The Alarming State of Internet Security
Richard Lowe Jr
2X Bestselling Ghostwriter with 100+ Books | All your brand is missing is a standout story | ?Books?White Papers?Case Studies?Blogs?Fiction?Memoirs | Writer & Consultant for Thought Leaders |
The Alarming State of Internet Security
Early in 2022, hackers breached LastPass's defenses. LastPass kept the details pretty close to the vest, but finally announced the attackers succeeded in stealing the password vault. To make matters worse, it turns out that LastPass only encrypts the passwords - the remaining information is in plaintext. This includes URLs, usernames, and so forth.
Take note - this is about as close to the worst-case scenario as you can get. The passwords were encrypted using each individual's master password, which, according to LastPass (and there is absolutely no reason to trust them), is not stored in the password vault. However, given today's powerful computing options, it may not be long before hackers crack some or all the encrypted contents.
Because of this unmitigated disaster, I changed all my passwords on all online accounts - roughly 400 of them. During the weeklong process, I learned some interesting - and disturbing - facts about the state of security online.
My observations
Conclusions
Website security is a basic, expected function of any entity on the internet. Yet most of the sites I visited would get a failing or barely adequate grade.
EMAIL IS THE MAIN VULNERABILITY TO INTERNET SECURITY, perhaps second only to human laziness or error. If hackers compromise your email account, it's game over.
PHONES ARE ANOTHER HUGE VULNERABILITY. Users typically (in my experience) don't spend a lot of effort to secure their phones. Many don't even do the minimum of requiring a PIN or thumbprint for access. If hackers compromise your phone, chances are hackers can gain access to most, if not all, of your online accounts.
领英推荐
Websites need to support:
Best practices for users:
I'm sure I've forgotten or missed a few things.
What is your experience with dealing with user security on the internet?
— I am a ghostwriter and write about cybersecurity, leadership, AI/ML, AR/VR, the Metaverse, leadership, and how to use LinkedIn to promote yourself. If you like what you see and want to see more: send me a connection request or view my profile, then click Follow and the bell (??)!
If you need a book or articles written, or your LinkedIn profile optimized, send me a message so we can set up a time to discuss. I am also a cybersecurity technical writer and can help your business write the policies and procedures you need to improve your security and satisfy your auditors.
last 2: -?Improve your vigilance:??many banks allow for you to set up alerts (text or email) whenever there is activity in your account.??Along similar lines, most credit card companies allow you to do the same regarding any credit card transactions.??While this won’t prevent fraud, it can help you react promptly to respond to abnormal activity. -?More advanced attacks involve the attackers posing as your bank or credit union to trick you into gaining access to your account.??i.e. in the ‘pay yourself scam’, you receive a text message that looks like a fraud alert from your bank about unusual activity. The text may look like "Did you make a purchase of $100.00 at ABC merchant?". by responding to the msg, you get a call from what looks like a bank (DON’T blindly trust caller ID – it is not always what is appears). they pose as your bank rep and ask you to send money to yourself with Zelle or some other online payment platform to stop the fraud. Of note, the scammer will ask you for a one-time code you received from your bank. If you provide the code (DON’T DO IT!), they will use it to enroll their bank account with Zelle using your email or phone number, hence granting them the ability to receive your money into their account.
3 more: -??Gift card scam – when someone says that they are in some sort of bind and they need for you to go out and purchase a bunch of gift cards (unless you do this for this person regularly!), there is a >99% chance that it’s a scam.??ALWAYS call that person to verify the request (do not respond to their email or text as likely it is an impersonator). -??Real Estate - Criminals can infiltrate a real estate agent’s email and ask homebuyers to wire money to a bank account ahead of their property’s closing. Don’t be afraid to pick up the phone to verify something like this before moving a large sum of money. -??EBay or other online auction places: A potential buyer will contact a seller to say they’ll send a (bogus) check to cover the purchase and shipping. The “payment” is often substantial (a huge red flag), and the buyer asks the seller to send the item and write a check to return the overage. In real life, who writes a check for way too much? Scammers may also say they’ll use an eBay/Craigslist “escrow service” for a safe transaction, and direct victims to a fake site. If you are sent a check for an EBay purchase, even if it’s the right amount, have your bank verify it and ensure that funds clear before shipping your item.
3 more: -???????In another Applepay scam, fraudsters contact you about an item you have for sale. Once you agree on a price, they'll “accidentally” send you too much money. Then, they'll ask you to refund them via Apple Cash or a similar digital wallet. In reality, the scammer used stolen credit card details to make the original payment. Always wait several days to ensure that the payment you receive was valid and cleared. -???????Vacation rentals - Scammers post fraudulent rental properties on trusted sites but ask renters to pay using a different app.??Don’t fall for this trick just to save a few bucks – there is a reason they want you to pay them via a covert channel.??When making payments, stick to the beaten path using your trusted payment platforms. -???????‘Your package is….’ – DON’T click on the link from anyone who sends you something that tells you where your ‘package’ is or its delivery status. If you want to check on something like that, just go to the site of the shipper (i.e. FEDEX, UPS) or shipping party (i.e. Amazon) .
next 2: -???????And don’t click on pop-up windows that you’re not expecting, either.??Let’s face it, there are a lot of companies out there that don’t necessarily harden (secure) their websites appropriately, so the attackers use those sites as vehicles to play to your fears.??For example, you may be on a compromised website where the attackers install malware to present a pop up window on your computer stating that you have a virus and to “click here” to fix it. Oftentimes, by ‘clicking here’, you may be opening the door for the attacker to install nefarious software on your computer. -???????A popular Applepay scam involves a text, sent from a mobile number, that reads something like: 'Apple Pay has been suspended on your device. Please visit, for example, secure-mysuspension-info.com. Scammers often use tactics like this to play to your fears and make you panic and act fast. The attackers WANT to use fear to cause you to over-react without thinking through the situation.??As mentioned before, don’t click on links in text messages unless you are expecting someone to send you a link.
first 2: -??We all hate to receive junk mail and spam and it is truly mind blowing to see just how much spam is clogging up the pipes of the internet.??Oftentimes we may react to clicking on the ‘unsubscribe’ button of a spam email, but why should you trust the spammer to include a ‘safe’ link to unsubscribe? The link very well could instead introduce malware (used to be known as viruses) or ransomware (where the attacker encrypts all of your data and you must pay ransom to recover it). If you only have one takeaway, it’s to NOT click on any links unless it is a link that you are expecting to receive!? -?‘Look who died’ (along with a link).??Really???I’ve probably seen this at least a dozen times in Facebook Messenger – nothing more than that plus a link.??It goes to show you that many social engineers aren’t that creative, yet folks will continue to fall for this one and click on the link.?So often we just get caught up/distracted and don’t think through some of these things – would someone you know really say this? If you are not sure about the content that was sent to you by someone, resort to that old 20th?century mode of communication where you use that app on your smartphone that lets you talk to people (i.e. call them!)