How to protect your data privacy on social networks

Studies have said public speaking makes as many as 3 out of 4 people anxious. But that was before Facebook.

The 650 million people on Facebook suggest that most of us are getting over—or want to get over—that fear of communicating (or at least sharing pictures) in public. In just a few years, Twitter, YouTube and Facebook have given billions of people the chance to connect to an audience they would never had access to before.

But now that you’re becoming comfortable in public, you may begin to wonder: Am I revealing too much? In a world with the NSA, TMZ and Wikileaks, do I have any privacy? Is it possible to be a public person and still protect my information from being misused?

Friday January 28 is Data Privacy Day 2011, an international celebration of the dignity of the individual represented through personal information. Protecting your irreplaceable data is our mission and we take this mission very seriously. (Here is F-Secure’s Privacy Policy.)

The risks

The more visible, attractive or rich you are, the more you’re a target for the haters, the stalkers and online criminals of the 21st century. Heck, if you have a credit card, you’re a target for both the online criminals and unscrupulous marketers of the world.

Sharing personal information in an age where data can travel faster than lightning requires a 21st century view of data privacy. Some think it’s vain to worry about privacy. But don’t think about your ego, think about social engineering.

Wiktionary describes social engineering as “The practice of tricking a user into giving, or giving access to, sensitive information, thereby bypassing most or all protection.” Criminals have discovered that human error is the easiest vulnerability to exploit. If you’re not careful, your private data (or even public data) can be used to fool you into making mistakes that even your award-winning Internet Security can’t prevent.

Ignorance may be bliss, but it’s not an excuse. Once your private data is stolen, you’ll have to deal with the consequences. The good news is that you can do a lot to make your data more secure

My nephew once told me, “Facebook is so easy that even old people can use it.” And by old people, he meant me.

I agree with my nephew. Most people who use social media don’t suffer significant negative consequences for doing so—or there wouldn’t be millions of new people trying it every day. Stories of people being fired or arrested for what they’ve done on Facebook are rare. But they get lots of attention because Facebook is the superstar everyone knows.

Only a small percentage of those on social media fall victim to the worst of identity theft, malware or scams. And that’s still too many people suffering needlessly—especially because most of these scourges are avoidable.

The lessons

If you learned to manage the benefits and risks of email, you can do the same for social media. Here a few things you can do to help keep your private data private.

1. Decide why you’re social networking.
For some, social networking is an extension of your private life. You mostly interact with people you know or would like to know in the real world. The main topics of conversation are personal. Even when you delve into entertainment or politics or sports, it’s about sharing opinions to have fun and connect. Intimacy is the goal so private things are often shared nonchalantly. For instance, you might reveal what you did on a day when you played hooky from school or work.

For others, social networking is like interacting at a conference. You’re seeking out people in your industry or whom you admire. Conversation is like a cocktail party—being interesting and on-topic matters. When you talk about entertainment or politics or sports, it’s a way to network and establish trust. You want people to feel like they know you, but getting too personal too fast raises red flags. For instance, you may reveal what you did on your vacation but only in a way that you wouldn’t mind your boss reading.

For a growing number of people, social network is a chance to build a little fame or fortune. You’re looking for an audience who trusts and enjoys you to the point you might even sell them things. You converse with fellow influencers and friends but you also broadcast for a targeted or general audience. When you talk about entertainment or politics or sports, you’re entertaining or engaging an audience while establishing expertise. You may share extremely private details or never talk about your personal life. Either way, you’re establishing a persona that’s relatable to the audience you’re trying to attract. For instance, you may reveal a joke a well-known person shared with you.

By the time you’re out of college for a few years, most people have tried out some variation of each of these approaches to social media. And your approach definitely affects your data security.

The rule is: the bigger the audience you seek, the more you have to think about the information you share.

All of us have to protect our ID, account and phone numbers, our address and our Mother’s maiden name. But if you’re an aspiring Disney star or class president, you have to think about which pictures you take—since you know they’ll all be posted eventually. And George Clooney probably shouldn’t use Foursquare to share his location unless he wants to spend his day shaking hands or filing restraining orders.

We all need to be cautious about sharing details that can be used to scam us. If you achieve, or accidentally achieve, fame, your privacy will become even more precious. So if you want to be internet famous, you need to be savvy about which information you share online—or you’ll have to hire people who are.

