Attacks on the human - when they hack you, not the system

The most expensive firewall does not help if the owner hands over the password himself. A whole family of attacks does not touch the system at all - their target is you. They need no vulnerabilities and no exploits, only trust, haste or inattention. Let’s go through the main kinds and the shared defence.

Social engineering

The attacker does not hack the system - he hacks the person, making them hand over access themselves. The classic: “Hi, I’m from tech support, we urgently need your password for an update.” Three main levers - pressure, urgency, authority: you are rushed, scared with consequences, and shielded by a job title.

• no legitimate organisation asks for your password - not a bank, not an IT service, not Google, not the police;
• verify the identity of anyone asking for something sensitive - call the official number, not the one they gave you;
• any “urgent” request is a reason to slow down, not speed up.

Phishing sites (spoofing)

You are sent a link to a “bank” - and the page looks exactly like the real one. The domain differs by one character (privatb4nk.ua instead of privatbank.ua), the design is copied down to the details, and the login and password you type go straight to the fraudsters.

• check the address bar - the URL must be exact to the character;
• HTTPS and the padlock do not guarantee honesty: a phishing site has a certificate too;
• for your bank and mail - bookmarks, not a Google search and not a link from an SMS; type the address by hand;
• check a suspicious URL on VirusTotal or Google Safe Browsing.

The scheme of luring people with bait (giveaways, “surveys”, “prizes”) is covered separately - how to check a site’s reputation.

Card skimming

You withdraw money from an ATM without suspecting your card data is already read. A skimmer is an overlay on the card slot plus a miniature camera above the keypad; disguised so well they are hard to spot with the naked eye. What they collect goes into cloned cards.

• before use, inspect the ATM - wiggle the reader, check for overlays;
• cover the keypad with your hand during the PIN - this defeats the camera;
• prefer contactless payment (NFC) and virtual cards;
• ATMs inside bank branches are better protected than street ones;
• enable notifications for every transaction.

Shoulder surfing

The simplest attack, with no technology at all: someone looks over your shoulder while you type a password in a cafe, the metro or an airport. Some film the victim with a camera from a distance.

• a privacy screen on your laptop and phone;
• cover the keyboard during a PIN or password;
• auto-lock the screen after the shortest idle time;
• don’t open confidential documents on transport or in a cafe.

Social media: you hand over the reconnaissance yourself

Everything you post can be used against you. A holiday photo tells thieves you are away. A post about a new job gives material for targeted phishing. Answers to “fun polls” (first teacher, first car) reveal your own security questions. The same fragments - leaks, social media, discarded documents - add up to identity theft: a loan is taken or a business registered in your name, and for years afterwards you untangle debts that were never yours.

• limit public data: date of birth, phone, address;
• don’t post your location in real time - better after you return;
• review privacy settings on every network;
• destroy paper documents with personal data before throwing them out;
• periodically check your credit history for records that aren’t yours.

Takeaways

• The common trait of all these attacks is that the target is you, not the system; so the defence is behavioural, not technical.
• Pressure and urgency are a signal to slow down. Legitimate organisations don’t ask for passwords and don’t rush you.
• The domain and the address bar decide it: one character of difference and you are on the bait.
• Less personal information in public means less material for a targeted attack.