First of all, if you haven’t done it yet, please take this quick quiz to find out if you’re smarter than the guy in the video below. (After you complete the quiz, you can enter to win an Xbox 360 and a Kinect.)
Now that took the quiz know how much smarter you are than John, here’s a quick review of why you shouldn’t do anything John does online.
1. Use unique, strong passwords for all of your important accounts.
John uses the same password for every account. That means if a hacker gets a hold of John’s Twitter password, that hacker would have access to every account John uses at work or at home. Creating and remembering unique, strong passwords is a must for your most important accounts. This system for creating and remembering strong passwords makes it easy.
2. Keep your computer’s software patched and protected.
You probably know which operating system you’re running. John doesn’t. He thinks it’s the one with the “windows.” A PC or a Mac running the latest versions of Windows 7 or OS X is probably as safe as any PC since the birth of the virus. However, if your OS and your applications aren’t patched you may be vulnerable to the kind of attacks John has to deal with on a daily if not hourly basis. Checking all of your applications for updates on a regular basis can be time-consuming. Our free Health Check makes it easy.
3. Realize that you’re vulnerable when you’re on an open Wi-Fi network.
When you use an open Wi-Fi network, the data you enter is only encrypted on secure pages, which start with https. Banks and credit card companies encrypt their sites however not all web email is encrypted. If you’ve ever emailed passwords or personal information, it could be accessible to a hacker. On an unsecured Wi-Fi network, you could get sidejacked by someone using a tool like Firesheep. Using the tracking data in your browser, a hacker can easily pretend she or he is you.
If you have to check your email or get on a social network and you only have open Wi-Fi, make sure you are using a secured session.
How to Secure Sessions
A virtual personal network is the best way to defend yourself from any snoopers. Most large companies insist on their employees using a VPN while doing any business over a wireless network. That’s a strategy John would never follow, but you should, especially if you make purchases or work with confidential information while on public Wi-Fi. Here are some strong VPN options for you to consider.
If you use Firefox, you can use HTTPS Everywhere by The Tor Project and the Electronic Frontier Foundation, which will encrypt your communications on several major websites.
You can secure any Twitter session by typing in an “s” after the http in the browser bar. If you click here, you’ll go to https://twitter.com and session will remain secure until you log out.
This feature is still being rolled out to some users. And it is not entirely secure.
You can activate secured browsing by logging in. Then go to Account> Account Settings> Under “Account Security”, check the box for “Browse Facebook on a secure connection (https) whenever possible”.
PLEASE NOTE: If you use an app, any Facebook app, you’ll get this warning:
PLEASE NOTE: If you use an app, any Facebook app, you’ll get a warning that you are now entering unsecured browsing.
If you continue on to unsecured browsing, your session is not unsecured and you are now vulnerable to a sidejacking attack. You will have to return to the same setting when you are done with the app to enable secured browsing again.
John was recently sidejacked by a friend who posted a hilarious Photoshop of John in the bathtub. Too bad it happened on a day when the HR department of a company that was about to hire John checked out his profile.
Login and go to the “Options” wheel in the uppermost right corner.
Select “Mail settings”.
Under “Browser connection”, select “Always use https”.
Go to https://account.live.com/ManageSSL and login if you have to.
Select “Use HTTPS automatically (please see the note above)”. And check out the note for the exceptions, of course.
4. Check to make sure a site is legitimate and secure before you make a purchase.
John will buy anything from any site. He bought his Snuggie from a website that had more pop-ups than the old AOL. Don’t be like John. Stick to online stores with good reputations. When you try out a new retailer, do a quick search for customer feedback. If you are still unsure, save yourself the trouble and money. Even if you trust a site, always check the URL of the page for two things before submitting your credit card number: 1) Is it a secured https page that will encrypt your information? 2) Am I really on the site I meant to be on? Try to use one credit card for all your online shopping and check the activity on that account often. Check out these safe shopping tips.
5. Don’t be afraid to reject or ignore a Facebook friend request.
On Facebook, wrong click and you could end up spamming your friends with something that will definitely waste their time and possibly your money. The best way to avoid becoming a victim or perpetrator of spam is to eliminate spam from your news feed. This requires you only friending people who are careful where they click. John, of course, lets spammers go on spamming as he adds more and more friends. You, however, should be careful who you add. If a friend shares some spam, inform them in a friendly way that they may have made a mistake. If it keeps happening, unfriend her or him.
