The Cybersafe Alert

CyberSafe Alert 2020 Edition 1

noreply@blogger.com (Cybersafe) — Tue, 10 Mar 2020 03:51:00 +0000

Covid 19 - Is Your Company Keeping Safe?

You can barely switch on the TV, open a newspaper, browse the internet, or strike up a conversation these days without the subject of the new coronavirus Covid 19 coming up.One of side effects of the virus has been to force businesses all over the world to ask their staff to work remotely instead of coming into the office.

In this edition of the CyberSafe alert we focus on flex work and the risks to SMEs when your workers are working in public spaces

Large companies with big technology budgets are able to afford a lot of the protective software, as well as the staff to manage I.T security. A luxury that all too often SMEs don’t have. But you don’t have to have a huge budget to keep your company safe while staff work remotely. There are ways to protect your business effectively without breaking the bank. This is one of the main reasons the Cybersafe book was written. In the book you’ll find more details about ways to protect your business when staff work remotely, in the meantime, here are some easy to implement tips:

Make sure all your computers have firewalls, and just as importantly, that they are turned on!
Protect your computers with a good security suite. There are very effective suites from BitDefender, Macafee, and Kaspersky that can protect multiple devices for less the USD100
If you are using Macs or iPhones, make sure that the find my mac functionality is switched on. This will allow you to track Some P.C’s also have this functionality. If your devices don’t have this functionality, the security suites mentioned in the bullet point above usually will
If you’re unable to locate your device, you can use one of the options above to either lock the device, or remote wipe the data. If you’ve been following the advice in Cybersafe, wiping your device won’t be a problem because you’ve already backed up your data. And you have insurance for loss of your device - right?
Never log on to anything that says free wi-fi. Those hotspots are notorious
If you use public wi-fi, always use a VPN. If a VPN is not provided with the security suites mentioned above, there are some great standalone VPNs like Express VPN that you can install on your companies devices without spending a huge amount of money.
Last but definitely not least, in case the worst does happen and someone is careless with one of your company devices, make sure that you have a good cyber insurance policy

Hopefully you’re keeping safe from the Covid 19 virus. If you follow the advice in this Cybersafe alert, you’ll also be keeping your business safe from the one of the unexpected side effects of it as well.

Following the advice in CyberSafe should go a long way to keeping you safe online. As we like to say at the CyberSafe alert - Don’t Be Scared; Be Prepared.

Don’t forget to share this important information with someone you care about, and if you're quick, you can get 20% off the Cybersafe book for a limited time by clicking this link - https://gum.co/qYxJM and using the code cybersafewfh

Are you new to the cybersafe alert? If so you’ve missed out on some great information to keep you, your family, and business safe online. Here’s what you have missed so far:

Want a regular briefing about the newest Cyber threats? Subscribe to the Cybersafe Alert now!

If you can't wait for the next CyberSafe Alert to tell you how to protect yourself online, get CyberSafe the book. It's packed with the useful information and strategies you need to keep yourself, your family, and your business safe online.

Disclaimer

Every effort has been made to ensure that the content provided in this post is accurate and helpful for our readers. However, this is not an exhaustive treatment of the subjects. No liability is assumed for losses or damages due to the information provided. You are responsible for your own choices, actions, and results.

CyberSafe Alert 2019 Edition 10

noreply@blogger.com (Cybersafe) — Tue, 10 Dec 2019 05:06:00 +0000

What will Santa’s little hackers bring you for Christmas?

‘Twas the day after Christmas when all through the house, Not a creature was stirring, not even a mouse...

But the hackers were watching, and listening, and stealing, because of all the brand new internet connected gadgets, toys, and appliances that had been bought for Christmas presents.

In this edition of the CyberSafe alert we’ll talk about something that not many people stop and think about amid the excitement of the Christmas holidays, and that’s how much you’re exposing yourself to cyberattacks through the presents you buy for yourself and your loved ones.

There are too many ways you can suffer a cyber attack to cover in a CyberSafe alert, so I’ll focus on some of the main ones. If you want to find even more ways to protect yourself online this Christmas you can always read the Cybersafe book.

Don’t get your data pocket picked while shopping

During this silly shopping season, millions of us are shopping online to fill our loved ones gift sacks. But did you know that at the same time, you are filling the online retailers' sacks full of interesting tidbits of data about you and your spending habits?

Let me tell you a little bit about how they may be collecting data on you. As well as the usual data collected from you when you make a purchase on their sites, some retailers are also using tools that can track your browsing histories to see what pages you are visiting. If you visited their competitor, they know about it. This is not necessarily illegal, but how is it possible? Well. millions of people around the world opt-in to (at least so they think) anonymously share their web browsing history. This can be done with seemingly innocent things like browser extensions you’ve installed that note in their terms of service (read the small print) that they may share user data with third-parties.

At this point, you may be asking yourself: So, what’s the big deal? Isn’t this how all cookie tracking works? Well, yes and no.

Some tools that retailers use can show third-parties all the URL's a user has visited, and some of those URLs can lead to non-password-protected pages a regular user browsing the internet wouldn’t be able to find. These could be things like order confirmation pages, private PDF attachments, and other pages intended for that specific user’s eyes that sometimes aren’t protected by a login screen, but instead, are “blocked” by a set of “tokens” or a series of characters that would be difficult to guess.