2. Secure your systems
Don’t use the default password for your voicemail or anything. Use strong, unique passwords for all your accounts. Don’t use work email addresses or passwords for social accounts. Put security software on your PC and your mobile device, if possible. Password protect your Wi-Fi networks. Turn on secure browsing on Facebook. Put a remote lock on your mobile phone. Always lock your PC and mobile devices when you aren’t using them. Keep your system and application software updated. (Our free Health Check makes that easy.) Turn off GPS on your phone and pictures if you don’t want strangers to know your location.

3. Choose services you trust
Any store, service or site that has your data, should have a privacy policy. A key feature of a good privacy policy is that your data will not be shared or sold. By 2011, most reputable online businesses have privacy policies that make that basic promise. But in addition to privacy also have to trust that any organization you trust with your data had security that won’t be compromised. Quality can have a price. If privacy is more important to you than cost, you can buy dedicated email services that won’t serve you ads. Regardless if they charge or not, you should only use reputable online services you trust. Before you enter any data into any website, think, “Do I trust this organization?” If there’s any doubt, ask others what they think.

4. On a social network, your information could be shared with everyone– no matter what your privacy settings are.
Twitter is simple. There are two privacy settings: everyone or “Protect my tweets”. But even if you go with the protected option, your approved followers can still retweet your information to everyone. Facebook’s privacy settings are much more complex. They’re so complex that it almost feels like you should get college credits for really using them. Going with “Friends Only” is a good start, then you have to decide if you want your page on Google (if you don’t want your Facebook page to show up on Google, go to Account > Privacy Settings > Apps and Websites: Edit your settings > Public Search: Edit Settings > Uncheck Enable public search)  and if you want to automatically share your information with other websites.

The safest rule is: get your settings right and still assume that what you post could go public so only share information you wouldn’t mind a future boss (or fan) seeing. NEVER share information that could be used to crack your passwords. Also keep in mind that the information you’re sharing that could be used by identity thieves and social engineers.

5. Be available or don’t
There is a difference between following and friending people. You can follow a lot of people but our brains can only handle around 130 friends. Rejecting or ignoring friend requests can be emotionally difficult, but your privacy is more important than others’ feelings. I say follow anyone on Twitter but on Facebook I’d recommend only befriending people you know or trust. And realize that the person is your friend, not their links. If anyone begins to spam you, let them know the problem. If they keep spamming, unfriend them. If anyone harasses you at all, block their communication. If you’re threatened, contact law enforcement.

You have the right to keep your private data secure while living your digital life to the fullest. All you have to do is respect your own data privacy and do your best to make sure that the people and businesses you interact with do the same.

