"Why Me?" – How and Why Hackers Choose Their Targets
“Why would a hacker target my site?” It’s probably the most common question we hear from customers when we’re discussing website security with them. The simplest answer is also the most accurate: Because they can.
When a website is hacked, it isn’t always to steal information. Often it’s to steal traffic, embed links, or just to brag ‘I hacked your site.’ We’ve seen all of these happen to sites we host. The bottom line is that the hacker, or team of hackers, isn’t necessarily targeting YOUR website specifically, it’s more likely they’ve written some scripts and launched them out into the world wide web. These scripts look for known holes or vulnerabilities in websites and then use those vulnerabilities to inject code and other scripts.
Sometimes these scripts add links to sites peddling porn, Viagra, real estate, or mortgages. You may not even be able to see the links on your site, but they’re there, lurking in the background or just outside the real estate of your monitor. Sometimes the script does a complete redirect of your site, so that when someone types in ‘www.yourwebsite.com’ they see your site for a split second and are then redirected to a different site that has nothing to do with you, your business, or your site. We’ve also seen a hacking where the site would load as it should only to be covered over with a new image and links that aren’t relevant to the site or its message and often it just says something like, ‘this site was hacked by the xyz security team.’ They’re such polite hackers—leaving a note to let you know who wrecked your website.
Another way hackers attack your site is by injecting code that attacks the computers of your website’s visitors. This is known as malware, and like some of the other types of hacking, it may not be visible to you. However, Google usually finds it and then blocks your site from loading with a message that says your site has been compromised and warns visitors to leave the site. Not really a positive message to send your potential customers.
None of these types of hacks are the things that come to mind for our customers when we discuss web security. They tend to think first of hacks that center around stealing identities, passwords, and other important credentials. Those are just a small part of the war hackers have waged on the general public.
Unfortunately hacking is here to stay, and much like e-mail spam, it costs far more in lost time than the perpetrator earns in dollars for their accomplishment. No website is un-hackable and no server is ever completely secure. You have to be diligent about updates and patches for the software and be sure your site is hosted on a server that keeps their software up to date as well. At Red Sage, we do the best we can to keep the sites safe and recover them as quickly as possible if they become compromised.