security in there,
well, you’re probably going to get a lot more. But hosting is
designed to display your site, right? It’s designed to get your site
out there, show it to everybody. Don’t block anybody. Get it out
there. Security is the opposite, right? We’re trying to block the bad
actors from accessing the site. We’re blocking the bots, we’re
blocking the attackers. Hosting and security kind of go against each
other. Like I said, you’ve got to find that fine balance. Where do
you want to be? So with a security company, our main motivation is to
secure your site. Yeah. We want your site to be visible, but more
importantly, we want it to be secure.
Speaker
2: Yes,
you’re right, Warren.
Joshua
Hammer: SEO
hacking, user management, passwords. Yeah, password things are
fantastic. Definitely don’t use one, two, three, four, five, or
password, or all the others. I think, what, it’s love and God are
popular passwords too. Fantastic.
Speaker
2: Really?
Joshua
Hammer: I
personally use LastPass as a password manager. I love it. I’ll tell
you all, that if you’re using a password manager, they’re the best
things in the world, except for people who don’t use them, then they
hate you because you know, hey, would you log into your Netflix for
me? And you got to pull it up and you look at, oh, my password is, a,
ampersand, two, three, one, five, w, one and they’re going, what the
heck is all that? Well, it’s LastPass, so thanks.
Speaker
2: I
love making them all complicated. I used to make it super easy before
I worked here. It was like one, whatever the name was, two. Not now.
Joshua
Hammer: Now
you feel like slapping your old self, don’t you?
Speaker
2: Okay.
Joshua
Hammer: How
much cost debt is stolen from a website like names, addresses, ID,
emails, credit cards? Well, that’s really variable. It’ll cost you
more in reputation than actual money. I was talking about this
earlier today. We had, if anybody remembers, in 2017 the credit
bureaus in the US were hacked, Equifax. They were just fined $700
million for that hack. So that’s a lot of money. Right? Well, guess
what? That comes down to about $4 per person of data that was stolen.
So that’s not a lot of money, but what it does hurt is the
reputation. Now the credit bureaus, nobody has a choice but to use
them, so it’s not going to hurt them in the long run. But for your
site, you’re probably selling a good or a product that other people
are selling as well. And that reputation can do a lot of damage.
Joshua
Hammer: Love
LastPass. I do love LastPass.
Speaker
2: You’re
catching up, yeah. So let’s see. Okay. Yeah. The comments of how much
it really is costing on-
Joshua
Hammer: As
their compliance with making a secure website? Well, there’s PCI
compliance, which is the credit card industry compliance. But no,
there’s no standard that says this is a secure site, this isn’t a
secure site. That would be fantastic. Right? They’re moving towards
more of a compliance with the GDPR, but even that is not per se a
security compliance, just a data compliance set of how the data is
stored.
Speaker
2: Okay.
Thinking, did we get everything in chat? I saw a little bit on the,
it was pretty similar though, I think of a question. So, I think we
got everything. It was mentioned before, everything is fair game and
that kind of thing. How you-
)