The use of these tools has already lead to the unintentional sharing of sensitive data, including:

Home and business surveillance videos hosted on Nest or other security platforms
Information on recently purchased vehicles, including the vehicle identification number, and the name and address of the buyer
Sensitive documents posted on Microsoft OneDrive and other cloud-based business platforms, like tax returns, business documents, billing invoices, and presentation slides
Patient names, doctors they visited, and other details surrounding their appointment cloud-based patient care platforms
Travel itineraries on Priceline, Booking.com, and other airline services

Even in cases where the page was password-protected, sometimes the URL and page title gave away enough information to give context into private data. The kinds of protected data exposed included:

URLs referencing car dealership subdomains that aren’t reachable by the outside Internet. Sometimes, the URLs or page titles included vehicle identification numbers of specific cars that were experiencing issues—or they discussed vehicle products or features that had not yet been made public
Internal URLs for pharmaceutical companies like Amgen, Merck, Pfizer, and Roche; health providers AthenaHealth and Epic Systems; security companies like FireEye, Symantec, Palo Alto Networks, and Trend Micro
URLs for JIRA, a project management service provided by Atlassian, that showed Blue Origin (Jeff Bezos’ aerospace manufacturer and sub-orbital spaceflight services company), discussing a competitor and the failure of speed sensors, calibration equipment, and manifolds

Advice for SMEs

Many companies (one hopes) make an effort to keep their website hacker-free, but the examples above demonstrate a big loophole that may have been previously unknown. So as a small business, here are some things you can do to protect yourself and your customers:

Make sure that you are password-protecting any pages that contain any information that you don’t want accessible by the public. This includes order confirmations, attachments, or anything else not intended for general visitors to find.
If you have password protected pages, ensure that URL path and page titles are just as secure. Even if a link expires after a certain amount of time, it can still leave private data vulnerable.
Take a look at your website pixels, employee browser extensions, or anything else that could result in unwanted data sharing.

It’s Child's Play

Now that you’ve navigated the jungle of e-commerce and bought your little angel a brand new toy, you should also be aware of the cyber risks that can come with it. If you’ve gone the analogue route, you’re in the clear - woohoo. If you haven’t, and your child's toy can connect to the internet (you’d be surprised at how many can!) then you should take a few precautions to protect you and your child.

Now some security experts say the only way to prevent a hack is to not keep the toy. We say bah humbug, it’s Christmas and you don’t want to be scrooge so if you decide to let your kids unwrap play with it, here are some ways to reduce the risks:

Research, research, research

Before opening a toy (and if you’re buying it yourself, then before you buy the toy), search for it online and read reviews to see if there are any complaints or past security problems. If there have been previous issues, you may want to rethink keeping it.

Reputable companies will explain how information is collected from the toy or device, how that data is stored, and who has access to it. Usually that type of information is found on the company’s website under its privacy policy. If you can’t find it, call the company. If there isn’t a policy, that’s a red flag. My advice would be not to use it. You should also be aware that companies can change their privacy policies, so read them again if you’re notified of a change.

Use secure Wi-Fi

Make sure the Wi-Fi the toy will be connected to is secure and has a hard-to-guess password. if the toy itself allows you to create a password, do it. Don’t settle for the default password as not only can they be easy to guess, but there are plenty of sites like this one - https://proprivacy.com/guides/default-router-login-details - in the public domain that will have details of the default password.

Power it off

When the toy is not being used, shut it off or unplug it so it stops collecting data. If the toy has a camera, face it toward a wall or cover it with a piece of tape when it’s not being used. Toys with microphones can be thrown in a chest or drawer where it’s harder to hear conversations.

Register, but don’t give away info

With some toys, you may be asked to register so you can receive software or firmware updates over the web. You absolutely should do this, as a software update may fix security flaws that have been discovered. But, when you do register, keep the information you supply to the bare minimum required. If the registration requires personal information you’d rather not give, such as your child’s birthday, make one up. You’re not under oath!

Be vigilant

If the toy allows kids to chat with other people playing with the same toy or game, explain to your child that they shouldn’t give out personal information.

Reputable companies that make toys with microphones will offer ways for parents to review and delete stored information. Make sure you take advantage of that.

Report breaches

If a toy was compromised by a hacker, the FBI recommends reporting it online through its internet crime complaint center at IC3.gov. You can also use this site to check on any breaches with your particular toy.

Something for the Grown ups

It’s not just the kids that need to be wary though. After all, Christmas is for adults as well, and after a few egg nogs too many, you may be feeling a bit frisky. The kids have been put to bed (or maybe you don’t have kids to worry about), and it’s time for the adults to unwrap their presents. Well, the adult industry is never one to be left behind, and they're now playing catchup in the cyber/Internet of Things space as well. Once upon a time, you could rely on your favourite sex toy to be a discreet, standalone pleasure to be enjoyed solely in the privacy of your own home. With the coming stampede of internet connected intimate adult accessories, that privacy is being challenged. Because adult toy manufacturers are coming in relatively late to the online arena, most sex tech devices and associated software are awful from a privacy, and often security, perspective. They collect too much sensitive data, such as who you’re having sex with, and aren’t doing enough to protect it. Lots of them don’t even use basic security to encrypt communications.

One adult toymaker recently had to pay a settlement of £3 million, to its customers, after it was revealed the company’s connected vibrator collected sensitive user data, including when they were used, vibration settings, and more, linking it all to user email addresses.

On the security side, researchers have revealed connected sex toys are easy to hack, making that data collection all the more problematic. But it’s not only hacked or leaked information that is an issue. A larger one is that if the infrastructure is hacked, then attackers could manipulate partner match ups, and someone else might be controlling devices that you and your partner use! And if your connected adult toy also comes with a camera, well I don’t need to go into detail about that scenario...

Are you the watcher or are you being watched?