Something else to remember: If you wouldn’t tell someone in person that you’re going to be out of town, don’t use Facebook to do so. If your Privacy Settings are set to “Friends of Friends”, you could be sharing your travel plans with thousands of people when you post them on Facebook. Before you post anything, ask yourself, “Would I be okay if all the friends of my friends’ friends knew this?” If your friends are anything like the average Facebook user, you could be thinking about more than a million people. (The average Facebook user has 120 friends. 120 X 120 X 120 = 1,728,000 friends you could be sharing with.)
6. Never use a password that is in the dictionary or could be guessed by a friend.
We’re back to passwords again because they can tend to be a weak link in many users’ security. And this weak link can be easily strengthened. The number of people who use “password” or their first name to secure their accounts is mind-blowing. Even John wouldn’t be that silly. It’s just as silly to use any word in the dictionary. Why? Because when a hacker uses a program to figure out your password, what do you think it tries first? Your passwords have to be unique and complex. They should also not be anything that could be guessed by a friend. If someone you know can guess your password, a stranger might be able to do the same thing by studying your Facebook profile.
7. Keep an eye out for Phishing Scams, even when you’re on your phone.
A Phishing Scam is a sneaky attempt to get you to turn over your financial data to criminals. That’s right crooks have found that Internet users, like John, will occasionally just hand over the account information needed to commit credit card fraud. All they do have to do is pretend to be a trustworthy site with official looking graphics and people fill in the forms and click submit. The best way to avoid Phishing scams is to check the URL of the webpage you are on to make certain it is on the domain of the bank or institution you think it is. Also, be skeptical of any email that contacts you asking you to change your password. If you’re ever in doubt, contact the institution directly. All of your accounts have values to a scammer, so keep in mind that you can even be phished for your Facebook account—and even when you’re on your phone. That’s why our Mobile Security blocks such scams.
8. Password protect your Wi-Fi network.
There’s plenty of good reasons to secure your home Wi-Fi network. You don’t want your neighbors to have access to private info. You don’t want strangers to slow down the connection you’re paying for. You don’t want people to use your connection to take part in illegal activities. The only reason to leave it open is if you want to give someone like John access to your digital life. Here’s how to set up a security key for your wireless network.
9. Don’t open strange email attachments (without scanning them).
The first computer security rule you probably learned was “Don’t open email attachments from strangers.” This is still true—even though John forgot it long ago. In fact, targeted attacks that use social engineering and profile their victims are becoming more advanced all the time. You should still refuse to open any attachment that you were not expecting. If you feel you must open an attachment, download it to you PC and scan it with your Internet security software first. Here’s more on how to deal with email attachments.
10. Don’t expect anyone else to protect your privacy.
Do you blame your telephone when you use it to tell someone something you shouldn’t? Then you can’t only blame Facebook when you post information that may cause you trouble. Even when you use the privacy settings correctly and keep your account under control, your information is only as secure as the people you share it with. If you need to share any information that could cause you trouble at work or could be used to answer your security questions, use private messages, email or even that old-fashion marvel the telephone. And never, under any circumstances, shout your password in public through a megaphone. John still hasn’t learned that one yet.
Which of these tips is most important? Which is John least likely to follow? Let us know in the comments.
