#FALLING FOR A PHISHING SCAM AND GETTING MY WORK LAPTOP HACKED

[mostlysignssomeportents]

How to be safe(r) online

I flatter myself that I am pretty secure online. I’ve written a series of global bestsellers about information security, I’ve worked for EFF for nearly 20 years, I’ve given keynotes at some of the world’s largest infosec conferences. And yet, I have been hacked. It wasn’t even very sophisticated!

It was in 2010. My kid had made a fuss about going to day-care so my wife and I were late walking to work. The cafe we always stopped at for a coffee had longer lines at that hour, so I stood in line while she sat down and read a paper.

https://locusmag.com/2010/05/cory-doctorow-persistence-pays-parasites/

I had reinstalled my phone’s OS the day before — the same day I’d had three different articles come out. I was hearing from a lot of people about those articles, and I was having to re-key my password in a lot of websites because I’d blown out my browser preferences with the reinstall.

Standing in line, I got a DM from an old friend: “Is this you?” followed by a URL. I clicked it, and my browser opened, then redirected to Twitter. I sighed, thinking that I needed to find the system setting to tell my phone to open tweets in the Twitter app. I typed my Twitter password into my browser, and ordered coffees.

As I was handing my wife her coffee, my phone buzzed three more times. It was three more DMs, from three more old friends: “Is this you?” and the same URL.

My guts twisted. I’d just been phished.

The Twitter worm that got me was simple: they took your Twitter password, logged in as you, and DMed all your friends with “Is this you?” and a phishing URL that looked like Twitter’s login screen. The URL started with https://twitter.com, but continued with .scammysite.com (my mobile browser only showed me the first part).

I got fooled because of a perfect alignment of vulnerabilities — late, long line, new OS, new publications, bad browser design, inattentiveness. If the first phishing DM had come in 5 minutes later, in the flurry with the three others, I’d never have been caught. If we’d been on time and I’d received the DM while at my desk on my laptop, I wouldn’t have been caught.

It’s easy to sneer at people who get fooled by phishers, but imagine this: you are buying a house. You’ve just gone into escrow. You get an email or a phone call or a text from your bank about your mortgage, telling you that you have to complete another form. It’s probably not even the first time that’s happened — buying a house often requires going back several times to complete new forms! It’s high-stakes, high-tension, and the market is so hot that if you miss a form, the house might go to someone else. Maybe you’ve already given your landlord notice or sold your own house.

Do you triple-check the URL your bank gives you? Does it even matter? Your bank is probably using half a dozen fintech services to close your mortgage and escrow. You’re already routinely transmitting sensitive data to companies you’ve never heard of.

I get dozens of phishing emails like this every day, but I’m not actually buying a house, so I ignore them. But if I got one of these on the morning that I was closing on the deed? While juggling movers and finance and maybe a new job and a new school for the kid in another city? I’m not so sure. If you’re honest, you won’t be so sure, either.

That’s the thing we miss about scams — they’re scattered like dandelion seeds. The cost of adding another email address to an untargeted scam is close to zero, and the scammer doesn’t care whether that email is deleted unread anymore than a dandelion cares whether one of its seeds falls on concrete.

The dandelion’s reproductive strategy isn’t to ensure that every seed takes root — it’s to ensure that every crack in every sidewalk has a dandelion growing out of it.

http://www.locusmag.com/Features/2008/05/cory-doctorow-think-like-dandelion.html

11 years ago, I got phished. I immediately realized my mistake and changed my Twitter password, but, like many people then (and now!), I’d reused that password elsewhere.

I’d created my Twitter account while standing in line for a Game Developer’s Conference press pass, after Ev Williams sent me an invite to the beta. I didn’t think I needed a good password for it, because it was a toy that sent you updates about other people’s lunches over SMS. Half a decade later, I had tens of thousands of followers and the account was key to my professional life.

The person who phished me hadn’t targeted me. I was fooled by an embarrassingly blunt and transparent ploy. Is there any way I could have avoided this?

Perhaps. But not by maintaining perfect vigilance, or by never being harried or hasty. The blame-the-victim school of unattainable security locates the infosec pandemic’s problem in human frailty, rather than bad systems.

Good security advice transcends this, and Ars Technica has just published an outstanding guide to securing your online life, in two parts, written by Sean Gallagher.

