Online privacy threats have become much more diverse and sophisticated than they were 10 or even 5 years ago and cybercriminals are getting more and more innovative when it comes to ways to steal your sensitive data.
For this reason, it’s important to know what threats to online privacy and digital security are out there so you know how to best protect your data.
Here are more than 20 such threats:
Social Engineering Privacy Threats and Digital Security Risks
When it comes to online privacy threats, most people focus their attention on things like viruses and different types of hacking attacks. In reality, cybercriminals steal much more data onlin without any sophisticated code and just using social engineering attacks.
What are these?
A social engineering attack is any attack that aims to manipulate and exploit the victim into sharing their sensitive information or giving them money.
Recognising social engineering attacks isn’t always easy, here are over 20 common privacy threats that you need to know about:
Email Phishing
Email phishing is the most common and best known type of online threats. Here, the malicious actor sends an email impersonating a legitimate company in order to steal the victim’s Personally Identifiable Information (PII), financial information, online account credentials or some other type of sensitive information.
“Phishing” is actually an umbrella term that includes email phishing, spear phishing, smishing, vishing and whaling. The difference is mostly in what medium the cybercriminals are using (email, SMS, voice, etc,). We’ll cover other types of phishing here as well.
Go ahead and read this article to learn more about phishing.
Also, be sure that you’re looking at the legitimate email address of the business. For example, Mailfence uses only these email addresses.
Spear Phishing
Spear phishing is actually a more sophisticated type of email phishing.
Unlike regular email phishing, where the cybercriminal sends bulk email to hundreds of potential victims in hopes to catch at least one, spear phishing uses accurate information about the particular victim that was gathered beforehand.
This type of phishing attack is typically used in combo with some other type of social engineering attack listed below.
If you’d like to know more about spear phishing and how it works, read the linked article.
Smishing
Phishing does not need to go through email like in our first two privacy threats examples.
One type of phishing that uses text messages (SMS) is called “smishing” (SMS phishing).
Of course, the idea here is the same. The attacker sends an SMS pretending to be a legitimate company or someone you might know in order to steal your sensitive information or have you send them money.
Here’s how to recognize smishing and protect yourself from it.
Vishing
Vishing is a portmanteau of the words “voice” and “phishing”. Unlike regular phishing, it uses voice technology and phone to scam victims into revealing their personal or financial information.
In vishing, you get a phone call (supposedly from a company that you might be a client of) in which the scammer tries to get you to share sensitive information.
Unfortunately, thanks to VoIP (Voice over Internet Protocol), vishing scammers can now place hundreds of calls at once.
Want to know more about vishing? Read this article.
Whaling
The types of phishing we’ve been talking about thus far mostly target “small fry”. This next type goes after the “big kahunas”.
Whaling is the next step after spear phishing, where the scammer typically impersonates a high-ranking individual to trick a manager or an executive into sending them money or employee’s sensitive information to a private account.
Here’s how to identify whaling attacks and keep your company safe.
Baiting
Curiosity killed the cat.
Or at least infected your work computer with malware.
Since we like both cats and our computers free of malware, let us introduce you to another type of online threat to online privacy and digital security – baiting.
Baiting attacks exploit the curiosity or greed of unsuspecting victims. For instance, a hacker may plant a USB stick loaded with malware in the lobby of a business (à la Wile E. Coyote leaving bird seeds on the road for the Road Runner).
If an employee then puts the USB into their work computer – perhaps because it had the logo of a rival company on it – it could install malware onto the company’s internal computer network.
So, be smart like the Road Runner and learn what is baiting.
Tailgating
Tailgating or piggybacking is a physical security breach in which an attacker gains entry into a restricted area by simply walking behind an employee with legitimate access.
Therefore, ‘Tailgating’ gives adversaries physical access to hardware. As a result, physical access can allow a hacker to pretty much do anything including stealing information, installing spying tools, or simply harming the equipment to make it dysfunctional.
So, be sure no one is following you and find out what is tailgating.
Quid Pro Quo
Quid pro quo, or “give and take” is a social engineering attack in which the scammer promises the potential victim something in exchange for information.
The idea behind this is that people obey the law of reciprocity (“I did you a favor so you owe me”).
Of course, when it comes to this type of social engineering attack, the scammer always gets much more than the victim, so be careful when someone offers you this type of deal online and learn what are quid pro quo attacks.