Cheers,
Jason

CC image by Sudhamshu Hebbar

More posts from this topic

Mikko Hypponen

Mikko Hypponen’s Malware Hall of Fame

Mikko Hypponen is one of the world’s most prominent cyber security experts. Described as a “virus hunter” in a Vanity Fair profile called “The Code Warrior”, Hypponen has spent nearly 25 years with F-Secure protecting people from computer viruses, worms, trojans, and other types of malware. In 2011, Hypponen travelled to Pakistan to meet the men behind the first known PC virus – Brain.A. [youtube https://www.youtube.com/watch?v=lnedOWfPKT0&w=560&h=315] The Brain virus was released in January of 1986, making January 2016 the 30th anniversary of this milestone in malware history. I thought it would be interesting to reach out to Mikko and ask him about other families of malware that standout as being noteworthy. So here’s Mikko’s list of some of the most infamous malware families (including viruses, worms, trojans, etc) that’ve pestered, frustrated, and even extorted computer users over the past few decades. 1990 Form – Form was a common computer virus identified in 1990, and for several years, was arguably the most prominent computer virus in the world. Spread through 3.5” floppy disks, it infected millions of computers throughout the world, and is possibly one of the most widespread viruses in history. 1992 Michelangelo – Michelangelo earns a place on the list for being the first truly global virus scare. It was named after the famous artist because the virus remained dormant until March 6 (the artist’s birthday), when it would awaken and overwrite sections of infected hard disks, thereby making the information inaccessible and the computer unusable. The virus was never particularly prominent compared to some of its contemporaries, but its destructive nature and subtlety helped spread Michelangelo Madness throughout the globe. 1995 Concept – Concept was the very first macro virus – a type of virus that infects applications such as Microsoft Word. It was a very prominent security concern in the mid-nineties, and even though it was successful in propagating itself organically during this time, it hasn’t been seen in over a decade. As the first macro virus, it was notable in that it spread by hiding itself as a Word doc and then infecting computers as those documents were shared. By using Word, it could use both Windows PCs and Macs to spread infections, as the software could run on both platforms. 1999 Melissa – Melissa, supposedly named after an exotic dancer, was a computer virus that sent infected Word documents to contacts in victims’ Outlook address book. While the virus was not designed to be particularly destructive, its rapid proliferation through the Internet wreaked considerable havoc on corporate servers and infrastructure. Some accounts claim that it infected twenty percent of computers globally, and the man eventually convicted of releasing the virus into the wild admitted to causing eighty million dollars in financial losses. 2000 Loveletter – Loveletter, also widely known as ILOVEYOU, was a prominent email worm that was able to spread itself throughout the globe in a matter of hours by promising victims a little bit of love. Disguising itself as a chain, love-themed email to recipients helped it quickly spread from its Filipino origin through Asia, Europe and North America. To this date, it is one of the largest malware outbreaks of all time, and responsible for an estimated 5.5 billion dollars of damage. 2001 Code Red – Code Red was the first fully-automated network worm for Windows. As in users would not have to interact with a machine in order to spread the infection. Code Red’s most infamous day was July 19th, 2001, when it successfully infected 300,000 servers. The worm was programmed to spread itself on certain days, and then execute distributed denial-of-service (DDoS) attacks on others, and was used against several different targets (including The White House). 2003 Slammer, Lovsan, and Sobig – Ok, so there’s three here and not just one. But they all occurred very close together, and unfortunately, all three were worms responsible for massive, global malware outbreaks. Slammer targeted servers so it’s presence wasn’t readily apparent to end users (save some lagging when they were attempting to access an infected server). Lovesan, however was able to infect end users running Windows ME or Windows XP, and use the infected machines in DDoS attacks. Sobig spread itself through email and network drives, and contained a trojan in order to cause more headaches for infected users. However, it appears that the trojan feature did not function as expected. These three worms infected millions of machines, and made headlines all over the world. 2004 Sasser – A computer worm that can be considered as the last large “hobbyist” outbreak. This is significant as it signaled the end of an era when most malware was written by people who were simply curious to see what the malware could do. Nowadays, malware has a more specific, insidious purpose, such as stealing information or making money. 2006 Warezov – A two-year email worm campaign perpetuated by professional criminals, Warezov gained notoriety for downloading new versions of itself from remote servers – sometimes as frequently as every 30 minutes, according to a 2006 interview with Mikko. 2007 Storm Worm (also called Small.dam) – Storm Worm was a trojan that was spread as an attachment to spam emails. But more importantly, it was a combination of complex and advanced virus techniques that criminals were able to use to make money by using infected machines as part of a botnet. 2013 Cryptolocker – A notorious ransomware family, Cryptolocker was spread through malicious email attachments, as well as the infamous Gameover Zeus botnet. Infected victims would find their hard drives suddenly encrypted, essentially locking them out of their devices and data until they paid a ransom to the perpetrators. While the FBI, in cooperation with other law enforcement agencies and security companies (including F-Secure), were able to disrupt the operation, the perpetrators were able to use Cryptolocker to extort about 3 million dollars from victims before being stopped. Other notable mentions include the 2005 Sony rootkit (for being distributed on Sony BMG CD-ROMs on their behalf), the still prominent Downadup worm from 2008 (for infecting millions, including armed forces of several countries and police departments), and the well-known Stuxnet virus from 2010 (for both its sophistication and its apparent state-sponsorship). If you want to know more about the history of computer viruses, you can check out Computer Invaders: The 25 Most Infamous PC Viruses of All Time!

January 29, 2016
BY 
Scam

Yes, it’s OK to play with scammers

This TED talk is so hilarious that I just have to share it with you. Watch it! British comedian James Veitch is engaging in the noble art of scam baiting, or scamming the scammers. The same as this site is dedicated to, or when I almost sold my boat to Mexico. I guess most or all of you already know how to spot an advance payment scam, aka. Nigerian scam. But James has some more to offer here. He’s making two important points, in addition to the excellent entertainment value. People often warns about engaging in any kind of conversation with these scammers. They are after all criminals and it’s safest to steer clear of them. I disagree, just like James. The people behind this kind of scams is not exactly the violent drug mafia. As a matter of fact, anyone who can use e-mail and Google Translate can set up a scam like this. And they are located in some poor remote country, typically in Africa. So it’s extremely unlikely that any of them would start hunting down people who play with them. That would disrupt their everyday business and cut profits, cost money and introduce the risk to get caught. But I do discourage people from engaging in scam baiting under their real identity. Set up a new mail account under a false name and never reveal any real contact info to them. You can reply from a different address than where you got the original spam. They are pumping out millions of spam messages and will not even notice the changed address. This adds an additional layer of security. And more important, it keeps your real inbox free of spam. Use their own tactic. Create a false identity with name, address, profession and country of residence. Stick to that story and make sure not a single bit of it is true. Read more about how to scam bait at 419eater.com. The other point is that scam baiting is a good deed. It keeps the scammers busy and ties up their resources. Resources that otherwise would have been used to scam a real victim and cause real damage. A single scam baiter can’t of course save the world, but they would probably shut down if all of us spent an hour a week scam baiting. And it can be fun so why not? A good scam baiter can be a real pain in the a** for the scammers. Be prepared to get some threats and evil language when they realize what is going on. Consider that as a trophy, a proof that you did it right. Don’t feel bad for them. They did after all contact you with the sole purpose to scam you for money.   Safe scam baiting, Micke   Image: Screenshot from ted.com  