Part One (“The Basics”) lays out both a way of thinking about security (particularly dispelling the notion that criminals won’t target you because you’re no one special), and a set of (mostly) simple steps you can take to defend yourself against opportunistic, untargeted attacks:

https://arstechnica.com/features/2021/10/securing-your-digital-life-part-1/

Part Two (“The Special Circumstances”) offers advice for people who might be specifically targeted by attackers. That’s not just one percenters and politicians — it can include people whose ex-spouses harass them with stalkerware, middle-schoolers targeted by bullies, and more.

https://arstechnica.com/information-technology/2021/10/securing-your-digital-life-part-2/

I often get asked what people should do to be more secure, and I offer four basic pieces of advice:

Use a strong, unique password for every service. Get any reputable password manager (including the free one that probably came with your OS) and use it to generate all your passwords. Never use a password that you are capable of remembering — if you can remember it, a computer can guess it (the exception being the password that unlocks your password manager!).

Use two-factor authentication, preferably an authenticator app, like the one that comes with your mobile OS, or an indie like Authy. Turn it on for every account you use regularly, and seek it out when you create a new account. Avoid SMS-based 2FA.

Keep your OS and software up to date. When your OS or app asks you whether you want to update, do it.

Turn on full-disk encryption. It’s free, it came with your device, and it protects your data.

All of this is in Gallagher’s advice, along with something I don’t recommend enough, though I’m obsessive about it myself:

5. Back up your data, offsite, and keep multiple backups.

The easiest way to do this is with an encrypted cloud service. I do some of that, but my first line of defense are cheap, encrypted 1TB thumb drives that I back up to every day. Once a week, I take a disk to an offsite location and swap it with one that’s already there.

Gallagher also offers solid privacy advice:

get a tracker-blocker (like Privacy Badger) and an ad-blocker

change the permission on all of your apps so they can only get your location while you’re using them

change your mobile device’s Bluetooth name to something other than your own (e.g., not “Fred’s phone”)

He’s also got some specific advice I hadn’t really thought about:

beware of a stranger who wants to move a conversation from one app to another (say, from Tinder to Whatsapp), as this is a “signature move” of fraudsters

claim an IRS account for your Social Security Number (warning: this is complicated and I failed in my attempt because my information wasn’t recognized)

https://www.irs.gov/payments/view-your-tax-account

One of the most common questions I get is “Which VPN should I use.” Gallagher’s answer? None of them: “for everyday Internetting, you just don’t need VPNs that much anymore. Transport Layer Security now encrypts a vast majority of Internet traffic, and it’s unlikely that someone is going to grab your credit card data or other personal information off a public Wi-Fi network.”

But that’s for “everyday internetting.” If you’re a whistleblower or someone else likely to be targeted, “use Tor.” He also advises using Signal for encrypted chat, which is good advice for everyone, not just people in high-risk situations.

Another piece of advice offered in Part Two that everyone should follow is locking your credit report.

For people at risk of domestic violence and stalkerware (the two are highly correlated), he suggests Operation Safe Escape:

https://safeescape.org/

All in all, this is excellent advice. If I’d followed it when I was phished, my recovery would have been a lot simpler. 2FA would have defended me, and if it hadn’t, I would only have needed to change a single password.

But some of the advice is less realistic, even if it’s sound: telling people not to click on email links, or to turn off wifi and Bluetooth when they’re out of the house (especially in an era in which the headphone jack is nearly extinct) may be good advice, but realistically, no one’s going to follow it.

As with much in information security, a sound defense requires both technology and policy. You shouldn’t have to turn off Bluetooth and wifi, because both the standards that define them and the implementations in your device should defend you from information leakage. Likewise, mobile OSes shouldn’t default to naming your device after you, and app vendors shouldn’t be able to get your location when you’re not using their apps, period.

Of course, most of us aren’t in a position to do anything about policy. We’re not FCC commissioners, we don’t work in an EU Information Commissioner’s Office or for a state Attorney General.

But that doesn’t mean that we should ignore policy, or give tech advice that no one will follow. A good deal of the threat to our privacy and security doesn’t come from criminals, it comes from large corporations adhering with bad, or out of date, laws.

America trails the world in privacy law. It is long overdue for a federal privacy law, with a private right of action — something ferociously resisted by telcos, ad-tech, and Googbook:

https://www.eff.org/deeplinks/2019/01/you-should-have-right-sue-companies-violate-your-privacy

Before the FDA was founded, people were routinely sickened and killed by “medicine” that was literally poisonous. I imagine that people got advice then that sounds a lot like our infosec advice today: “Only take medicine from doctors you trust,” “read the labels carefully,” etc.

Today, we have a better system: we make it a crime to poison people or lie to them about what’s in medicine or what they can expect of it.

The advice in Gallagher’s guide is essential, and much of it would apply even in a world where we had good tech policy. But even if you follow all that advice, it won’t protect you from the choices made by governments and corporations that put their priorities ahead of your welfare.

