IT security
How can we protect ourselves against cyber attacks?
Stock photo: Cybersecurity – Colourbox*
“We always imagine a hacker to be someone wearing a ski mask, sitting in front of their computer and attacking other systems via the internet,” says Prof. Tibor Jager, Head of the Chair of IT Security and Cryptography at the Faculty of Electrical Engineering, Information Technology and Media Technology at the University of Wuppertal. But it’s not quite as simple as that, he explains, because first and foremost, these are always programmers who are capable of using technology creatively, even with good intentions.
“Asa rule, malicious hackers exploit security vulnerabilities that they have either discovered themselves or purchased on the black market,”says Jager. “But there are also people within the intelligence services who buy security vulnerabilities,” he continues. It is always difficult to predict where malicious attacks will come from; you cannot tell from the data alone. But by analysing the times or the tools used, it is often possible to identify the perpetrators through detective work. “These can be lone actors or state-organised groups.”
Social engineering – people as the starting point for cybercrime
Jager broadens the definition of a hacker and gives an example: “If you want to meet a previously unknown person for an interview and someone else finds out about it, they could theoretically turn up 15 minutes early, pose as the person in question and be the first to ask the interviewee about the potentially secret research project. That’s what’s known as social engineering.” As if that weren’t enough, there are also hackers who, for example, target smart cards or keys that could be used to unlock other people’s offices.
Prof. Malte Mues, Assistant Professor of Reliable Software and Distributed Systems at the University of Wuppertal, confirms that this form of social engineering is increasingly coming under the spotlight in companies, as people are still the weakest link in the system. Changing passwords more frequently and recognising phishing emails are the first steps in tackling this.
“In our research, we focus more on technical methods that secure systems against attacks where people attempt to make technical alterations,” says Mues. These often involve old systems that are still in use or forgotten computers – for example, in a production hall – which are connected to the network via an outdated version of Windows and are tracked down by hackers. “This is how hackers find their targets. There are always people who search out of boredom, because it’s not just organised state actors, but very often people who are simply trying things out,” explains Mues.
Bypassing security barriers
“Programming errors are the most common reasons why a hacker gains access to a programme, and the possibilities are incredibly varied,” says Jager. Protective mechanisms such as passwords or digital signatures – where, immediately after entry, a programme checks whether everything is in order – are logical systems, but they too can contain programming errors that serve as a gateway for a hacker into the programme. Then it’s just a matter of time and using the right software to have a look around the target computer.
“Passwords were a popular trend for a long time, but they’re not nearly as popular today because people generally have a strong password and use it across all other areas as well,” says Mues, adding: “Spotify lost a lot of user accounts a few years ago due to a hack, and they all resurfaced on the dark web. And if I search through these accounts, I can also find out the password that was used back then, log in to other sites and cause damage. There’s a list of common passwords that’s publicly available. One password that’s extremely popular on these lists is ‘1-2-3’ – that offers no protection whatsoever.”
Anyone who wants to check whether their email has already been hacked can do so. “There’s a website called haveibeenpwned.com. I can enter my email address there and then see whether my login details are included in such data breaches, and when and on which list my passwords have already appeared,” says Mues.
Another method is so-called voice cloning, a computer programme for imitating voices that uses artificial intelligence to copy a human voice to near-perfect accuracy based on audio samples. Jager adds: “There have already been cases where petrol stations were robbed because a hacker phoned new staff members, posing as the boss, and got them to hand over the codes for the Apple Pay cards.”
Good and bad hackers, and the complex legal landscape
Not every hacker is a criminal. Within the industry, a distinction is made between black-hat hackers, white-hat hackers and grey-hat hackers. Mues explains: “Black-hat hackers are people who have malicious intent and attack companies because they want to take them down.” However, there are also people who try to protect the company and test its defences. These are often people who are well-versed in social engineering and who use their knowledge for the good of the company. They are known as white-hat hackers.
“We even have a white-hat hacker team here at the department,” says Jager, “made up of students who enjoy engaging creatively with technology. They try to understand how hacker attacks work, for the sake of learning. It’s a voluntary hobby project in which we also adhere to hacker ethics.” This means that no external systems are attacked without consent; instead, they only look at what has been agreed upon.
“Grey-hat hackers,” continues Malte Mues, “are all the hackers in between.” And this middle ground is quite narrow, as the legal situation in Germany is less than ideal. His colleague Tibor Jager confirms this and explains: “What’s really unfortunate in Germany is that there is, for example, the so-called ‘hacker clause’ – Section 202c of the German Criminal Code (StGB). It states that no distinction is made between those who discover security vulnerabilities and report them in good faith, and those who discover them and exploit them maliciously.”