The first known use of the term "trick or treat" was found in a November 1927 edition of Blackie, Alberta's Canada Herald: Hallowe’en provided an opportunity for real strenuous fun. No real damage was done except to the temper of some who had to hunt for wagon wheels, gates, wagons, barrels, etc., much of which decorated the front street. The youthful tormentors were at back door and front demanding edible plunder by the word “trick or treat” to which the inmates gladly responded and sent the robbers away rejoicing. "No real damage" from "youthful tormentors?" Sounds a lot like the early days of hacking. Unfortunately those days are long over. “It’s a business,” F-Secure's Chief Research Officer Mikko Hyppönen told Wired UK. “There’s a whole structure there that’s needed,” F-Secure's "Cyber Gandalf" Andy Patel told ITPRO. “An individual can’t just go in and do this now; it’s not a one man job… these are companies.” The cyber crime "industry" has raked in hundreds of millions and possibly even billions of dollars. And it does it, in general, by counting on people to make mistakes. “People do stupid stuff,” Mikko explained. “You cannot patch people.” The first step to avoiding a threat is knowing it exists. So this Halloween as you search for treats online, look out for these tricks. Ransomware F-Secure Labs has warned about malware that holds your digital files hostage to demand a ransom for most of the last decade. But it's in the last year that the threat has burst into the mainstream and become something you can't go a few weeks without hearing about it on the news. How do you avoid this trick? Keep your system software updated and run security software at all times. Make regular backups of every file that matters on your computer and never click on attachments and links in emails that you weren't expecting. Find My iPhone Scam This scam answers the question, "How can losing your iPhone get any worse?" People who use the "Find My iPhone" app have been targeted by criminals who've gotten ahold of their phones with a scam that allows the crooks to gain access to the device and -- possibly -- the owner's most intimate financial details. How do you avoid this? Check the URL before entering any confidential data. Or as Apple says, "You should never enter your Apple account information on any non-Apple website." Phishing Scams As cyber criminals have gone pro, they've gotten better at using old tactics that we thought had faded away -- like email attachments and phishing scams. Like the trick that gives crooks access to stolen iPhones, a phishing scam just tricks you into entering your private credentials into the wrong site. And it then uses those credentials to hack your email, financial accounts, etc. Checking URLs before entering data is crucial because with the explosion of photo editing software and skills, it's now easier than ever to make a fake site look real. Experts believe that one wrong click to a fake site led the chair of a major presidential campaign to expose his entire inbox to the world. Having someone else leak your password Millions and millions of passwords have been leaked in 2016, some from breaches of data that took place years ago. It might not sound scary that your Yahoo! password from 2005 is now public, except if you are still using that password today on a critical account. This is why you need to use strong, unique password for each important account. Yes, remembering all that is almost impossible. So consider using a tool like F-Secure's KEY to manage your passwords. KEY is free to use on one device. Haunted IoT devices As our homes are getting smarter by connecting almost everything to the internet, they're also getting haunted -- by cyber criminals. A botnet is a network of computers that have been hacked and "enslaved." Security expert Brian Krebs was recently hit by a monster attack on his site that he believes was powered by a botnet powered by "'Internet of Things,” (IoT) devices — routers, IP cameras and digital video recorders (DVRs) that are exposed to the Internet and protected with weak or hard-coded passwords." What can you do? So much of this problem requires manufacturers to improve their security. But you can help by keeping every device updated with the latest software from the manufacturer and always changing your default passwords. [Image by Daniel Lewis | Flickr]
When he was still working in cyber security for the Finnish government, Erka Koivunen met a NATO diplomat that there was "nothing new" about the era we now live in. Foreign envoys have always lived with the constant awareness that their private communications could be "leaked" for their enemies to exploit. "Anything that was written down could eventually be discovered," Erka, who is now an F-Secure Cyber Security Advisor, told me. "So the most sensitive conversations never took place in writing." Given the massive email leaks that have now hit the worlds of business, with the Sony hacks, and politics, with the leaks of U.S. political figures, is this how we should all start thinking? Does everyone alive in the twenty-first century have to operate like a NATO diplomat? Or a C-level executive who knows any word she types could be subpoenaed? Or the campaign chair of a presidential campaign? The answer, unfortunately, seems to be increasingly clear. "Whatever you write, you may need to defend your position in public," Erka said. Relying on an insecure medium The problems with email begin with the general insecurity of it as a means of communication. It's more like sending a postcard than sending a sealed letter, Erka explains. "As soon as the message goes out of your or your company’s systems, you lose control of it," Erka explained. "This is by far the biggest problem of the good-ole-email. Messages can be eavesdropped, altered, delayed, replayed or dropped altogether without you ever knowing." To actually spy on email as it's being transmitted generally requires legal access to telecommunications infrastructure or extraordinary technical knowhow and resources. Think law enforcement or intelligence agencies. Since