Don't let your eyes deceive you: How you can be hacked in one click.
As more security measures are put into place to stop hackers, and as IT departments provide more training to eliminate infiltrations, hackers are tapping into one specific effect of modern technology: Speed.
You search for something on the web; if what you're looking for doesn't come up in the first couple of links, you change your search.
You send a text; if you don't get a reply in a couple of minutes, you wonder why.
Technology has compressed what used to take hours or weeks into mere seconds and minutes.
This is why most people tend to scan emails very quickly. If they feel a message came from someone they know, they will instinctively click the link, download the attachment, or call the number provided.
Hackers are tapping into this need for speed to trick users. In less than one second, they can steal all your information without you even knowing.
Don't let your eyes deceive you
For example, hackers know that IT departments train you to look at email addresses to ensure they come from a trusted source:
Trust this: bob@life.com (because you work at life.com).
Don't trust this: bob45@yahoo.com
But what about this? Can you spot the difference?
bob@life.com
bob@Iife.com
One is a valid email from Bob; the other is a malicious email impersonating Bob. The hacker used a capital "I" to make it look like a lowercase "L". If we made everything lowercase, you could easily spot the difference:
bob@life.com
bob@iife.com
Because of how fast things move, the hacker is counting on you not noticing. In fact, you might not even be able to tell the difference initially, even if you looked very closely.
Fake Bob + AI + Social Media
You receive the hacker's email thinking it’s from Bob since the address looks legitimate. "Bob" starts by saying he hopes you had a great time on your vacation last week. How does this fake Bob know about that? Your social media posts. The hacker used AI to scan your social media and generate an email that appears to be from someone who actually knows you.
Then fake Bob writes: "I thought you might like this photo I took of a similar place: https://tinyurl.com/yckdt862"
You trust the email and you trust that this is Bob because he talked about your vacation. Now, you trust the link he sent you. You click it, and it downloads what looks like a JPG. You double-click it to open it, and in less than one second, you have been hacked.
One second, that's all it took.
You know how when you log into sites, you have the option to check "Remember Me"? Or when you log into a business email account like Microsoft 365 or Google Mail, you can keep checking your email in your browser without needing to log back in for a while?
This happens because when you log in, a special "session token" is added to your browser. The next time you visit the site, it looks for that token, and if it hasn't expired, it automatically logs you in. Convenient, right?
The only issue is that convenience and security rarely go hand in hand.
Hackers know this. When you clicked on fake Bob's link, it loaded a file that executed a script to steal all of those tokens and send them back to the hacker. Now, the hacker can simply add those tokens to their own computer, and voila, they are in. There is no need for them to know your password, and no need to bypass dual-factor authentication. The worst part is, you won't even know it happened.
Simple rules to stay safe
So, what can you do? Here are a few rules to help keep you safe:
Never trust your eyes. The email looks legitimate, but is it really?
Stop before you click. If you get an unexpected email from someone you know asking you to download or click something, pause.
Verify the source. If you want to make sure it's legitimate, start a brand-new email chain, or better yet, call the person and ask: "I just got this from you, is it legitimate?"
Do NOT blindly download attachments. Do not double-click them unless you are 100% sure they are safe. When in doubt, don't do it. Pick up the phone and call first.
In Conclusion
Don't let your eyes deceive you. The only person who can truly protect you from being hacked is you. IT departments can add rules, software, and training to minimize the chances of an infiltration, but only you can actually stop it from happening.
In the IT world, there is a concept known as a "Zero-Trust" policy when it comes to user access; you only give people the bare minimum access needed to do their job.
You should adopt that same Zero-Trust policy when it comes to your inbox, even for emails that look like they came from people you know.
Did You Know?
Even people who deal with technology on a daily basis can fall for this type of hack.
Here are two excellent videos by the PC Security Channel that break down exactly how this type of hack works, using the Linus Tech Tips security breach as a real-world example.
If it can happen to them, it can happen to you.