You might also be interested in this
Emmy Noether Programme: 1.4 million euros for a computer scientist from Wuppertal (Press release dated 13 August 2026)
International recognition – IT security: A landmark award for a computer scientist from Wuppertal (Press release dated 20 August 2026)
No backup, no mercy
Systems are built differently today than they used to be, explains Jager, using the example of a house of cards: “If I imagine that the university’s entire network structure looks like a house of cards, my approach today is to use as many cards as possible and build it as sturdily as possible, so that I can remove cards here and there without the house collapsing.”
In the past, people used to build the house of cards with as few cards as possible, put up a big fence around it and hope that no one could get past it. If they did, even removing a single card would cause the house to collapse. Security is therefore the top priority, and there are plenty of examples of how not to do it.
In Romania, a hacker recently paralysed the entire property market. He breached the land registry’s network and subsequently attempted to blackmail the authority with the data he’d stolen. When that failed, he deleted the country’s entire land registry database. Jager is unsympathetic on this point and, as an expert, says with a wink: “No backup, no mercy!” He then continues: “You have to consider that there was an important database there. These days, you simply have to reckon with the possibility that at some point, someone will gain access to it and launch an attack. Completely securing such a large system is certainly a lost cause.” But, of course, one must ask why there was no backup copy, and why this backup copy wasn’t stored somewhere out of the hacker’s reach.
There is also the option of cleverly dividing data in such a way that part of it could fall into the hands of attackers without them being able to do anything with it. The technology for this is now available. “Our start-up utilacy, which grew out of my department, has developed a technique for splitting data across three, four or five different systems,” says Jager. “Combined with the usual security measures, this is the strongest protection that can currently be achieved technically. And it’s also relatively straightforward.”
A centralised system for 80 million people?
There will always be cyber-attacks, but there are also ideas on how to better ensure protection. Mues is thinking, for example, of administrative structures. “I believe that administration in Germany is also organised in a very decentralised way. We’re only just beginning to centralise everything.” At the moment, the situation is such that every district and every small local authority would be paralysed for a long time if they were attacked.
“If I were to centralise all of this now and pack it into a data structure stored in a database, then I’d finally have a unified system for 80 million people, with which I could actually make a real difference. I’m not setting up separate IT centres for 100 districts, which I’d then have to deal with, but rather I’m consolidating them into one large infrastructure,” said Mues.
This would leave one or two attractive targets, which would certainly come under heavy attack. For instance, the so-called Telecom Security Monitor, available at sicherheitstacho.eu, shows an average of two million detected attacks per hour. As there is a “baseline level” of attacks anyway, Mues concludes, it makes more sense to focus attention on one large, attractive target that can be defended.
AI goes rogue
However, there are now also cyber-attacks carried out directly by artificial intelligence (AI). The US company OpenAI has accepted responsibility for a cyber-attack on the AI platform Hugging Face in July 2026. This extraordinary incident highlights the risk of potential cyber-attacks carried out by AI. During a test run of new AI models by OpenAI, the software independently infiltrated the computer systems of another AI firm. In doing so, the AI effectively left the protected environment of its own accord.
Jager cannot understand the hype surrounding this news: “AI is quite good at recognising patterns in complex data, which means it is also good at identifying security vulnerabilities in complex data,” explains the expert. “The more powerful AI becomes, the better it gets. The fact that AI is so good at finding security vulnerabilities is also a major advantage, because now anyone can start identifying vulnerabilities in their own systems and securing them.” This also takes the pressure off existing areas of work where people previously had to deal with this intensively. “There are experts,” says Jager, “who say that AI will make our systems more secure because we will no longer have to rely solely on a handful of specialists.”
Invest more in an independent Europe
The problem, however, is that most providers, such as OpenAI, are predominantly American or Chinese corporations, and there is no European equivalent. Jager therefore asks: “Why aren’t we putting more resources into this? Including in the field of IT security research! At the moment, we are very heavily dependent on others when it comes to such AI methods.” The technology itself is certainly an advantage, he adds.
Although there is constant talk of the need for sovereign solutions for a digital Europe, says Mues, all the chip labs – that is, semiconductor design laboratories – are located elsewhere. “We buy hardware and software abroad.”
In cyberspace, many things can be digitised. Both scientists are aware of the opportunities and possibilities offered by the sensible use of digitalisation and say: “If we do not make use of the technologies that are available, we will increasingly be reading about cyber-attacks that render companies unable to operate for extended periods.”
Transfer story
This article is also published by the University Communications department at the University of Wuppertal. The ‘Bergische Transfer Stories’ use numerous examples to illustrate how researchers actively shape society, the economy, the region and everyday life through their findings.
You can find the full article on the UniService Third Mission website.
* The rights to use the Colourbox image are held by the University of Wuppertal. It is not licensed for publication by third parties.