these groups have a vested interest in cloaking their activities, they had little incentive to engage in the massive sort of leaking of gigabytes of private data we've seen from Wikileaks. However, we appear to be at the end of the era of "the gentleman's agreement" between countries, as cyber policy expert Mara Tam explained on a recent episode of the Risky.Biz podcast. This agreement went something like: "Gentlemen read each other's email, but they don't leak it to the public." The leaks from former CIA contractor Edward Snowden helped make the public aware of how much information the government potentially could access. But the exposure of a private individual's digital communication to the world presents a stark new reality for anyone who conducts business online. "Personal mailboxes store gigabytes’ worth of conversation history that will be a treasure trove for attackers for multiple reasons," Erka said. "There are sensitive discussions about business strategy, customers, competitors, products. There is also internal gossip, badmouthing and other damaging stuff." Activist Naomi Klein told The Intercept that "this sort of indiscriminate dump is precisely what Snowden was trying to protect us from." And we don't yet have a full sense of the potential ways this mass of data can be used against us. A competitor could use private information to tarnish someone’s reputation and hackers can mine the data to prepare for future cyber intrusions or to gain access to your other accounts through password resets. Letting the public decide what's private Leaks have already cost some executives their jobs and could swing the U.S. presidential election. But in a sense, we're all victims of this new risk to all of our privacy. "Whatever you write in an email you have to consider, are you ready for your boss, your spouse, your business partners to read it?" Erka asked. This new reality leads inevitably to the tragedy of self-censorship. Zeynep Tufekci -- a "techno-sociologist" -- has been doing a running commentary on the Wikileaks revelations and is very disturbed by what she's seeing. "People gossiping in internal conversation is not a scandal—but destroying public/private boundaries will paralyze dissent, not the powerful," she tweeted. Wikileaks is releasing more documents than it could ever sift through in the hopes that the newsworthy information will be discerned by interested researchers around the world. But along with potentially relevant items, intensely private information has been revealed. "For example, a suicide attempt was publicized through Podesta indiscriminate dump (Wikileaks tweeted it out)," she noted. "Who will want to be political?" This makes the loss of email seem dire, but perhaps it speaks to a not just a flaw in the medium's security but the medium itself. "The deeper problem with email is that it has never quite settled on a social mode," The New York Times Farhad Manjoo wrote. "An email can be as formal as a legal letter or as tossed off as drive-by insult. This invites confusion." What can you do? So, should you be like that NATO diplomat content to keep all of your deepest secrets out of writing? Can you expect yourself to remove all snark and potentially offensive thoughts from your emails? Should you assume that your email box is like a box of letters in your attic, vulnerable to anyone who can get access to it? These answers are ultimately up to you and how you use -- or don't use -- email. F-Secure security advisor Sean Sullivan has found that young people he's interviewed are increasingly abandoning email as communication tool. "They only have an account -- typically Gmail -- in order to sign up for stuff," he said. If this continues, email is on its way out, whether it's private or not. For now, lawyers, doctors and other professionals with explicit legal responsibilities, email has a much more defined role that cannot be easily abandoned or circumvented. As far as your work email goes, consult your IT staff for guidance as you may be under legal obligation to preserve your data. But for your personal email, Erka suggests you have to at least be aware of how likely you are to be a target and what you can do to contain any potential damage -- besides using a strong unique password for every email account you have and only entering your account information on the secure webpage of your email provider. If you are involved in international politics, for instance, there's no question. You are a target. Hackers are either after your emails or are trying to get access to powerful people in your contacts. If you're someone with no power, no tumultuous relationships and no interest in politics, you're likely not to be on anyone's radar... yet. The problem is no one knows where you'll be in a few years and our inboxes are big enough to last a lifetime. "When everyone is using cloud-based emails like Gmail, there's no need to save space," Erka said. "That's the whole selling point of those services: Never delete anything." If you see the potential for enough damage, you many want these recent leaks as an inspiration to launch a serious spring cleaning of your personal online inboxes, including email and social media. "You may want to delete the messages you don't need and sort the stuff you do want into folders that you take off the web and can store on a secure backup," Erka suggested. Yes, you will lose the convenience of being able to search your Gmail box through a simple interface, but so will potential hackers. He also recommends sharing documents through sharing platforms and cloud services such as Sharepoint, Salesforce or Dropbox. "These links can require separate authentication upon opening and the sender can control how long it will be valid," Erka said. "If the email gets stolen and leaked years later the chances are the link will be invalid by that time." For quick conversations, Sean suggests Wickr, which offers self-destructing messages through a mobile app or a desktop client with easy encryption, something that just doesn't exist for most email. "For professionals, Wickr has a paid service which will retain messages for a legal requirement, and will then securely delete them post-requirement," he said. Regardless of policy, employers have a vested interest in moving their staff away from an over-reliance on email for more than privacy reasons. "Actual phone calls and face-to-face discussions that get out of your chair are probably more useful than email or chat threats," Sean said. "So rather than swap from one to the other – just learn to better utilize what you work with best." These leaks offer a sobering reminder that email is not secure. But, perhaps, the more important message is that it as a means of communication, it was never very smart. [Image by Alan Levine |Flickr]
