5 Home Cyber Attacks That You May Not Be Aware Of

You may live somewhere far away from the physical borders of the United States but the moment you connect to the internet, your home and every device in your home move instantaneously to the absolute wild-west border town of our country’s cyber frontiers. No, this is NOT hyperbole. There is a reason cybercrime targeted against individuals and homes is a multi-billion dollar industry.

 

Before we look into the 5 types of cyberattacks that you may not be aware of, let us pause to understand the scale, impact and reasons for cybercrime. The FBI’s Internet Crime Complaint Center’s 2022 report identified that over $10.3 billion in losses were reported from over 800, 944 complaints. Now, keep in mind that a vast majority of cybercrime is NOT reported and not all cybercrime can be mapped to direct dollar value in losses. The cost of cybercrime is predicted to reach $8 trillion by 2023. Yes, no typo there – that is a trillion with a ‘t’! So, can we all agree that cybercrime is an illegal but very lucrative endeavor?

 

Ok, so there is definitely money to be made but how do we, as individuals, fit into the picture. Our money, our identity, our data, the devices we own, the apps we use (such as mobile apps as well as apps on devices such as televisions and smart speakers) and the websites we trust all form part of the reasons as well as the vectors of attack. We could also be targeted based on the employer we work for – for example, if a person works for a large corporate entity or for the military or for a military contractor, that person’s identity and the resources that they may have access to are of high value to malicious actors.  Large corporations have sophisticated security tools and protocols in place but our homes, despite having increasing networking, storage and compute power, have nowhere near the equivalent. In other words, from a hacker’s perspective, the amount of smart home vulnerabilities is large, continues to grow and more importantly is relatively weakly defended. The number of people using whole home Intelligent Digital Safety solutions is still relatively small and so as they say in the armed forces, this is a ‘target rich environment’! Awareness and alertness are key elements to ensure that we are not a part of that target rich environment and to lower our risk of security, data, identity theft, or device breaches.

 

We have all heard of the common attacks such as phishing, ransomware, viruses, malware, etc. But there are several more attack types that plagues each and every one of us across our apps, devices, websites and online services. Let us look at 5 ones that are definitely worthy of our attention.

1. Typosquatting Attacks: Many years back, I used to think it was funny to have an email signature on my phone emails that read: “Fat fingers, small keyboard”. That very problem that we all have where we mistyped words on keyboards is what is exploited in this type of attack. Typosquatting attacks, also known as URL hijacking or domain spoofing, are a form of cyberattack where malicious actors take advantage of typographical errors made by users when entering website addresses. These attackers register domain names that are similar to popular websites, capitalizing on common mistakes such as misspelled words, transposed letters, or substituted characters. The goal of typosquatting is to trick users into visiting the malicious website instead of the intended legitimate one. Once users land on the fake website, attackers may engage in various malicious activities, such as phishing, distributing malware, stealing sensitive information, or generating revenue through fraudulent advertisements all of which represent cybersecurity threats.

 

There have been several notable examples of typosquatting attacks. In 2022, a massive typosquatting attack campaign covering over 200 domains was discovered where attackers targeted Windows and Android users to impersonate Google Wallet, Paypal and Snapchat to install the ERMAC banking trojan (a type of malware) onto people’s devices. Another example is when malicious actors targeted popular news websites to redirect users to fake news sites that peddled completely false stories.

 

To mitigate the risks associated with typosquatting attacks, users should exercise caution when entering website addresses, double-check the spelling, and bookmark frequently visited sites. Employing security measures such as Intelligent Digital Safety Solutions that protect every device in the home with advanced threat intelligence, keeping software and browsers up to date, and being vigilant for signs of phishing can also help protect against such attacks. Overall, typo squatting attacks exploit human error and the ease of mistyping website addresses. By preying on users’ mistakes, cybercriminals can redirect traffic to fraudulent websites, putting individuals’ personal information and online security at risk.