January 28, 2016
BY 
Sean Sullivan

Sean Sullivan says look out for extortion, ad blocking in 2016

This is part of a series of posts about what security experts think will happen in 2016. F-Secure Security Advisor Sean Sullivan spends a lot of his time thinking about how people expose themselves to online risks. Whenever you download an app, click on a link, or open an email, there’s potential security problems that most people never even think about. But not Sean. It’s part of his job to understand how these things actually work, and what people should be doing to keep their devices and data safe from online threats. Here’s a quick look at what security issues Sean thinks people and companies will have to contend with in the upcoming year. “2016 will be remembered as the year of extortion.” Sean’s already predicted that the future of online threats will revolve around extortion. That is, criminals will be investing in scams that see people and businesses paying a “fee” to avoid being victimized by online threats. Ransomware is a well-known example of this trend. It’s malware that locks (either through encryption or other means) people’s devices unless a “ransom” is paid to the perpetrators. “Criminals will continue to figure out ways to extort people and businesses,” said Sean. “The returns we’ve seen extortionists getting on ransomware demonstrates just how profitable the malware sector can be for criminals. Increasing use of social networking tools like Linkedin are also giving online criminals a way to collect data and research potential blackmail targets, and given developments like these, I’m expecting criminal enterprises involving extortion to evolve throughout 2016.” Sean has pointed out in the past that crypto-ransomware, and many other types of online threats, are actually very sophisticated criminal enterprises. They often have a level of service that rivals what legitimate companies offer their customers, making them very profitable for criminals. In fact, the FBI advises ransomware victims to simply pay to have their computers unlocked (but F-Secure Labs has created some useful guidelines that people can follow to remove some police-themed ransomware variants). “We’ll still be talking about ad blocking at this time next year.” Ad blocking became an explosive topic after Apple built content blocking capabilities into iOS 9 earlier in the year. While it seems like a good idea for consumers, ad blocking caused waves after a report pointed out that publishers stand to lose billions due to ad blocking technologies. Publishers that use native advertising, or apps (like Apple News) to push content to their audience, will be largely unaffected. But publications relying on web browsers have become vocal critics of the practice, even though security experts (and even tech journalists) suggest that ad blocking may be in the best interests of consumers. “Ad blocking is going to continue to be an issue because there’s been no real progress on solving the problems that ad blocking is supposed to address,” says Sean. “The problematic connection between online advertising and tracking is still there, so there’s going to be demand for ad blockers until this changes. Plus, malvertising is still a huge security concern that ad blocking can help with, so using these apps is a good way for consumers to minimize online risks and have a better online experience, especially on mobile devices.” “Use of end-to-end encryption will increase in 2016.” Governments have been toying with the idea of asking tech companies to work around encryption to support national security interests. However, many companies and security experts are opposed to this, as encryption allows information to stay safe from criminals and other agents looking to collect information to use for less than altruistic purposes (for example, extortion, discrimination, targeted advertising). End-to-end encryption is one approach to securing digital communications that allows information to be encrypted by the sender and then decrypted by the receiver, which prevents anyone in between those two points (such as the company providing the service or app) from accessing the personal data contained in the messages. Whatsapp and Apple’s Facetime are popular examples of messaging apps that use end-to-end encryption. According to Sean, use of these kinds of apps will increase in 2016, despite pressure for companies to offer weaker encryption to end users. “The security benefits of end-to-end encryption are indisputable, and all the arguments to the contrary are really weak. But the real driver for this will be business, because it’s the best way for companies to provide secure services to users. It’s cheaper and more secure, so it’s a better option for both app developers and users.”

December 18, 2015
BY