Attack surface: why hackers go after small websites too

Miva makes candles, and today her small shop opens online, at candleshop.example. Who would bother to attack a shop this small? Nobody in the world knows it exists yet.

Before the first customer arrives, the first visitors knock on the shop's server, the computer that runs it. They are not people but programs, and each one tries one easy trick: the password the software came with, a page left open, an old version with a known flaw.

Nobody picked Miva. Rono wrote his program once, and it tries the same trick on millions of addresses, one after another, day and night. A program that works alone like this is called a bot.

This is not a scare story. In 2021, researchers put 320 servers online with easy passwords, on purpose. Within a day, attack programs had broken into 80% of them, and into every one within a week.

So the real question for Miva is not "Who wants me?" but "How many ways in do I have?". Each one is a door a bot can try. All of them together are called the attack surface.

The bot does not need to be clever. A locked way costs it nothing: it just moves on. One way left open is enough, and the bot finds one at Miva's: her admin page, where she runs the shop, still takes the password it came with. The bot is in.

Miva spots the stranger in her admin page that evening and changes that password. The next knock finds every way shut. The bot moves on to another shop. Rono does not. He reads the "About me" page of the shop, and picks up the phone.