Common Threats to Home Users and How to Defend Against Them

Cybercriminals have been trying to steal user accounts and information for years, and they're still at it to this day.

What kinds of accounts are targets for thieves? The primary targets of hackers are financial accounts (banks, financial services, etc.), social media sites, or email accounts. These are popular targets because they're easy to monetize:  bank accounts can be drained, and credit cards can be used for fraudulent charges. These are staples of cybercrime, and will continue to be so in the future.

With that said, people shouldn’t think that thieves will only be after their financial, social media, or shopping accounts. Any account for a service is at risk of theft if the service is large enough. For example, accounts to streaming sites, which are also easily monetized, are now the targets of phishing attacks as well.

Our earlier discussion on information theft gives more examples of information that can be stolen, and what users can do to prevent their information from being stolen in the first place.

Data Breaches

More and more of our personal information are being stored by companies and organizations that we deal with day to day. These groups need your data to go about their business, to make transactions safer, more convenient, or for other purposes. Unfortunately, they sometimes fail to secure this data, and your personal information ends up online.

Data breaches occur because organizations did not handle the data they possess correctly. The causes may vary – sometimes an attacker makes inroads into an organization’s network despite their best efforts. Other times, the target turns out to have been downright neglectful of security best practices and effectively left their data out in the open for attackers to steal.

In either case, there isn't a lot that ordinary users can do if their data is stolen or exposed. The severity of the damage depends on the type of data that gets stolen—payment information could be used to siphon funds, while personally identifiable information could be used for identity theft or harassment.

In many cases the end user is “made whole” and doesn’t actually have to pay the full costs of a data breach—fraudulent transactions are reversed, and credit monitoring services are provided for free for a time. However, this doesn’t completely make up for the stress, inconvenience, and worry imposed on users because a trusted party turned out to be unworthy of that trust.

Our Data Breaches 101 guide provides an overview of data breaches, and tips on what users can do if they become a victim of one.

Malicious Ads

Advertising powers the modern Internet, but it is a very mixed bag in terms of security. Users have two big concerns when it comes to advertising: privacy and malware.

Advertising on websites provides a significant amount of information about the user to the advertising networks, which is used to track and provide customized ads to the users. Privacy-conscious users may find this objectionable, as they may not want their site visits being tracked across multiple sites. Some users may also find the ads themselves visually obnoxious, as well as a significant performance and bandwidth burden.

Online advertisements have also been used to spread malware. Malvertising, as this attack is sometimes known, uses ad traffic to redirect the users to malicious sites that download malware (particularly ransomware) without their knowledge. This is particularly a problem if users have not kept their software updated, as this leaves them at the risk of various vulnerabilities.

We have frequently talked about the problems with malvertising. Keeping your OS and software updated to patch possible vulnerabilities, and consider the use of ad blockers to reduce the risks posed by malvertising.

Remote Access Tools

Remote access tools (RATs) may frequently be thought of as tools used to attack enterprises and larger organizations, but that isn’t always the case.

The quality of RATs available to cybercriminals varies considerably. While attacks aimed at enterprise may use custom tools, there are plenty of off-the-shelf RATs available in various hacking communities of differing levels of quality. This means that RATs are available to all sorts of threat actors. Surprisingly, for consumers, this means that they are just as likely to be attacked by relatively unskilled attackers. In at least some cases, the persons responsible might well be teenagers looking to settle a score.

How exactly are RATs used in these cases? The “attacker” would try to get his target to download a copy of the RAT via chat or social media. This allows them to take control of their victim’s PC. Here, they may to steal information from the victim. Some file types, such as photos and videos, are more likely to be targeted.

Why these file types? These file types are the most likely to include private or sensitive content. Exposing these sorts of secrets are viewed by teenagers as an effective way of attacking their perceived enemies, never mind if that would be illegal. Similarly, these attackers can also try to turn on the user’s webcam to try and capture private moments.

The use of RATs to try and access such sensitive information isn’t limited to teenagers having disputes. Sextortion is also a problem; here criminals use a similar tactic (social engineering to plant malware onto targeted PCs) to try and get money out of users. However, the fundamental problem is still there: attackers using RATs to try and acquire intimate details of the user, to either embarrass or extort money.