Once you’ve overdosed on festive food and drink, opened your presents and had your Christmas fun, you’re probably going to want to put your feet up in front of the TV. So here’s the thing. Is it your new Smart TV purchase that you’ve made? Have you connected it to the internet? If so, you may want to take a few precautions before you get too comfortable.

Like anything that connects to the internet, smart TVs are susceptible to the usual online security vulnerabilities, including hackers. Similar to the adult toys mentioned earlier, because smart TVs are a relatively new concept, manufacturers have not caught up with the levels of digital security as devices such as computers for example. This security flaw could potentially give hackers a gateway into your home. For example, a hacker may not be able to access your (if you’ve been following the advice in Cybersafe) securely locked down computer, but they may be able to find a backdoor through to your router through your unsecured smart TV. Infact there have been documented examples of hackers gaining access to Google Chromecast sticks and streaming random content to unsuspecting viewers. Other jolly japes a hacker might indulge in on your smart TV include cranking the volume up and down, knocking your TV off the Wi-Fi network, quickly changing channels, or forcing your TV to play questionable YouTube content.

While hackers are potentially an issue, hacking smart TVs still takes a bit of know-how and is illegal so that dissuades most casual hackers. What is arguably a bigger issue is the perfectly legal (so far) tracking of your data collected by smart TV manufacturers. Smart TVs use a technology known as automated content recognition (ACR) to constantly track what you are watching and then relaying it back to the manufacturer and/or its business partners.

ACR helps the TV recommend other shows you might enjoy watching but can also be used to target your families with advertising. The data can also be combined with other aspects of your personal information to help build profiles on your behavior that are sold to other marketers. If you read the Cybersafe alert on doxxing, you’ll recognise this as one of the ways doxxers can get hold of your data.

So what are some ways that you can improve the digital security around your smart TV? Well, options include placing black tape over an unused smart TV camera, and following the usual advice in Cybersafe, which is to keep your smart TV up-to-date with the latest patches and fixes, and to read the privacy policy to better understand what your smart TV is capable of.

While it may be inconvenient for most users, and possibly negate the main reason for buying a smart TV, the most secure smart TV is one that isn’t connected to the internet at all.

I hope this Cybersafe alert hasn’t ruined your Christmas and has instead (as intended) made it a (digitally) safe and secure one instead for you and your loved ones.

Following the advice in CyberSafe should go a long way to keeping you safe online. As we like to say at the CyberSafe alert - Don’t Be Scared; Be Prepared.

Don’t forget to share this important information with someone you care about.

Are you new to the cybersafe alert? If so you’ve missed out on some great information to keep you and your family and business safe online. Here’s what you have missed so far this year:

Edition 1 - Are your toys spying on you?
Edition 2 - The unhackable password
Edition 3 - Is It Safe To Hit 'Send' Now?
Edition 4 - WhatsApp Hacked!? Here's What To Do About It
Edition 5 - Is the new “Sign in with Apple” button a game changer?
Edition 6 - Why your personal calls are not personal anymore
Edition 7 - Has your wallet been hacked?
Edition 8 - Your personal data may have been breached - Take action now!
Edition 9 - Have you been Doxxed? What it is and how do you avoid it?

Want a regular briefing about the newest Cyber threats? Subscribe to the Cybersafe Alert now!

Disclaimer

CyberSafe Alert 2019 Edition 9

noreply@blogger.com (Cybersafe) — Fri, 15 Nov 2019 14:50:00 +0000

Have you been Doxxed? What it is and how do you avoid it

There have been a lot of headlines recently about Doxxing (no, not boxing, although there have been a few headlines about that as well). So to enlighten you about what it means and how you may be at risk, In this edition of the CyberSafe alert you’ll find out what doxxing is, and how to avoid falling victim to it.

Click HERE to Tweet this

So what exactly is doxxing?

Doxxing (also written as “doxing”) has been around in the hacker community since the 1990s, but recently it has emerged generally to become a threat to anyone who uses the internet. In the early years of doxxing, hackers would dox a rival out of spite. In these cases, the doxxing focused on identifying the hacker and their misdeeds then turning those details over to the authorities to get them arrested.

The term “doxxing” itself comes from a hacker word for “documents.” “Documents” became “docs” and then “dox.” When you “dox” someone, you are documenting their personal information. The important pieces of information you can find out are a person’s social security number, their address, telephone number, email address, social media profile names, place of work, details of relatives, partners and children, and so on.

Doxing isn’t usually illegal, though it does violate many sites’ terms of service and may result in a ban. Depending on your jurisdiction, it may also be illegal under laws designed to fight stalking, harassment, threats, etc.

How does it work?

Doxxing involves researching the details of people’s lives, usually with the purpose of embarrassing the victim, to draw criticism towards them, or to cause them physical harm.

Some doxxing attacks lead to a mass campaign of public shaming, or harassment, as seen in Hong Kong during recent protests when police officers accused of brutality were doxxed.

Mob attacks launched by doxxers also include prank phone calls, overwhelming amounts of abusive email, network-swamping quantities of text messages and even physical attacks on the individual. The effects can cause people to lose their jobs, their families, their homes, and in some extreme cases, even their lives. Targets of major doxxing attacks have been forced into hiding and have had to delete all of their online accounts and change their identities. In other words, doxxing takes cyberbullying to the next level.

Where do doxxers get the information from?

Social media profiles that are open to the public are goldmines of data. While a lot of information can be gleaned from social media and other forums that you post to, there are also some public sources of information that doxxers can also get your information from. Listed below are three of the most common ones.

Data brokers

Many places on the web hold your personal information. Businesses (commonly known as data brokers) profit from storing, collating and in some instances sharing and selling your information. They buy customer lists from other businesses that you would have given your data to. So, for example, if you buy a car, the dealership may put you on a list that they sell to a data broker, unless you have asked them not to.

