You are signed in. Close

You are signed out. Close

Thank you. Your subscription has started. Close

Thank you. You will get an email when a new comic comes out. Close

We could not confirm your payment. If you paid, use the link "Sign in" at the bottom of the page. Close

Something went wrong on our side. Please try again in a moment. Close

Previous episode Malware: how a file you open starts working against you

How hackers break in: the most common attacks on people, websites and apps

Unpatched software: how attackers get in when nobody clicks anything

Nobody clicked a link. Nobody opened a file or answered a phone call. Still, attackers got into the website during the night. The "Later" button on an update screen plays a part. Meet vulnerabilities, patches and zero-days, with the real cases of Equifax and WannaCry.

  1. 1 Miva now checks every caller and every file before she trusts them. One busy morning, the admin page of the shop shows a note: a new version of the review plugin, the small add-on from another company that shows customer reviews, is ready. Miva has orders to pack, and the shop works fine. She clicks "Later".Mivaadmin pagereview plugin:new versionNowLaterorders to pack

    Miva now checks every caller and every file before she trusts them. One busy morning, the admin page of the shop shows a note: a new version of the review plugin, the small add-on from another company that shows customer reviews, is ready. Miva has orders to pack, and the shop works fine. She clicks "Later".

  2. 2 That night, while Miva sleeps, Rono's bot gets into the shop. Nobody opened a file. Nobody picked up a phone. Nobody clicked anything. So how did it get in?candleshop.exampleRono's botclicks: 0

    That night, while Miva sleeps, Rono's bot gets into the shop. Nobody opened a file. Nobody picked up a phone. Nobody clicked anything. So how did it get in?

The rest of this episode is for subscribers

Subscribe to read every premium episode. You can cancel when you want.

Paid yearly: $99 instead of $119.88

Next episode SQL injection: how a search box can hand a whole database to a stranger

Share this comic

More comics