Why is Everything Getting Hacked?

Summary

Cybersecurity breaches are becoming more frequent, and it's not just because we're hearing more about them. The rise in incidents is linked to regulations requiring faster breach reporting, as well as companies' lack of severe consequences for poor security practices. Hackers are increasingly targeting employees through social engineering and bribes, bypassing traditional security measures. Additionally, the complexity of modern software development, especially AI-driven coding, increases risks through supply chain attacks and insecure dependencies. As security flaws evolve, developers must adapt quickly to protect both their code and personal data.

Takeaways

• 😀 Hacks and breaches are becoming more frequent, partly because companies are not punished enough for poor data security practices.
• 😀 The SEC now requires public companies to disclose breaches within four days, increasing visibility of security incidents.
• 😀 Private companies also have to comply with state and international laws (e.g., GDPR) that require breach notifications.
• 😀 Some companies may not even know they've been hacked due to poor security practices or undetected breaches that last for months.
• 😀 Hackers are increasingly relying on social engineering to target employees rather than bypassing sophisticated network defenses.
• 😀 The Vercel breach was due to an employee being compromised via a third-party service, showing how internal security can be weak.
• 😀 Hackers can exploit human error, such as employees unwittingly granting dangerous permissions or downloading infected files.
• 😀 Outsourcing to third-party companies can increase the risk of data breaches, as seen with Discord's hack through a third-party service.
• 😀 Some hackers bribe low-paid customer service employees in outsourced locations to help them gain access to sensitive data.
• 😀 Supply chain attacks are becoming more common, where malicious updates to software packages (e.g., through NPM, PyPI) can infect many users.
• 😀 The rise of AI in coding can lead to vulnerabilities as AI tools may suggest malicious dependencies, causing unnoticed security risks.

Q & A

Why does it seem like there are more hacks nowadays?

There are several reasons: hacks are genuinely increasing, companies are required to report breaches more frequently due to new regulations, and there is greater media coverage making them more visible.

What role do SEC regulations play in the reporting of data breaches?

Since 2024, the SEC requires publicly traded companies to notify them and their customers within four days of a data breach. This makes breaches more visible compared to the past when companies could keep them secret.

How do hackers often gain access to companies without attacking their infrastructure directly?

Hackers frequently use social engineering to target employees or third-party contractors, compromising accounts, malware infection through personal devices, or bribery to gain access.

What is an example of an internal employee-targeted hack?

The Vercel hack involved a Vercel employee granting excessive permissions through a compromised Context.ai account, allowing hackers to access Vercel's systems indirectly.

How can outsourced companies contribute to data breaches?

Outsourced companies, like customer service providers, may have access to sensitive data. If they are compromised, hackers can access the primary company's data through them, as seen with Discord.

What is a supply chain attack and why is it concerning?

Supply chain attacks occur when hackers compromise a software maintainer or package that developers rely on. This allows malware to spread widely when developers integrate updates, potentially affecting many systems quickly.

How can dependency management in programming contribute to security risks?

Over-reliance on third-party packages and automated AI suggestions can introduce vulnerabilities. Hackers exploit typo-squatting or compromised maintainers to insert malware into these dependencies.

What strategies help prevent internal or employee-focused hacks?

Implementing zero-trust authentication, using physical security keys (YubiKeys), passkeys, and strict access controls can limit damage from compromised employee accounts.

Why might developers delay installing updates in certain cases?

While updates patch security vulnerabilities, immediately installing updates can expose systems to supply chain attacks if the update has been compromised. Waiting allows others to detect issues first.

Are hackers becoming more sophisticated in their methods?

Yes, hackers increasingly focus on human vulnerabilities rather than just technical ones, using social engineering, bribery, and exploiting supply chain weaknesses instead of only breaching firewalls directly.

How do GDPR and state laws affect data breach reporting?

GDPR and individual state laws require companies to notify affected customers when a data breach occurs, even for private companies, ensuring more transparency and accountability.

Why is the general public more aware of hacks now than before?

Increased regulation, media coverage, and frequent reporting of breaches make it more likely for the public to hear about hacks that previously may have gone unreported.