Cyber security is playing an starring role in the drama surrounding the question of who will be the next president of the United States. "The security aspect of cyber is very, very tough," Republican nominee for president Donald Trump said, when asked about securing American secrets from cyber attacks during the first debate. "And maybe it’s hardly do-able." Even the integrity of the election has been put into doubt by the threat of hacking -- which may be exactly the point. The questions about cyber intrusions into the electoral system and the wild speculations those intrusions provoke can be hard to put in perspective. So here are five basic premises to help you assess the situation as this historic election transpires. It would be almost impossible to hack the entire U.S. election. The biggest reason this U.S. presidential election is unhackable is that most of it doesn't depend on computers. More than three out of four Americans will vote on a paper ballot this November 8, Techcrunch's Ben Dickson reports. And the fact that all Americans don't vote in the same manner points to the biggest reason you probably couldn't hack the election. Each state has its own system, with some federal guidance. Nearly every state lacks sufficient funding to fully upgrade their systems, hence the reliance on outdated technology. So while voting machines are definitely vulnerable to hacking, hitting just the right ones in a systematic way that just happens to sway the electoral college vote in favor of one candidate would involve both a massive investment of time and money and an even larger serving of luck. But that doesn't mean an election can't be "hacked." “To ‘hack’ a US presidential election, all you need to do is to obviously tamper with one county’s system, then leak that the tampering occurred,” our security advisor Sean Sullivan told Dickson. “Many people will rush to assume that all of the other typical issues that occur may also be the result of hacking — and thus, you’ll end up delegitimizing all of the results.” A delegitimized election equals a delegitimized winner. You don't even have to hack an election to hack an election. The hacks of the Democratic National Committee and Hillary Clinton's campaign chair John Podesta could end up being far more consequential in swaying the election than hacking either voting processes or actual vote counts -- especially if the resulting leaks end up revealing something extraordinarily damaging to the candidate in the documents being dripped out by Wikileaks. “Owning an election is gold; being able to influence it is silver; knowing the outcome in advance is bronze,” F-Secure cyber security advisor Erka a Koivunen explained. It's pretty clear that someone is at least after the silver in this election. Someone has definitely poking around in the U.S. election system. The United States has been clear that it believes that Russia is trying to hack this election. This month U.S. officials have explicitly stated that the Russians are behind the hack of a contractor that works on the electoral system of the key swing state of Florida. Similar hacks were reported by the states of Arizona and Illinois. U.S. intelligence also believes Russia is behind the hack of Podesta's emails and a security firm believes it found evidence that the nation led by President Vladmir Putin was behind the hack of the DNC. Russian Foreign Minister Sergei Lavrov told CNN that the accusation that it was behind the Podesta hack "flattering." When pressed to confirm or deny his nation's involvement, Lavrov said, “No, we did not deny this, they did not prove it." Trump himself questioned whether the hack actually happened in the second debate and if he's concerned about Russian hacking, he doesn't seem to be showing it. At one point he even -- jokingly, he said later -- asked Russia to hack his opponent's missing emails. Election technology needs to improve quickly. It's safe to say that no matter who is hacking the U.S. elections, the U.S. is probably hacking them, too. The richest nation on Earth is just not engaging, as far as most people can tell, in the leaks that have followed the recent U.S. hacks. In this new era of cyber attacks backed by nation-states or "privateers" employed by nation-states the rules of cyber espionage are unclear and the fog is thick. No matter what happens in 2016, digital technology will play ever-increasing role in both campaigns and election, and the U.S. needs to take steps to ensure the integrity of its elections. Sullivan believes that the Department of Homeland Security should go through with its proposal to declare voting system critical infrastructure and then adapt its defenses to catch up with the threats. “Network monitoring is rapidly becoming a requirement,” he told Techcrunch's Dickson. And voting must be made to feel at least as secure as using your credit card to buy a coffee. “Smartcard technologies are available in several European countries for online identity authentication,” Sullivan said. “They aren’t widely used. If a country such as the United States were to get serious about rolling out such tech, it would be a game changer.” All of this focus on the security of election systems means that there are “more people checking stuff.” The question now is who is putting in more resources -- the attackers or the people doing the checking. [Image by Maryland GovPics | Flickr]