If you fill in a survey about your favorite soap or enter an online competition you may be inadvertently giving the company the right to store and/or sell the information that you put on the form, unless you opt-out. Selling your information is often a way to help pay for the prize that they offer you.

Once this information is in the hands of data brokers, although they may not deliberately leak it (it does impact their bottom line after all if it’s available for free!), hackers may target them and steal data in bulk.

WHOIS

If you run your own website, or you have a website for your business, the registration information that you filled in to get that domain name is made public to all the world through the WHOIS database.

IP address

Every connection you make on the internet has to carry your internet address on it. This is called an IP address. Doxxers can use an IP logger to trace your online activities and expose your identity by combining it with searches on membership of certain sites.

How to protect yourself against doxxing

The practice of doxxing is on the increase so you need to be cautious about the information that you make available online. Regular readers of the Cybersafe Alert know that we don’t just provide the alert, but actionable steps to help you protect yourself. This issue is no different, so keep reading to find out what you can do to prevent, or at least make it harder to be doxxed.

As with many things on the internet, getting complete protection can be prohibitively expensive and complicated. However, there are ways you can make it much more difficult for you to be doxxed. If you are concerned about doxxing, here are some of the steps you can take to avoid it.

Social media

The more you write on forums and message boards, the higher your chances become of accidentally revealing personal information about you.

If you’ve read the Cybersafe book, you’ll know that there are so many different ways we give away far too much information on social media. Not checking privacy settings, accepting friend requests from anyone just to boost our followers, the list goes on. Suffice to say, some simple advice is to only allow people that you know very well to be your friends on Facebook. Also consider changing your privacy settings so that only friends can see your posts.

Avoid posting details about where you work, or where your children go to school. My personal opinion is that you shouldn’t put any identifying information about your kids on social media at all. After all, they haven’t consented to it, and that information will be a permanent record on the internet when they grow up. Although it’s great posting your fun family moments on social media, it is safer to enforce a policy of not posting photos of your children, and ask anyone else who takes pictures of them at events not to post them online. If you absolutely must post, make the photos as anonymous as possible. I.e. no face shots, names, or identifying locations.

Protect your internet communications

This one’s an easy one to write. If you must use public Wi-Fi, use a VPN! Nuff said, and readers of Cybersafe will be very familiar with the whys and wherefores of this advice.

Protect the data on your computer

Stop hackers from stealing your personal information by installing anti-malware. There are lots of good packages on the market, and these are just as important as the firewall on your computer.

Remove your personal data from your software you install

A lot of times we innocently add personal data into the software we use. Sometimes just for convenience. For example in the properties of Microsoft Office products you can include your name on the documents. This means that every document that goes out from you will have your name (and any other information you’ve added) embedded in it.

You should also check out the settings your gadgets. Is your personal information stored on your camera, your webcam, your set top box or your gaming consoles? Do you allow your camera to store location and other metadata that could be exposed?

Protect your email identity

If you need to sign up to websites and are not sure of their privacy policies, or you don’t want to use your usual email address to sign up to them, then you should use a temporary or burner email address. In addition, consider using a secure email service to encrypt your emails. You can find some recommendations and more details in Cybersafe, or on this list of secure online services if you are unsure what to use.

Vary usernames and passwords

If you have a penchant for visiting ahem..questionable (but legal) sites, you may want to consider using a different user name and also to vary your passwords. That way if one user ID is compromised, it won’t necessarily compromise your entire online presence.

Get your information removed online

In the EU, you have the right to be forgotten. This legislation particularly relates to search engine results. If you get search engines to delist information on you, doxxers will have a lot more difficulty tracking your data.

To do this, You can fill out a form on Google, Bing, or Yahoo to get them to remove search results that relate to you.

In the USA, You can get a quick rundown on where hackers can find you at We Leak Info. Similar to the EU, you can also ask Google to remove information about you. In addition, here’s a selection of sites that you can ask to remove your data.

BeenVerified: https://www.beenverified.com/faq/opt-out/
CheckPeople: http://www.checkpeople.com/optout
FamilyTreeNow: http://www.familytreenow.com/contact
Instant Checkmate: https://www.instantcheckmate.com/optout/
Intelius: https://www.intelius.com/optout.php
Nuwber: https://nuwber.com/removal/link
OneRep: https://onerep.com/optout
PeekYou: http://www.peekyou.com/about/contact/optout/index.php
PeopleFinders: http://www.peoplefinders.com/manage/
PeopleSmart: https://www.peoplesmart.com/optout-signup
Pipl: https://pipl.com/directory/remove/
PrivateEye: http://secure.privateeye.com/help/default.aspx#26
PublicRecords360: http://www.publicrecords360.com/optout.html
Radaris: http://radaris.com/page/how-to-remove
Spokeo: http://www.spokeo.com/opt_out/new
TruthFinder.com: https://www.truthfinder.com/opt-out/
USA People Search: http://www.usa-people-search.com/manage/default.aspx

If you don’t have the time or inclination to go through this entire list, you can take a look at Privacy Duck and DeleteMe, who can help identify information about you in the USA and get it removed.

If you want to find out how much information Google has on you, try typing https://myactivity.google.com/myactivity in your browser when logged in to a Google account. Google knows your location as well – you can find your personal Google map with all the places you have visited at the https://www.google.com/maps/timeline URL.

WHOIS

As mentioned earlier, If you run your own website, or you have a website for your business, the registration information that you filled in to get that domain name is made public to all the world through the WHOIS database. However, You don’t have to give your personal information to get a website. Some domain brokers offer you the option of obscuring this information. However, you can get this privacy for free by entering a webmail email address, putting a fake telephone number in the form and giving a made up company name. Although technically false this information rarely gets verified.

