In the high-stakes world of cyber security, the term “hacking” often conjures up images of sophisticated cyber threats and data breaches orchestrated by skilled attackers. However, a lesser-known but equally dangerous phenomenon is the rise of “fake hacking” - where individuals or groups deliberately misrepresent their abilities to infiltrate computer systems.
Fake hacking is when an attacker pretends to have gained unauthorised access to a target's network or devices, when in reality no breach has occurred. While this type of activity may not always lead to long-lasting damage like other hacking methods, it can still have serious consequences, including extortion and reputational harm.
“Fake hacking is particularly insidious because it leverages people’s fear and uncertainty about cybersecurity. Attackers are essentially tricking victims into believing their systems have been compromised, in order to extract money or other concessions,” explained William Petherbridge, Manager of Systems Engineering at cybersecurity firm Fortinet.
One common tactic used in fake hacking is the “hacker typer” - a website that simulates the appearance of a computer being hacked, with lines of code rapidly scrolling across the screen. While this may seem relatively harmless, other methods employed by fake hackers can be far more convincing, such as sending emails that claim a system has been infected with ransomware, or triggering pop-ups that falsely warn of a malware infection.
“The goal of the fake hacker is to create a sense of panic and urgency, in order to pressure the victim into paying a ‘ransom’ or purchasing some kind of ‘protection’ service. And unfortunately, if the target isn’t vigilant, they can fall for these tricks quite easily.” Petherbridge said.
So how can organisations and individuals distinguish legitimate hacking threats from the fake variety? Petherbridge outlines several key signs to watch for:
Money Demands: If the “hacker” is demanding a relatively small amount of money, often in the form of cryptocurrency, this is a strong indicator of a fake attack rather than a real data breach.
Lack of System Changes: When a network or device has been genuinely compromised, there are usually clear signs of change, such as altered files, new user accounts, or unusual network traffic. If the system appears to be functioning normally, the hack is likely fabricated.
Poor Organisation: Fake hackers often lack the infrastructure of a real attacker, such as a legitimate-looking website or authentic email address. Their communications and demands tend to be disorganised and lacking in technical details.
To protect against fake hacking, Petherbridge recommends carefully verifying any claims of a breach before taking any action, and leveraging the expertise of former hackers who can recognise the hallmarks of a fabricated attack. Ensuring employees are trained to spot the red flags of fake hacking is also crucial.
“The most important step is to never panic or rush into a decision when faced with a purported hacking incident,” Petherbridge advises. “Take the time to carefully assess the situation, double-check the facts, and respond accordingly. Falling for a fake hack can be just as damaging as a real one,” he said.
Ultimately, the rise of fake hacking underscores the complex and ever-evolving nature of the cybersecurity landscape. While these attacks may not involve the same level of technical sophistication as other hacking methods, they can still inflict significant harm through extortion, reputational damage, and the erosion of trust.
By understanding the telltale signs of fake hacking, and implementing robust security measures and incident response protocols, organisations and individuals can stay one step ahead of these deceptive threats. Vigilance, education, and a level-headed approach are the keys to avoiding the pitfalls of fake hacking.
Learning to spot the warning signs
Unusual system slowdown: “If your computer suddenly starts performing simple tasks much slower than usual, it could be fighting a virus infection.”
Unexpected pop-ups: “When pop-up windows appear even when you're not browsing the internet, this is often a red flag.”
Self-starting programs: “Programs that launch automatically, especially unfamiliar ones, warrant immediate investigation.”
Account disruptions: “If you're repeatedly logged out of your accounts without initiating it, this could indicate malicious activity.”
Frequent crashes: “Regular system crashes or the dreaded 'blue screen of death' might signal virus interference.”
Unauthorised emails: “Finding sent emails you didn't write in your outbox is a classic sign of email-spreading viruses.”
Homepage changes: “Any unexpected changes to your browser's homepage should be treated with suspicion.”