Common Threats in Plain Terms

Picture the hacker from a movie: a hooded figure typing furiously, cracking a bank's defenses in seconds with brilliant code. That image is almost entirely wrong, and believing it leaves you exposed to the attacks that actually happen.

Most real attacks aren't a battle against the machine — they're a trick played on the person using it. They work the same handful of ways, and once you can name those ways, you can recognize them. Naming them is most of the defense.

Phishing: the Fake Message

Phishing is a message — an email, a text, a chat — that pretends to come from someone you trust, in order to trick you into giving up access. The name is a play on "fishing": the attacker dangles convincing bait and waits for someone to bite. It is, by a wide margin, the most common attack there is.

A typical one looks like an email from your bank: "Suspicious activity on your account — log in here to verify." The link goes to a page that looks just like the real bank's login. You type your password, and you've handed it straight to the attacker. Nothing was hacked; you were persuaded.

The reliable tell is urgency aimed at you. Real organizations rarely demand that you click a link and enter your password within the hour. When a message rushes you toward a login or a payment, that pressure is the warning sign — stop and reach the company yourself, through a number or address you already know.

Malware: the Harmful Program

Malware — short for "malicious software" — is simply a program written to harm you or to steal from you, instead of to help you. A program, remember, is just a set of instructions a computer follows; malware is a set of instructions written with bad intent.

It can lock your files and demand payment to unlock them, quietly record what you type, or turn your machine into a tool for attacking others. But it almost always needs the same first step: you have to run it. That's why malware usually arrives disguised as something you'd want to open — an attachment, a "required" update, a cracked copy of paid software.

So the defense is mostly about that first step. Don't run programs that arrive unexpectedly, and don't install software from places you don't trust. The computer will faithfully follow whatever instructions you let it run — including the harmful ones.

Weak and Reused Passwords: the Easy Way In

The third common threat needs no trickery at all — it just walks through an unlocked door. Passwords that are easy to guess, or the same password reused across many sites, are the simplest way in, which is why this connects straight back to the passwords topic earlier in this chapter.

The danger of reuse is the multiplier. When one website is breached and its passwords leak — which happens constantly — attackers take that email-and-password pair and try it on your email, your bank, and your shopping accounts. One reused password turns a single leak into a break-in everywhere you used it.

The Common Thread: Attacks Target People

Step back and the pattern is clear: all three aim at the person, not the machine. Phishing persuades you to give up a password. Malware persuades you to run it. A reused password is a human shortcut an attacker exploits. The computer did exactly what it was told — the trick was getting *you* to tell it.

Think of a con artist at your door in a convincing uniform. The lock on the door worked perfectly; the problem was that you were talked into opening it. That's how most attacks land — not by defeating the lock, but by persuading the person holding the key. Knowing that the target is you, not your software, is what makes the warning signs visible.