Pretexting
Pretexting is a form of social engineering where attackers focus on creating a good pretext, or a fabricated scenario, that they can use to try and steal their victims’ personal information.
These types of attacks commonly take the form of scammers pretending that they need certain bits of information from their target in order to confirm their identity.
Once they get this information, scammers can initiate their attack either by stealing the victims’ identity or by performing other malicious operations.
Read this article to learn what is pretexting and how to protect against it.
Pharming
Pharming refers to pointing the user to a malicious and illegitimate website by redirecting the legitimate URL to it.
Basically, you can enter a correct URL, but by using different exploits and backdoors (see more about them above), a malicious actor can affect the DNS and send you to a fake website instead of the real one.
Homograph or Homoglyph Attacks
Homograph or homoglyph attacks are cyberattacks in which the threat actor uses an URL or an email address that looks almost identical to the real one.
By utilising similar character scripts, called “homographs” like “bat” (animal) or “bat” (baseball), or “homoglyphs”, for instance, the digit 0 and the capital letter O, lowercase L (l) and I, the scammer can create spoof domains or email addresses to trick users into accessing them.
Spam
Spam is the mass distribution of unsolicited (bulk) messages to a large number of users. These messages are usually distributed through email, but can also be done through instant messages, forums, newsgroups, text messages, social networks, blogs, websites, etc.
Although spam is in itself harmless, they can often be a precusor to more serious online threats, so it’s best to ignore and delete them right away.
Doxing
In a doxing attack, hackers publicly release personal information about the victim, usually in order to defame them online, take revenge, blackmail, etc. In fact, in 2013, several celebrities and politicians were victims of a doxxing attack.
The process simply includes gathering information both from public and private online sources – which could include compromising victims online accounts, and other online spaces.
Email Spoofing
Email spoofing is a cyberattack much similar to phishing because the scammer also hides behind a fake email address in order to fool potential victims.
However, it works a little differently than regular phishing.
Most commonly, email spoofing is done via display name (using a Gmail or other popular free email service), lookalike domain (business.com vs bvsiness.com, much like homograph/homogplyph attacks) or a legitimate domain (by exploiting SMTP’s inability to authenticate the sender’s email address).
We cover email spoofing in more detail in this article, so go ahead and read it.
Scareware
Scareware is another social engineering technique in which the attacker scares the victim into believing they have a virus on their device and need to buy or download the malicious software disguised as an anti-virus or anti malware program.
Our post on what is scareware can help you learn how not to fall prey to this social engineering tactic.
Malware Threats to Online Privacy and Digital Security
Malware refers to any type of malicious software that can infect your device. This can be a virus, worm, Trojan horse, spyware, adware, ransomware, etc.
Of course, not all malware is the same or has the same goals. Some malware can be used to steal sensitive data, others to take control of your device, perform crypto-mining, others to delete or change your files, monitor your online activities and so on.
Want to learn how to protect against malware? Start with these three articles:
- 10 simple tips to protect your computer and other devices from hackers
- Steps to take when your email is hacked
- How to protect your privacy online with our 6 tips
Now let’s take a look at some of the more common malware types.
Spyware
Spyware is a form of malware that the victim typically installs unknowingly as a part of a “freeware” or “free software”. This malware then gathers data about you and monitors your activities and forwards that information to a 3rd party, like a cybercriminal.
Adware
Adware is similar to spyware in that it also comes bundled with freeware. However, whereas spyware usually works in the background to avoid your detection, adware is very much “in-your-face” type of malware.
You’ve probably seen ads popping up on your laptop’s or smartphone’s browser, usually for things like virus removal or storage cleaners or to download a free software but you don’t remember ever visiting these sites, let alone interacting with them.
Well, these are adware and they are what the name suggests – unwanted software that throws ads on your screen.
Worms
Worms are malware computer programs that have the ability to replicate themselves. Their sole objective is to increase their population and transfer themselves to another computer via the internet or through storage media.
Typically, worms are not harmful to your computer but may introduce spyware or ransomware, overload the network, consume bandwith, open a backdoor and steal or delete data.
Trojan Horses
Trojan horse is a malicious software that either disguises as a legitimate program, or embeds itself in one. Once the victim executes it, the Trojan can alter or delete their data, use their device as a proxy to attack other computers, spy on and so on.
