Who hunts you and why
Lesson 2 of 16 in the course “Cybersecurity from Scratch”. Free, with animations and a quiz.
You’re not attacked personally, but in bulk
An ordinary person is rarely picked on purpose. It works like a net: databases of passwords stolen from sites hacked long ago, bots that try those email+password pairs on hundreds of other services, millions of phishing texts, and malware hidden inside cracked games and programs. Whoever has a hole gets caught.
Three doors
Almost every hack of an ordinary person comes through one of three doors. The account: the password was guessed, taken from a leak, or the SMS code was intercepted. The device: it has malware, it was stolen or it has no lock. And you: someone talked you into reading out a code, installing a program or signing a transfer. At Binance, judging by the first account, it was door two: an infected laptop. The course closes all three in turn.
What they want from you
Money is the obvious one: bank, card, crypto. But your Instagram or Telegram is worth money too: in your name they message friends “urgent, can you send me some till tomorrow”, and friends believe it. ID photos and selfies are used to take out loans and for blackmail. And your laptop itself can be quietly used to send spam and attack others. So “I have nothing to steal” doesn’t hold: everyone has something.
Three keys to everything
Three things unlock everything else. Your email: it resets passwords almost everywhere. Your phone number: it receives codes and the calls “from the bank”. Your main device: it stores your logins, passwords and wallets. Lose one of the three and you’re effectively hacked as a whole. So we build protection in this order: these three first, then the rest.
Three myths that get people caught
“I have nothing to steal”: covered, your accounts and data are worth money. “I have an iPhone, no viruses”: phishing needs no virus, you type the password into a fake page yourself. “I’d spot a scam instantly”: good schemes look like a normal message from your bank and push urgency so you don’t have time to think. Overconfidence is a hole too.
Dan’s holes, in order
Let’s look at Dan the way an attacker would. Hole one: email with no 2FA; take it, and you can reset the exchange password. Hole two: one password on nine sites; a leak from any of them opens all. Hole three: the exchange protected only by SMS. Hole four: pirated software on the laptop where the exchange is open. We’ll fix them in exactly this order. In the trainer, sort Dan’s threats into the three doors.
Check yourself
- Dan thinks: “Nobody cares about me, I won’t get hacked.” What’s wrong with that?
Correct answer: Attacks are in bulk: bots and mass messages look for any hole, not for Dan in particular. Bots don’t care who you are: they cycle through leaked passwords and send phishing by the million. Anyone with a hole gets caught. - Which of the three “master keys” should Dan protect first?
Correct answer: His email: it resets the exchange password and everything else. Email is the key to the keys. Whoever owns it clicks “forgot password?” on the exchange and gets the link. - Dan’s friend writes on Telegram: “Urgent, send me $50, I’ll pay you back tomorrow”, though he never writes like that. Which door was most likely used?
Correct answer: The friend’s account was hacked and someone writes in his name. A classic hijacked account: urgency, a money request, an unusual tone. Check by calling him on a number you already know.
← How one laptop cost $6.3 billion Passwords nobody can guess →