Exploring How Hackers Hide From Your Organisation

How Hackers Hide From Organisations

The various different types of hackers are continually finding new and more efficient ways to infiltrate systems, whether that’s buying a ready-made exploit on the dark web, innovating new security flaws, or using AI language models, such as ChatGPT, in phishing attacks. However, we also see hackers using the same methods time and again to break into systems that lack basic security. So, while cyber criminals do make use of sophisticated hacking techniques, they will first choose the path of least resistance.

For example, hackers will often brute-force weak passwords to gain unauthorised access to a system, or use passwords scraped from previous data breaches. Quite often, and here’s a pro tip, the weakest part of your business’ security isn’t your tech, it’s your people. That’s just one of the reasons that security training is an overlooked superweapon in your defences.

Because hackers first look for an easy way in, it's up to organisations to cover the security basics. What this means is that for much of the time, hackers don’t need to go to great lengths to hide themselves because your business is in no state to detect or track them. In fact, if you’re not doing the basics, there’s a good chance you won’t even know you’ve been breached. It often surprises people when I tell them that sometimes hackers are in and out with no real need to confuse themselves at all. And whilst I’m here, you should be regularly looking for (and ideally, fixing) the holes that hackers will use to get in. I’m of course talking about UK penetration testing services.

There are several baseline measures businesses can put into place, such as making sure software is up to date, using strong unique passwords, and being aware of common threats such as phishing emails. A good tip here is to make compliance work for you. A good one for the basics is Cyber Essentials. Not only does it make you do the security basics, stopping a lot of opportunistic attacks, but it’s also a business enabler. As well as showcasing your commitment to security to potential customers, Cyber Essentials Plus certification is also a pre-requisite for a lot of UK Government and public-sector contracts. That’s an easy win-win.

Hackers are always getting smarter, and a recent trend is using off-the-shelf software instead of custom-crafted components. Bespoke software made by hackers leaves behind a digital fingerprint that can identify perpetrators, and as cyber criminals have started to be challenged by digital forensics, they have stopped using custom-built technology. Instead, they increasingly opt for open-source tools. These tools make it harder for criminal investigators to trace an attack because they are openly available and, in many cases, they are written by multiple contributors.

For example, Metasploit was initially built for use by ethical hackers to probe network and server vulnerabilities through pen testing. However, thanks to Metaspolit’s adaptability and open-source nature, this tool has now been adopted by malicious hackers as well. Anyone can download open-source hacking tools and use them to identify and exploit weaknesses in a target’s system.

A while ago our Co-founder Oli Pinson-Roxburgh did a whole webinar about how uncovering how hackers operate and hide. This video goes into a bit more detail than this blog and includes a great walkthrough of an attack in-action.

Once hackers have gained access to a system they can sit for months or sometimes even years within the network using a stealth approach to avoid detection from scanning and monitoring software. For example, hackers will analyse and mimic authorised user behaviour, such as only probing the network during normal working hours. Hackers will also attempt to blend their activity with common network connections and protocols using domain name system ports to route fraudulent activity, disguised as seemingly harmless queries between public and private networks. In the case of business email compromise (BEC), this continuous access to a system can be very useful for exfiltrating data.

Malicious actors lurking within an organisation are already authorised users within your perimeter, making it easier for them to go rogue with sensitive information and credentials. Disgruntled employees, or those who have been bribed or blackmailed by hackers from outside the company, could be tempted to leak sensitive information for personal or financial gain. This is arguably one of the most insidious ways hackers hide. After all, where better to hide than in plain sight? Sometimes the hacker isn’t a teenager in a hoodie on the other side of the world, it’s not a nation-state threat actor in a bunker... it’s the person sitting next to you in the office.

The great game of cat-and-mouse that is cyber security means that tactics and techniques are always evolving on both sides. When one door is closed, another is found. Hackers are not unintelligent or lazy, and complacency will get your business breached. But that doesn’t mean there aren’t effective, cost-efficient measures your business can take to stay secure.

The bottom line is, when hackers need to hide, they can be really good at it. The more you do up-front, the more effective you can be at dealing with problems. It applies to many things in life, and cyber security is no exception. Proactivity always makes your life easier in the long run.