Interview with a Hacker: What Hackers Don’t Want You to Know About Website Monitoring Services

Recently we interviewed a hacker for the purpose of finding out how our readers can better protect their websites against threats, and what hackers really think about website monitoring services. While he preferred to remain anonymous, and referred to himself as a “hacktivist” rather than the average run-of-the-mill hacker, he did give us a wealth of information for our readers. If you thought your website was safe from the threat of a DDoS attack or other hacking activities, you may be thinking twice after reading this. Fortunately, our guest also gave us some advice to truly help safeguard your website if a hacker does make you his next target.

Hacker vs. Hacktivist and Why the Difference Matters

When our guest told me he was a hacktivist, I asked him what he meant by that. His explanation was rather quite simple. “Hackers are people who will, for money, entertainment, or even just the challenge, hack into networks and websites. Depending on the reasons for what they’re doing, they may just leave a footprint showing that they’ve been there or they may cause serious damage to the website or network they have turned into their playground for the moment.” Hacktivists, on the other hand, do not hack websites or networks without a reason, and they usually feel their actions support the greater good when they do launch an attack.

So while all hacktivists are hackers, not all hackers are hacktivists. Since hacktivists work for the greater good and your site is likely too small to attract the attention of a talented hacker, you should be safe, right? Not necessarily. According to our hacktivist guest, any website is a potential target. While bigger, well-known sites are indeed the targets we hear about the most, smaller sites also get targeted on a frequent basis and for a variety of reasons. Perhaps you sold a cheap product made in China and when a customer had an issue with the product your customer wasn’t happy with the way you resolved the issue. This person knows a hacker or even a hacktivist and suddenly you find that your website is the target of a DDoS attack or even, as our hacker called it, the “defacement” of your website. With a DDoS attack, the hacker brings your site down with a flood of traffic that overwhelms the server your site is hosted on. With defacement, the hacker replaces the hosted pages of your site with their own pages, usually pages involving a message they want to send about your company if a hacktivist is involved. There are other types of hacking attempts, such as those that distribute malware and those that harvest data, but when the main concern is downtime then DDoS attacks and defacement are usually what scares people the most.

A Hacktivist’s Thoughts On Website Monitoring Services

So if anyone could be a target of a hacker, what do you do to protect yourself? Our interview gave us quite a bit of insight.

First, we asked our hacktivist guest what he thought of the use of website monitoring services. According to his experience, website monitoring services can indeed be a safeguard, but it won’t always stop a hacking attempt. He went on to explain…

Let’s take websites that advertise the fact that they utilize website monitoring services, such as those that display their uptime statistics with the badge provided by their website monitoring provider. Those are akin to a home with a “beware of dog” sign. You know that website has some safeguards in place, but you don’t know if they’re really using them correctly. For example, a website that only utilizes website monitoring services for notification of downtime is like a home with a small and yappy dog that doesn’t bite. Yes, the dog is going to make a lot of noise, alerting people of your presence, but it’s not really much of a hassle and it’s not going to get in your way. On the other hand, websites that utilize a website monitoring service and put other failsafes into place, such as DNS failover, are more like houses with a big dangerous dog. Yes, you may be able to get in and do some damage but it’s going to take longer, be harder, and your efforts aren’t likely going to have much of an impact. Therefore, the hacker or hacktivist is likely to move on to an easier target, unless (according to the hacktivist) you or your site has done something so severe that it warrants the effort.

Are You Advertising One of Your Greatest Assets?

This advice brings to mind an important question. If you’re using Alertra’s website monitoring service, do the pages of your website let visitors know that you have the service in place? Are you boasting your uptime with the uptime badge? If not, you may want to start doing so as that itself is the “beware of dog” sign that our guest says is the first indication a hacker may want to move on to a different target when analyzing the weaknesses of your site. Keep in mind, however, that this alone is not enough to protect your site from an attack.

Taking Website Monitoring a Step Further

As we were conversing with our guest we asked him what he thought of website monitoring services that not only notified subscribers of an outage, but were able to actually put automated failsafes in place, such as instantly redirecting a site to a different DNS if an attack such as a DDoS did occur. The hacktivist informed us that this is exactly the difference between the house with the small yappy dog and the house with the big dangerous dog. Sure, a hacker may be able to get around it, but according to our guest, hacking isn’t like what you see on television. It doesn’t happen in a matter of seconds. It takes time. As our hacker said, “Especially with sites that are safeguarded with security measures such as updated software, passwords, and firewalls. Then add in the fact that the site will automatically redirect to a different DNS when you do pull off your attack. That’s a lot of wasted time because you’ve put in all of this work and it’s basically just been thrown down the drain because the site is now on a totally different DNS. Your work is shot. It doesn’t make it impossible to launch another attack but it usually isn’t worth the time unless the website has done something heinous.”

What Will Make Your Site Unattractive to a Hacker?

We asked the hacker how he differentiates the sites with the “little dog” as opposed to those with a “big dog” and his answer was simple. “You get in, do a bit of digging. If they advertise they are using a website monitoring service, that doesn’t immediately eliminate the website as a target. On the other hand, once you start digging, if you see that they also have other safeguards in place, such as passwords and firewalls, you can be pretty sure they’ve taken it to the next step and at that point you have to ask yourself, is it really worth the time or would you be better off focusing on a different target? Eight times out of ten the answer is to go to a different target.”

With this in mind, if you have yet to have other security measures in place, now is the time to implement them. Your goal is to make your site as unattractive a target as possible. Combining the use of quality website monitoring service and its tools along with other safeguards is the best way to make your site look like more of a hassle than it’s worth.

More Advice from the Hacktivist

Once we realized there are certain things hackers look for before deciding to proceed with a target, we asked our guest if he had any advice he could offer our readers. His response was interesting, to say the least.

“One of the best things you can do is really protect the admin area of your site. Don’t use passwords that are easy to crack. Change the prefix of your database from the default standard wp6_ to a random prefix that no one would guess. Also make sure you limit the number of login attempts that someone can make within a certain time period and then make the system lock them out, even locking out password resets at that point, because email accounts can be hacked too.”

The Best Advice to Take Away from the Conversation

So what is it that hackers don’t want you to know about website monitoring services? First, they don’t want you to know that a quality website monitoring service is the first line of defense in not only protecting your website against downtime, but is also the first line of defense in protecting your site against malicious hacking attempts.

Second, a website monitoring service that offers automated services, such as Alertra’s webhooks (which can redirect your DNS if your site is brought down), are a significant deterrent since they literally undo the hackers’ work the moment the failsafes are put into place.

However, to truly protect your website from hackers you need to integrate everything. Combine your website monitoring service and its tools with other security features as well, such as the ones advised by our guest during our interview. By putting all of these measures into place, you can greatly reduce the risk of your site becoming the next successful target of a hacking attempt.