11 essential hacking terms, defined

Savvy IT professionals know that their networks and security are under a constant barrage of cyberattacks.

As a business professional, you too can ensure that you are aware of major cybersecurity risks as they appear.

The challenge for many who don’t live in the world of cybersecurity, however, is that the security industry presumes that you already know the hacking terms discussed.

To help, we’ve assembled and updated this list of common hacking terms to keep you on the same page as the security professionals.

1. Malware

Malware, which is short for malicious software, is a generic term for any software that is designed to disrupt the operation of a computer with malicious intent. While many malware attacks are the result of stealthy attacks on the computer, others, such as the Lenovo SuperFish debacle, may simply be the result of vendors installing adware on computers that they ship to the public without being aware of potential issues.

For more about malware, read our article, “Advanced malware attacks: 3 ways to protect your business.”

2. Back door

A back-door attack is generally involves a piece of code intentionally left by the developer of the software or firmware that allows access without going through the normal security process. Back doors can also result from different malware or virus attacks that leave a way for remote, unsecured access into a device once the malicious code has been executed.

3. Denial of service (DoS)

Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks attempt to make network resources unavailable, usually by flooding the resource—often a website—with requests that can’t be properly serviced. A DDoS attack is usually accomplished by making use of a network of zombie computers, which are end-user systems that have been previously infected. A zombie computer may still function normally from the user’s perspective, while the DDoS attack occurs completely in the background.

Read more about how to protect yourself against DoS and DDoS cyberattacks.

4. Brute force attacks

There are three main types of brute force attacks: dictionary attacks, credential recycling, and reverse brute force attacks.

• A dictionary attack is maybe the most basic form that tries thousands, if not millions, of randomly generated passwords in an attempt to break password security. In a more sophisticated dictionary attack, the attacker will start with lists of probable passwords, removing randomness from the attack.

• Credential recycling is an attack that employs usernames and passwords captured from previous data breaches.

• Reverse brute force attacks take a common password, like “password”, and attempt to match a username to it. This is why password management is so important.

5. Logic bomb

A logic bomb is an attack that is triggered by a specific event. The infected computer or hacked code is waiting for a single event or combination of events to launch its attack. The best known of these attacks might have been the Michelangelo virus, which was alleged to attack millions of computers on March 6, 1992. The attacks remain devastating when they occur such as the South Korean logic bomb cyber attack of 2013 that wiped data from computers in the country's banking and broadcasting industries.

For most companies, the threat comes from the inside. An inside actor, like a disgruntled IT employee, inserts code that causes computers to fail. Often, the problems do not manifest all at once, but in a way that leaves the cause of the malfunction difficult to determine. For example, this happened at Siemans from 2014 through 2016.[1]

6. Man in the middle

A man in the middle attack requires that the connection between two computers be compromised. When it is, the “man in the middle” captures and relays the information being passed between the originator and the target in order to glean information from the data. Using secured authentication methods between computers – the type that repeatedly checks for an authentication signature – helps mitigate a man in the middle attack.

7. Phishing

Phishing is the most common type of attack. It’s those social engineering messages from a Nigerian princess or global lotteries that tell you that you now have access to untold riches—but only if you complete certain steps, which can range from filling out online forms to directly sending people money. Another type of phishing scheme pretends to be from a trusted friend. If you look closely at the actual email address, you'll see it's not. What happened? Their computer - and address book - were compromised by a virus and then used in an effort to get you to click on the link.

Spear phishing attacks are more narrowly targeted than regular phishing attacks. These attacks pretend to be messages from trusted and recognizable sources, such as bank communications or your internal network resource. They aim to get you to respond to a message or link. If you do, you are taken outside your protected network, making your computer susceptible to attack.

For more on phishing cyberattacks, read, “Are these new phishing attacks targeting your business?”

8. Ransomware

Ransomware is a malicious program that infects a single computer or network of computers and encrypts the data, making the device inaccessible. Once infected, the cybercriminals behind the infection deliver their demands - typically a ransom that the infected organization must pay if they want to use their device(s) again. Cryptolocker is one famous example of ransomware.

9. Social engineering

Social engineering attacks are aimed at the weakest part of any IT security system—the end user. These are attacks that attempt to trick the user into responding. The attack may ply on the user’s sympathy or link to something of interest (such as the famous Anna Kournikova attack in 2001). These attacks can be as straightforward as a simple phishing email, or more complex, involving cyberattacks or even interactions in the real world.

10. Visual hacking

Visual hacking is an in-person form of hacking that takes advantage of poor security on the part of end-users. When it comes to securing a work computer and physical workspace, a lack of employee training on cybersecurity best practices and actual execution of those best practices can leave key information easily accessible. For example, seeing logged-in, unattended computers, passwords taped to monitors, and sensitive corporate data left in plain sight on desks are common examples of lax security and visual hacking opportunities.

11. Zero-day attack

A zero-day attack or zero-day exploit is simply the use of a previously undiscovered flaw in an application or operating system that can be exploited to gain access to or control system resources. The term zero-day refers to the fact that it is the day on which the attack or exploit was first identified.

Bonus terms: deep web and dark web

These bonus terms may not refer to a type of cyberattack, but they are relevant.

• The deep web refers to the part of the internet not indexed by Google. Cybercriminals may reside there but so might legitimate – and legal – groups like a chess club that simply does not want to appear on Google.

• The dark web is a smaller part of the deep web. To access it, you need a special browser called Tor. Here, cybercriminals certainly reside.

Stolen data and credentials pass through the dark web, like those stolen if you get hacked. This is why many businesses today turn to dark web monitoring through managed security services. It provides an added layer of cybersecurity for increased awareness and protection for your business.

IT professionals know they must be constantly vigilant in an ever-changing landscape to protect company data. Hackers and cyberattacks, however, aren’t the only threat to data.

Read more about other serious threats in this article about potential low tech security risks.

The reality is, cybersecurity is a holistic, team effort. Businesses and employees must contribute to protect a company’s data and information. See how you are doing with a business cyber risk assessment.

For more on cybersecurity best practices, especially for a remote workforce, check out our article, “Cybersecurity best practices for a remote workforce to protect your business.”

Have you ever wondered about the security of your office phones? Read this article about office phone hacks to find out more.