Ransomware
Ransomware is a cyberattack in which hackers encrypt or lock victims’ data until they pay a ransom. There are two types of ransomware that are currently affecting systems around the globe: crypto-ransomware and locker ransomware.
The first type of these, crypto-ransomware, encrypts the victim’s system files and only provides the decryption key if they pay the ransom.
Locker ransomware is similar, but even more dangerous in that the criminals now completely lock the user out of their device (not just the file) until they pay the ransom.
Unfortunately, even if you do pay the ransom, there is little guarantee that you will get access to your files or computer back or that the attacker hasn’t left some other malware, like a spyware or a keylogger on your device, so here are the top 5 ways to protect against ransomware.
Exploits
An exploit is a piece of software, a command, or a code that attacks a particular security vulnerability. What’s different about them compared to other threats to online privacy and digital security here is that exploits are not always created with malicious intent.
Very often exploits are used by threat intelligence and security researchers to discover potential security flaws in the system and are as such useful in preventing actual cyber attacks.
Backdoors
Backdoors, like their name says, are a way of bypassing the regular authentication mechanism in order to access the system.
While backdoors can be introduced into the system via a virus or a worm by cyberattackers, much more often the original programmer. places them there.
This can have practical uses, for instance, restoring access if you forget the password and get locked out of the device. However, encryption backdoors can also allow the government to bypass security measures and gain access to citizen’s data without their consent.
Of course, most privacy and cybersecurity experts are against backdoors and for a good reason. Here’s why encryption backdoors don’t work.
Zombies and Botnets
Is your device running much slower than usual or behaving differently (random error messages popping up, browser closing for no reason, etc.)?
Your computer might have become a zombie.
No, we don’t mean that someone ate your computer’s brain (that would be it’s CPU), but that it was infected with malware that turned it into a zombie or a bot computer and is now used as part of a brainless botnet army alongside other zombie computers to spread spam, malware or even launch DDoS attacks.
If you don’t want your computer to become a mindless walking dead (and don’t want to shoot it in the head), read what is a zombie computer and how to prevent it.
Distributed Denial-of-Service (DDoS) Attack
A distributed denial-of-service (DDoS attack) is a cyberattack that aims to overwhelm or flood the server or a website with connection requests and render it temporarily unavailable for service by regular visitors.
Typically, a DDoS attack is done by using botnets, which allows the actual culprit to stay undecteted behind them.
DDoS attacks are today more and more common and legitimate businesses or even government websites are often a target of such attacks. Mailfence even suffered a series of DDoS attacks in 2021.
Wi-Fi Eavesdropping
Another way a threat actor can steal your sensitive data is if you are using an unencrypted WiFi network. For example, you might be using the airport’s free WiFi that doesn’t require a password and in doing so leave your device vulnerable to man-in-the-middle (MitM) attacks which allows the one listening to steal your sensitive information or monitor the conversation.
This is why it’s important to always protect your devices when traveling.
Keylogger
A keylogger is any piece of software or hardware that has the capability to intercept and record input from the keyboard of a compromised machine without the user’s knowledge. The stolen information is then gets sent to a remote, C&C’s (command and control center) which then further sells this sensitive data to cybercriminals!
Here’s where you can learn more about keyloggers, and how to protect your device.
Password Brute-Forcing
Brute-forcing is a crude trial-and-error method used to obtain user’s password or PIN. Usually, it involves an automated software that is capable of generating a large number of consecutive guesses until they get the right password.
Here are 11 password best practices to keep your accounts secure.
Advanced Persistent Threats (APTs)
Advanced Persistent Threats or APTs can best be described as campaigns rather than a single cyberattack, in which intruders establish a long-term foothold on the network and steal sensitive data over time.
This data can include intellectual property, trade secrets, employee or costumer information and so on and is usually done by experienced and well-funded cybercriminal groups, which can often be funded by governments or industry rivals.
For this reason it’s a good idea to know how to protect your small business from hackers.
Conclusion
Keep an eye on these 20+ online privacy threats at all times to keep your sensitive data and devices secure from malicious actors! This is what Mailfence is about: privacy and security.
Useful Resources
Need more help in protecting your online accounts, devices and data against privacy threats?
Read our email security and privacy course and check out these articles as well:
- Tips to backup your data securely
- User data security, privacy and anonymity
- 12 tips on how to protect your data
And, of course, don’t forget to follow us on twitter/reddit and keep yourself posted at all times.