 

1. Phlashing attacks: Ok, first, get your mind out of the gutter. We did not typo squat a difference concept (see what I did there?)! Phlashing attacks, also known as Permanent Denial-of-Service (PDoS) attacks, are a type of cyber attack that aim to render a device permanently inoperable by targeting its firmware or hardware. Unlike traditional Denial-of-Service (DoS) attacks that focus on disrupting services temporarily, phlashing attacks permanently disable the targeted device, making it unusable even after rebooting or reinstalling software. These attacks exploit vulnerabilities in the firmware or hardware of devices such as routers, laptops, smart phones, baby monitors, thermostats or other smart home devices. By overwriting or corrupting the device’s firmware, phlashers can irreversibly damage critical components, rendering the device non-functional. Real-world examples of phlashing attacks are relatively rare due to the complexity and severity of these attacks. However, one notable occurrence took place in 2008 when researchers discovered a vulnerability in Cisco routers that allowed attackers to overwrite their firmware, effectively bricking the devices. This incident, known as the “Cisco IOS Firmware Vulnerability,” affected numerous Cisco routers and highlighted the potential impact of phlashing attacks on critical networking infrastructure such as routers, which every internet connected home has. Another example was when in 2017, cybersecurity company Radware discovered the BrickerBot phlashing attack that targeted Internet of Things devices and wiping all of the storage on the device rendering the devices unusable. While phlashing attacks may not be as common as other forms of cyber attacks, their ability to cause permanent damage and render devices unusable underscores the importance of implementing robust security measures, such as regularly updating firmware, using trusted devices from reputable manufacturers, and promptly addressing vulnerabilities discovered by manufacturers through firmware updates.

 

1. Back Doors: A back door may be a vector of entry for a cyber threat but it could also be a type of cyber attack as well. Many device vendors include some hidden paths of entry either intentionally or as a result of a vulnerability in their technology. Hacker forums are full of information on specific device brands and the back doors that allow access into those devices. Back doors may also be a technique that attackers may use as part of a larger cyber attack. For example, an attacker may infect a device with malware such as a virus or trojan. But should that device be recovered and the malware removed, they may have used the malware code to open up a back door access that allows them another entry point back into the device. The back door might exploit a problem with the device’s hardware or software such as apps on it. Ingenious right? So, how do you protect yourself? First line of defense is to make sure that all patches and updates for the device as well as the apps on it are applied immediately after they are available. Second, make sure the apps are only from very trusted sources and that those sources push out constant and well communicated updates for those apps. Third, if a device is indeed infected and you remove the malware, make sure to monitor the traffic as well as all the open ports on it. Yes, this is a very technically challenging task and I would recommend that you enlist the help of a professional to scan for and close down open ports on the device that are not needed for its functioning.

 

1. Root Kits: Root kits are a type of cyber attack that are designed to strike at the very heart of a system or device – the operating system itself!! Rootkits are malicious software tools designed to gain unauthorized administrative-level access, or “root” access, to a computer system. They are designed to hide their presence and provide covert control to attackers. Rootkits operate by modifying the operating system’s functionality and concealing their existence from normal security measures. They can be used to monitor user activities, collect sensitive information, or create a backdoor for further exploitation and hence are a security threat of great potence. An example of rootkit attacks from the past include one that targeted Sony devices in 2005 (yes, these attacks have been around for a while!).  The most well-known of root kit attacks was the Stuxnut worm that made the news back in 2010. This was a worm that targeted industrial systems and not home devices but it really brought a spotlight on this kind of attack.

 

1. Drive-by-download attack: Drive-by-download attacks are a type of cyber attack where users’ devices are infected with malware simply by visiting a compromised website or clicking on a malicious link. These attacks exploit vulnerabilities in web browsers, plugins, or operating systems to automatically download and install malware without the user’s knowledge or consent. Attackers often use social engineering techniques to lure users to malicious websites through enticing content or deceptive advertisements. Examples of drive-by download attacks include the Angler Exploit Kit (2015), which targeted popular websites, and the Magnitude Exploit Kit (2016), which exploited vulnerabilities in Adobe Flash Player. To protect against this type of attack, please make sure your browser has the latest patches or updates and second, make sure the websites you visit are not suspicious. One good hygiene tip might be to check a website or link you get against a URL reputation checking site before actually visiting it.

 

There are several more types of cyber attacks that target homes and individuals but hopefully, this list of 5 cyber attacks piques your curiosity to read more about other types of attacks. But more importantly, I hope that this raises your levels of alertness about cyber threats that may target apps, devices, websites and online services that you use. The strongest and best line of defense is always common sense and human intelligence. Developing a muscle memory on cyber hygiene will go a long way towards better online safety.