How Hackers Hack 101: The Use of Vulnerabilities & Exploits

By the year 2022, the cybersecurity market will reach $170.4 billion globally. But how do hackers hack despite all these security-related expenses occurred by companies? Let’s find out!

Hackers are getting innovative and sophisticated with their hacking techniques in this era. Even big corporations like Yahoo, Hilton, Equifax, British Airways, etc., became the victims of cyberattacks and data breach incidents. And numerous cyberattacks take place every minute on small businesses and individuals that don’t make headlines as well. But how do hackers hack? Or maybe an even more interesting question would be how do hackers hack when advanced security tools, firewalls, malware detectors, vulnerability scanners, and expert security professionals are so available and ready to defend in the industry?

How Do Hackers Hack?

There are two main components involved in hacking.

(1) Vulnerability: A weak area of the system. This can be a software bug, misconfiguration, flawed process, outdated algorithms, weak passwords, and even less vigilant stakeholders.

(2) Exploit: Exploit is a method by which the hacker breaks into the system from the vulnerable point. This method can be a tool, scanner, piece of malware, script, etc., or psychological manipulation like phishing, social engineering, and other types of scams.

Hackers are a lot like burglars: they break into places and steal stuff or just cause general mayhem. Burglars find the weak area in your home from where they can enter and use various tools and tactics to break into the home. In the same way, online hackers observe a company’s defenses, find a security vulnerability and use exploits (tools and technics) to hack the system.

What Is a Vulnerability?

As stated above, a vulnerability is a loophole in your website (or a system and people connected to your website) that hackers use as the “door” to gain access for their nefarious activities.

Examples of vulnerabilities:

• WordPress plugin has a code error that would allow a hacker to launch an SQL injection attack.
• The admin account has a weak password that a hacker can easily guess through social engineering.
• A site running on HTTP (Instead of HTTPS) would let a hacker intercept the communication between a website’s server and website visitors’ browser.
• An employee that wasn’t able to identify a phishing email and downloaded a malicious attachment from it. (Here, employee, the living asset, itself is a vulnerability)
• An employee is using an outdated Windows operating system, which is suffering from many software bugs.
• There isn’t any validation and sanitation available for input data on the contact form, allowing hackers to send malicious codes to your server via a SQL injection technique.

But how hackers hack using a vulnerability? That brings us to the next section, “exploits.”

What Is an Exploit?

After the hacker finds a vulnerability, they use an exploit to take advantage of the vulnerability. An exploit is a specific code snippet or procedure that executes an attack (which works because it’s “sneaking through” the vulnerability the hacker found).

For example, a hacker finds a website whose login fields don’t have a limited login attempt feature. i.e., vulnerability. Now, they use tools like THC-Hydra, John the Ripper, or DaveGrohl to execute a brute force attack on that login fields. Here, the above-mentioned password cracking tools are called exploits.

Hacking Works Like a Burglary

To make the concept of how hackers hack easier to understand, let’s use an example to show how this process is similar to a home burglary. Remember, a vulnerability is a weakness, and exploit is a procedure used to gain access through the vulnerability.

Hackers follow those same basic steps to attack a website:

• Find a vulnerability.
• Create an exploit.
• Get into the system and do whatever they want (send spam emails, steal data, etc.)

Now, you might be thinking…that sounds like a lot of work to hack. But it isn’t. Hackers have a weapon that makes hacking very efficient at scale: Automation.

How Hackers Hack Using Automated Tools

Instead of spending days or months carefully planning and executing a single attack with a huge payday, hackers use automated tools to scan and attack hundreds or thousands of websites and try to gain a small reward from each site they compromise. It’s a numbers game.

Here’s how it works:

• Mallory, the hacker, got information that a WordPress plugin named BobForms, version 2.01, has a security vulnerability, allowing hackers to insert malicious code into the website.
• BobForm’s development team has already fixed the vulnerability and published the 2.02 version of their plugin. But thousands of websites haven’t installed the updated version yet.
• Mallory develops a piece of code snippet to insert on the website for hacking it.
• Now, Mallory gets a list of thousands or even millions of domain names.
• She creates an automated web crawler that visits each website and performs a series of steps on each one:

• Check if the website uses WordPress. If so…
• Check if the website uses the BobForms plugin, version 2.01. If so…
• Execute predefined exploit code to gain access to the website’s database and hack it.
• Save access details into a database so Mallory can easily access the website for more nefarious activities later.

A hacker could scan 1000s of websites per hour with just a basic personal computer, potentially hacking 100s or even 1000s of websites per day.

Case Study: MageCart

Magecart malware skims credit cards from thousands of online stores. MageCart has been one of the most prolific and dangerous online security threats for the ecommerce industry since 2015. There are at least seven different cybercriminal groups running these attacks, but the attacks generally follow the same steps and pattern:

1. MageCart runs automated scanners to identify websites with known vulnerabilities. Many (but not all) of the targeted sites run Magento ecommerce software.
2. Once a vulnerable website is identified, the exploit is executed to hack the website (manually or via an automated tool), and a JavaScript snippet is added, either site-wide or on the checkout pages.
3. The JavaScript snippet has simple logic to identify if credit card data is entered into a form. If card data is entered, the data is copied and sent to a server run by the hacker group.
4. Once the hacker group has the credit card data, they’ll either sell it on the dark web or use it to purchase goods they can resell without getting caught.

Wrapping up How Hackers Hack

According to a survey done by Accenture, 68% of business leaders believe that the cyber threats against their businesses have sharply increased. But when you observe how hackers hack via similar patterns in most of the incidents we covered here, there are some real lessons you can learn from them. The very basic things you can do is:

• Identify the vulnerabilities as early as possible and patch them before a hacker finds them.
• Keep all the third-party applications and software updated with their latest versions.
• And provide sufficient training to your staff so that they don’t become a vulnerability in your defense mechanism.