Do a regular app and browser cleanse

Mobile apps and browser extensions are known to collect personal data, often without your knowledge or consent - who reads the privacy small print after all? Because of this, it’s worth regularly cleansing apps and browser extensions you use and removing the ones you don’t.

If you have the Cybersafe book, double check the chapter on secure browsing,

Avoid Online Quizzes

We all like to show how clever we are right? And anyway, what’s wrong with a little harmless quiz fun? Well, did you know that some quizzes ask a lot of seemingly random questions, which are actually the answers to common security questions? Plus, it gives attackers more data to work with. Supplying an email address or name to go along with results makes it even easier to associate information from other data sources.

Don’t Login With Facebook or Google

Finally (and I hope I’m hoping this isn’t news to anyone with Cybersafe), when you come across websites and apps that allow users to register using the “Login with Google”, “Login with Facebook”, or “Login with Twitter” buttons please consider using email (see the section on email in this blog post), or the "sign in with Apple" button (if available) instead. Understandably, these services provide a level of convenience by enabling you to complete the registration process with the email you used for your Google, Facebook, or Twitter accounts. However, the downside of using them is that you’ll automatically give the information attached to your Google/Facebook/Twitter accounts to the website. If you still yearn for this convenience, take a look at the Cybersafe alert Edition five, also listed at the end of this blog post for a potential alternative.

Remember, although it’s an odious practice, doxxing is not illegal per se. Hopefully, laws will catch up with that situation soon. Until then, following the advice in CyberSafe should go a long way to keeping you safe online. As we like to say at the CyberSafe alert - Don’t Be Scared; Be Prepared.

Click HERE to Tweet this...

Are you new to the Cybersafe Alert? If so you’ve missed out on some great information to keep you and your family and business safe online. Here’s what you have missed so far this year:

Want a regular briefing about the newest Cyber threats? Subscribe to the Cybersafe Alert now!

Disclaimer

CyberSafe Alert 2019 Edition 8

noreply@blogger.com (Cybersafe) — Sun, 13 Oct 2019 07:58:00 +0000

Your personal data may have been breached - Take action now!

It seems barely a day goes by without another massive data breach being announced. Only recently, Zynga, the online games company (think Farmville) also had a data breach.

In this edition of the CyberSafe alert, you'll find out how to check if you’ve been a victim of a data breach and what to do about it.

In general, companies that have been the subject of a data breach are required to inform

their customers of the breach. But what happens if the company themselves are unaware that they’ve been hacked, or if the contact details they have for you are out of date so you don’t get the message? Or worse, what if the company is trying to keep the data breach quiet for commercial reasons and don’t tell you at all?

As regular readers of the Cybersafe alert know, we give you simple actionable information to tackle cybersecurity issues. This Cybersafe Alert is no different. Today we provide you with two options for checking if you are part of a data breach. The first service you can use is Firefox Monitor.

Firefox Monitor is extremely simple to use, regardless of whether you use the Firefox browser or not. Of course if you have read the CyberSafe book, it’s likely you are already using the Firefox browser or something like it. To use Firefox monitor to check whether your data has been breached, all you have to do is the following:

Go to the Firefox monitor URL at https://monitor.firefox.com/
Type in the email address that you want to check
If your email address has been part of a data breach, it will show up. The Firefox monitor records go back to 2007
As well as doing a spot check, you can also set up an alert for future breaches so you don’t have to wait to be notified by the organisation that has been hacked

The other service for checking whether your password may have been breached is Google’s password manager.

Google will now include the password checking feature in its password manager app, which means that you have to use Google’s password manager to save your passwords in order to take advantage of it. This shouldn’t be a problem for those of you who use Google products already.

So what does Google's password checker do? Well, as well as letting you know about password breaches, the password manager will also prevent you from using bad passwords. If you want to find out how to improve the quality of your passwords, you can also read the Cybersafe Alert Edition 2 - The unhackable password.

Password Checkup tells you if your password has been compromised (for example, in a breach), and gives you personalized, actionable recommendations when needed. For example, it will advise you to change the password. The tool will also tell you if your password is being used on multiple sites.

Did you find this Cybersafe alert useful? Yes? Well, don’t keep this useful information to yourself. Use the sharing buttons to share this valuable information with your family and friends so they can protect themselves online.

Following the advice in CyberSafe should go a long way to keeping you safe online. As we like to say at the CyberSafe alert - Don’t Be Scared; Be Prepared.

Are you new to the Cybersafe report? If so you’ve missed out on some great information to keep you and your family and business safe online. Here’s what you have missed so far this year:

Want a regular briefing about the newest Cyber threats? Subscribe to the Cybersafe Alert now!

Disclaimer
Every effort has been made to ensure that the content provided in this post is accurate and helpful for our readers. However, this is not an exhaustive treatment of the subjects. No liability is assumed for losses or damages due to the information provided. You are responsible for your own choices, actions, and results.

CyberSafe Alert 2019 Edition 7

noreply@blogger.com (Cybersafe) — Wed, 28 Aug 2019 14:33:00 +0000

Has your wallet been hacked?

Welcome to the CyberSafe alert 2019 edition 7, where we provide timely, actionable advice to individuals and SME’s on how to protect themselves online.

This alert covers RFID credit cards and passports, and the lengths we go to, to prevent them from being hacked.

If you’ve got a credit card in 2019, the chances are that it’s RFID enabled. How would you know? Well, if it’s one of those cards that you can simply wave at or place on a card reader instead of swiping it in a slot, then it’s RFID enabled.

