I'm trying to understand how realistic hacking is from a purely technical perspective. Is an attacker generally capable of launching an attack against almost any average computer, but deterred mainly by the risk of leaving logs, traces, or other evidence? Or do most attacks only work when the attacker finds a specific vulnerability in the target's operating system, software, configuration, or network?
For example, is an ordinary computer more like a brick house with windows that can usually be broken, or more like a heavily reinforced structure where random tools generally do nothing? Assume the target has not already been compromised, does not willingly provide credentials, and is not unusually exposed online. I'm also curious how much encryption and other defensive technology limit an attacker before they can interact with the victim.
4 Answers
People are often the easiest path because phishing, reused passwords, malicious attachments, and social engineering can bypass many technical protections. But even without user interaction, attacks are not guaranteed. The attacker still needs a remotely reachable vulnerability or some way to get code running, and well-maintained systems may provide no practical opening.
Avoiding detection is only one reason attackers hesitate. Finding a usable vulnerability can require specialized knowledge, time, target information, and sometimes luck. An attack can also be blocked by layered defenses, fail because the software version is different, or cause too little benefit to justify the effort. In that sense, a computer is neither an impenetrable steel house nor a fragile glass one—it depends heavily on its design, maintenance, and exposure.
The technical defenses matter a lot. Modern operating systems use access controls, sandboxing, firewalls, secure boot features, encryption, and frequent security updates. Those measures don’t make a computer impossible to attack, but they mean an attacker needs a compatible exploit or another weakness. Encryption can prevent someone from reading protected data, while it may not stop every kind of compromise by itself.
No—there isn’t a universal hacking tool that works against almost everyone. A successful breach usually depends on a particular weakness, such as an unpatched application, a bad configuration, exposed services, stolen credentials, or a vulnerability in a specific version of software. Without knowing anything about the target, an attacker has to discover what is exposed first, and many attempted attacks simply fail.
That makes sense. So for a reasonably updated, average computer with no exposed services, most generic attacks would just fail rather than automatically work?