As these cards have become increasingly popular you probably started seeing reports in the more hysterical sections of the popular press showing how is it is to intercept your RFID enabled card and steal all your money. People conjured up all sorts of images and scare stories of ne’r do well hackers on street corners with wi-fi interceptors or waiters at restaurants skimming your card details.

As a result of all the scare stories, of course an industry suddenly grew up around protecting consumers from having their cards skimmed. This protection came in the form of RFID blocking, wallets, backpacks, clothes, passport holders, etc., driving tens of millions of sales from worried consumers.

So what’s the advice here? Regular readers of the Cybersafe alert know that our aim is to provide simple, actionable advice on cyber threats. Our advice on RFID blocking accessories is this. Save your money, and buy something that you really want instead. Why should you not be worried? Well, consider the facts:

Most RFID cards these days are next-generation cards. These cards protect the information they send by encrypting it
In the time since RFID cards were released, there have been no publicly acknowledged real-world examples of RFID crime. In that time however, there have been billions stolen in other financial crimes
The payback for Cybercriminals just isn’t worth it. When you consider that a hacker cracking a database such the recent Capital One hack can yield tens of thousands of records, why would someone hang around on a street corner for a day trying to skim credit cards with a reader?

After all that's been said, if you’re still not convinced and you want to protect your wallet anyway, well you can still save yourself some money. Simply put some sheets of aluminium foil in your wallet, and hey presto, you’re protected! So were the reports of RFID skimming all false then? Well not exactly. Plenty of demonstrations by researchers showed how it could be done, but the key point is, it has never happened in a REAL WORLD crime scenario, so relax.

Did you find the Cybersafe alert useful? Yes? Well, don’t keep this useful information to yourself. Use the sharing buttons to share this valuable information with your family and friends so they can protect themselves online.

Following the advice in CyberSafe should go a long way to keeping you safe online. As we like to say at the CyberSafe alert - Don’t Be Scared; Be Prepared.

Are you new to the CyberSafe Alert? If so you’ve missed out on some great information to keep you and your family and business safe online. Here’s what you have missed:

Want a regular briefing about the newest Cyber threats? Subscribe to the Cybersafe Alert now!

CyberSafe Alert 2019 Edition 6

noreply@blogger.com (Cybersafe) — Thu, 08 Aug 2019 09:29:00 +0000

Why your ‘personal’ calls are not personal anymore

Welcome to CyberSafe alert 2019 edition 6, where we provide timely actionable insights to individuals and SME’s on how to protect themselves online.

This alert covers the story that’s recently been doing the rounds about Skype calls being legally listened to. If you’ve read the CyberSafe book, then this information will not be news to you, and if you followed the advice in the book, then this is one less cyber security issue that you need to worry yourself with.

So what’s the big issue? According to a story from Motherboard,

Microsoft has people that regularly listen in to calls made on Skype in order to improve their machine learning services, especially around translations. Before you get outraged and start calling your lawyer about this flagrant violation of your privacy, it’s important to note that unless you opted out from this in their terms and conditions, you have agreed that this can be done. Skype is not alone in this. Most if not all of the big, commercial VOIP providers will have clauses in their terms and conditions that allow them to monitor your calls.

Although this alert is focused on the VOIP issue with Skype, I think it’s important to note that if you use a service like Cortana, or Alexa, or Siri, these devices (assuming they are switched on) are listening to your every word, whether it’s a valid command or not.

Regular readers of the Cybersafe Alert will know that we’re not just here to scare you into thinking the sky is falling in by telling you what’s going on, but also to give you actionable advice on what to do. So here’s what to do if you’re concerned about the recent revelations about Skype:

Check the T&C’s of the VOIP service that you use. If you are concerned about them listening in, then opt-out. If you can’t opt-out, then switch a different service
This kind of monitoring is not unique to Skype. Most if not all of the big commercial services will have a similar capability to listen in to your calls. Cybersafe book readers will know about alternatives such as Silent Phone by Silent Circle. If absolute privacy is important to you, then switch to one of these services
This is somewhat counterintuitive in terms of what these tools are supposed to offer, but if you use an IoT device such as Cortana, Alexa, or Siri, keep it switched off until you need to use it. These devices by their very nature need to listen to every word you say, in order to react when you give them a recognised command

Following the advice in CyberSafe should go a long way to keeping you safe online. As we like to say at the CyberSafe alert - Don’t Be Scared; Be Prepared

Want a regular briefing about the newest Cyber threats? Subscribe to the Cybersafe Alert now!

CyberSafe Alert 2019 Edition 5

noreply@blogger.com (Cybersafe) — Thu, 06 Jun 2019 14:00:00 +0000

Is the new “Sign in with Apple” button a game changer?

Hello again, it’s time for the fifth CyberSafe alert edition of 2019. I’m sure you haven’t failed to notice that these days when you sign up or sign into most apps or websites you will have encountered the timesaving social login feature. These time-savers allow you to register for websites and apps using your already existing profiles on social media behemoths like Facebook, Twitter, and LinkedIn by simply clicking on a button, instead of typing in your details all over again.

Great idea right. Well yes if all that matters to you is saving half a minute logging into the site or app. Not such a great idea if you value your data privacy. I have to say, I personally don’t use social logins, and If you’ve read the CyberSafe book

you’ll know that we don’t recommend you do so either. The reason? Although social login provides extra convenience, the cost of that convenience is giving away some of your personal data. Not worried about giving away your email address or username? Well, these social login buttons usually also send additional data like gender, age, relationship status, etc to the sites and apps you register with or log in to.

If you’re a Cybersafe reader, you’re pretty careful about your cyber security, so that’s why Apple’s recent announcement of “Sign-in with Apple” could be a potential game-changer for those that value both convenience AND privacy.

So how is it going to work? “Sign in with Apple” will be in the form of a button similar to the other social login buttons. The difference is, it won’t transmit your personal information. Instead of sending your email address, it will generate a random email address linked to your real address.

So do you need to do anything to get this going? Well no actually. The great thing about this for users (Apple users actually, sorry Android users - at least for now) is that Apple will require apps that include social sign-in buttons to include the new sign in with Apple one as well.

For Android users, although the sign in with Apple button isn’t available, alternative methods of registering with or signing into an app or website other than social logins usually are. If you’re concerned about your privacy, I would recommend setting up a profile manually. It can usually be done relatively quickly, and you can decide what information gets transmitted.

Following the advice in CyberSafe should go a long way to keeping you safe online. As we like to say at the CyberSafe alert - Don’t Be Scared; Be Prepared

Want a regular briefing about the newest Cyber threats? Subscribe to the Cybersafe Alert now!

CyberSafe Alert 2019 Edition 4

noreply@blogger.com (Cybersafe) — Thu, 16 May 2019 05:39:00 +0000

WhatsApp Hacked!? Here's What To Do About It

Welcome to the fourth CyberSafe alert edition of 2019. Usually on the CyberSafe alert we focus on issues that could impact you at any time. Today’s alert concerns the the recent attack on WhatsApp and what to do about it if you have WhatsApp installed.

If you’ve read the CyberSafe book you’ll know that we list WhatsApp as being one of those messaging tools to look at because of its end to end encryption. WhatsApp is one of the most popular messaging apps in the world, and because of this, that makes it a target for hackers targeting its massive user base.

The news filtering in from WhatsApp this week is that hackers were able to install surveillance software on not just phones, but on any other devices you may have installed WhatsApp on. This surveillance software allows hackers to view messages you have sent or received on WhatsApp.

If you’re a Cybersafe reader, you’re pretty careful about your cyber security, so how could you have been caught out right? Well, it turns out there wasn’t a lot you could do about it. The hack worked by using WhatsApp's voice calling function to ring a target's device.

Even if the call was not picked up, the surveillance software could be installed. Just to cover their tracks, the call would often disappear from the device's call log.

Here at the CyberSafe alert, we don’t just give you the news, we also give you solutions to tackle the issues we raise, and this solution is simple. WhatsApp have issued a fix to this problem, but the next bit depends on you. Make sure you update your current version of WhatsApp to the latest version. Yes, stop reading, and DO THIS NOW!

Oh, and one more thing. While the update fixes the flaw that let this attack take place, WhatsApp has not said whether the update removes any spyware that has already infected a compromised device. So, in addition we suggest you also make sure your anti-virus software is up to date, and run a scan for any potential threats. Of course we’re sure you’re already doing this regularly, right? If you’re running WhatsApp on iOS you can feel reasonably secure that any infection is limited to the WhatApp app because of the way apps operate in iOS.

Following the advice inCyberSafe should go a long way to keeping you safe online. As we like to say at the CyberSafe alert - Don’t Be Scared; Be Prepared

Want a regular briefing about the newest Cyber threats? Subscribe to the Cybersafe Alert now!

CyberSafe Alert 2019 Edition 3

noreply@blogger.com (Cybersafe) — Mon, 08 Apr 2019 05:50:00 +0000

Is It Safe To Hit Send Now?

Welcome to the third CyberSafe alert edition of 2019. Today’s alert focuses on the perennial business (and sometimes personal) problem of how to send large files securely, especially when your email allowance is too small to allow it.

In the CyberSafe book we mention some specific secure tools as well as techniques for safely transmitting and receiving confidential data to keep it safe from cyber-crooks. For this alert we’re going to talk about a tool that isn’t mentioned in the book, but is also effective at keeping your sent files safe. That tool is Firefox Send.

Firefox send is a simple add-on to the Firefox browser that allows you to send files of up to 2.5Gb in size securely if you are logged in with a Firefox account, and 1Gb otherwise. The great thing about Send (besides the obvious security features) is its simplicity. To send your files, all you have to do is drag and drop your files into the Send page, or select the file from your computer. Once you done that, give it a secure password (take a look at Cybersafe Alert edition 2 on the unhackable password), and then hit send - simples.

You may be thinking, why do I need to use this service when I’ve already got alternatives like Google Drive, Dropbox, Box etc.? Well as explained in the Cybersafe book in more detail that we can go into in this newsletter, those services are only secure up to a point, so it depends on how secure you need your documents to be, and how much you value your privacy.

Not everyone out there is out to get hold of your private business documents or engage in industrial espionage, but it’s nice to know that if needed, there are simple ways to protect your privacy.

Following the advice in CyberSafe should go a long way to keeping you safe online. As we like to say at the CyberSafe alert - Don’t Be Scared; Be Prepared

Want a regular briefing about the newest Cyber threats? Subscribe to the Cybersafe Alert now!

If you can't wait for the next CyberSafe Alert to tell you how to protect yourself online, get CyberSafe the
book. It's packed with the useful information and strategies you need to keep yourself, your family, and
your business safe online.

Disclaimer
Every effort has been made to ensure that the content provided in this post is accurate and helpful for our readers. However, this is not an exhaustive treatment of the subjects. No liability is assumed for losses or damages due to the information provided. You are responsible for your own choices, actions, and results.

CyberSafe Alert 2019 Edition 2

noreply@blogger.com (Cybersafe) — Wed, 13 Mar 2019 05:25:00 +0000

The Unhackable Password?

Welcome to the second CyberSafe alert of 2019. It seems not a week goes by without yet another report of passwords being hacked because the unwitting victim used the name of their favourite pet, child, car (insert favourite thing here...) being used as their password. That’s the subject of this edition of the cybersafe alert

In the CyberSafe book we talk about the various ways to safeguard your passwords. These include multi-factor authentication, password managers, cold storage etc. In this cyber alert however the focus is on how to create easy to remember passwords that are tough to hack.

The problem with a lot of sites that ask you to create strong passwords is that all too often these passwords are so complicated that you end up forgetting them yourself, which kind of defeats the whole object of the exercise.

One straightforward way to create a memorable strong password is to make your password a sentence. A strong password is a sentence that is at least 12-14 characters long. Focus on positive sentences or phrases that you like to think about, and that are easy to remember for example, “Come0nYou$purs”. On many sites you can even use spaces, so for example “Come On You $purs”. You can play around by substituting letters for numbers and symbols like the previous two examples to make the phrase even stronger.

An even stronger alternative is to think of a sentence or phrase that you can easily remember. For example, “Simon really loves Italian red wine in the summertime, because he goes to Italy every year!” Then you could use that sentence as a code by inserting the first letter in each word as the password: SrlIrwits,bhgtIey! and then make it more secure by adding/substituting numbers and special characters for the letters. 5rlIrw1t$,bhg7I3y! That’s a very secure password, AND it’s a LOT easier to remember. It would take centuries for a supercomputer to crack that one. Or at least a lot longer than the name of your favourite pet!

Hopefully you’ll avoid being hacked by using one of these methods to secure your passwords.

Following the advice inCyberSafe should go a long way to keeping you safe online. As we like to say at the CyberSafe alert - Don’t Be Scared; Be Prepared

Want a regular briefing about the newest Cyber threats? Subscribe to the Cybersafe Alert now!

CyberSafe Alert 2019 Edition 1

noreply@blogger.com (Cybersafe) — Wed, 13 Feb 2019 05:43:00 +0000

Are Your Toys Spying On You?

Welcome to the first CyberSafe alert of 2019. We trust you all had a safe and prosperous holiday season and are looking forward to the rest of 2019.

Accompanying the holiday season more often than not is a wide variety of presents, and more likely than not these days, those presents will be electronic is some form or other. That’s the focus of this post holiday CyberSafe alert.

In the CyberSafe book we talk about the Internet of Things (IoT), and how so many consumers are not even aware of how many of their electronic goods are connected to the internet in one way or another. Not only are they connected to the internet, but a lot of these devices have wide open security that allows them to be hijacked.

A recent case that clearly demonstrates this danger is that of the British security consultant jailed for effectively taking a whole country (Liberia) offline. He brought down Liberia’s primary telecoms provider, by hacking into and using -ironically- cheap security cameras with minimal password protection to send so much data traffic to the telecoms company that their servers were overwhelmed. This example alone should demonstrate how easy it is for an e-intruder to enter your home by hacking into your shiny new presents. Think it can’t happen to you because you don’t have cheap security cameras? Well, let me give you some other examples:

The baby monitors transmitting a live feed onto the internet for all to see

Your childs smart teddy bear that can be hijacked

The car that allows hackers to take control of its systems remotely

The printers that were hijacked and used to gain access to small business networks

Once in control of a toy, a hacker could have access to your smart TVs, mobile phones, computers, tablets, gaming systems, in fact potentially anything connected to your families or your businesses network.

But, here at the CyberSafe alert, we’re not interested in scaring you away from all things electronic but in giving you actionable advice to protect yourself. So here goes. Here are some things you can do to protect yourself, your family, and your business if you have IoT connected devices:

Attach a security device like Bitdefenders Box or Winston to help protect your network
Where possible, lock down IoT applications and operating systems. Just like any server, the device should have the absolute minimum of network services. Your smart TV may need to use DNS, but your smart baby monitor? Not so much
Check your device documentation. If it allows you to change the default password, make sure you do. Most of these default passwords are either easy to guess or public knowledge
Make sure that the contact information for all of your devices are up-to-date including an email address regularly used to receive security updates and related notifications
Confirm all your devices and their mobile applications are set to automatic updating to help maximise protection. Review their sites for the latest firmware patches. If they are not automatically updated, follow the instructions to manually update them
Review the privacy policies, and practices of your devices, including data collection and data sharing with third parties. Your settings can be inadvertently changed during updates. Reset as appropriate to reflect your preferences
Review devices' warranty and support policies. If they are no longer supported with patches and updates, disable the device’s connectivity or discontinue usage of the device
Before discarding, returning or selling any device, remove any personal data and reset it to factory settings. Disable the associated online account and delete any associated data
Review privacy settings on your mobile devices including location tracking, cookies, contact sharing, bluetooth, microphone and other settings. Set all your device and applications to prompt you before turning on and sharing and data

Do these things and it will go a long way in keeping you safe from hackers. As we like to say at the CyberSafe alert - Don’t Be Scared; Be Prepared

Want a regular briefing about the newest Cyber threats? Subscribe to the Cybersafe Alert now!

If you can't wait for the CyberSafe Alert to tell you how to protect yourself online, get CyberSafe the book. It's packed with the useful information and strategies you need to keep yourself, your family, and your business safe online.

Disclaimer
Every effort has been made to ensure that the content provided in this newsletter is accurate and helpful for our readers. However, this is not an exhaustive treatment of the subjects. No liability is assumed for losses or damages due to the information provided. You are responsible for your own choices, actions, and results.