Today is Aaron Swartz Day. One of Aaron’s most memorable quotes is from the fight over SOPA, an idiotic, internet-destroying legal proposal that Aaron helped kill a decade ago: “This is the 21st century. It’s not OK for politicians not to understand the internet anymore.”

https://www.aaronswartzday.org/

The awful state of tech policy is a scandal that puts us all at risk. Security is a team sport, after all. No matter how careful you are, you can still be compromised by someone else’s badly configured technology — the emails you send to someone else may leak, a company may suffer a breach and put your home address on the internet forever, etc.

Aaron fought for better tech policy. A lot of orgs do that today: EFF, of course, but also Public Knowledge, Software Freedom Conservancy, FSF, Creative Commons, Internet Archive, Fight for the Future, SFLC, EDRI, Open Rights Group, and many, many others.

We should all take some measure of responsibility for our technological safety and security, sure — but until we get better tech policy, we’ll just be sticking bandaids on tech’s gaping wounds.

[thecoroutfitters]

Written by Cody on The Prepper Journal.

Even if you completely discount the circus that is taking place in Washington D.C., which you should, and just open up your computer to the Internet your are suddenly in a unique swamp all to its self, one replete with low-life creatures that even the creators of fiction in Hollywood would envy.

As Preppers we, like everyone else, deal in information, we depend upon it and should always understand its sources. We are already aware of the American Media and its agenda and hopefully we have learned to apply the proper filters. On the one side we make planning and life decisions based on the information at hand and on the other we keep valuable data in these smart devices. Date that can be used to hurt us financially.

Can we be sure our laptop is secure? Any of our internet capable devices? I know I have received a half-dozen scams through email of late phishing for information. Emails that are mirror images of the actual sites we deal with on a regular basis (JP Morgan Chase, Amazon, E-bay, even Google) looking to “verify” account information and now with required fields for my social security number and drivers license number sprinkled in the mix.

I even got a phone scam last month from someone claiming to be from the IRS and leaving a voicemail that I must call back if I don’t want the matter passed off the next 24 hours to local law enforcement to process. The IRS does NOT call. These scammers are out there and they can be pretty slick.

Am I complicit in this loss of innocence since I have allowed myself to use the “free” email from Yahoo, G-Mail, Hotmail or AOL (ugh)? I am certainly guilty of taking a convenient short-cut to save some money, and can I even be sure that a paid email service is any more secure? Where do you draw the line between reasonable caution and paranoia? A simple way to make that call is where do you put your car keys after you park the vehicle somewhere? Locking it and taking the keys does not assure it won’t be stolen, but it does make it a lesser target than perhaps others. Or do you leave it unlocked, windows rolled down and the keys in the center console? I have a friend I sail with who does just that. Understand that the car is a 1990’s beat to death Ford Taurus, but still it is wheels, something to take for a joyride.

To be honest I had a good laugh this month when there was “breaking news” that Google is working with the Chinese Government to connect all data and search results with a users phone number there, making it easy for their government to know their every keystroke. My laughter was because people will read that and think it isn’t true elsewhere, including here.

So, do you think your computer is protected now? By Norton or McAfee or whatever software. Well, it is safer for sure, but no one can guarantee it 100%.

And what about your laptop (if they are not one in the same)? Smartphone? Are you 100% sure nobody is monitoring your traffic now, reading your emails, running searches for strings of numbers that could be credit card numbers? The Payment Card Industry (PCI) is one of the bright spots in this cyber jungle because they have to be; without them on-line would just be looking at pictures. They bend over backwards to insure, as best they can, the security of your credit card number. It is a race and the hackers are the mechanical rabbits and the cyber-security industry are the greyhounds.

Besides phishing for financial data other scams include:

“Your Domain Name is Expiring+ = phishing for login credentials

Technical Support Calling – a call claiming to be from Hp or Microsoft that they have detected a problem in your computer and need you to log into their site to address it – capturing your login/password

FBI – contacting you over license infringements on files, usually music or videos, that you downloaded

…and on and on

The list is endless and runs from clever to “who would fall for that” but people do, daily. I for one am still waiting for my winnings from the “fill in the blank” countries lottery winnings. And one has to be as clueless as our elected representatives to not know about the ransom ware traveling the world wide web.

I even had my Uber account hacked. I began getting confirmation numbers in text messages for scheduled pickups. I tried contacting Uber, an impossible task for anything other than a ride somewhere. Only took a few weeks, like 7 of them, to get Ubers attention.

I find that when I am driving the information superhighway I have to be just as alert and aware and on top of things as when I am driving the roads of America, a threat can come out of nowhere and your reaction time is all you have to recognize it and avoid a costly collision.

Follow The Prepper Journal on Facebook!

The post Accidents on the Information Superhighway appeared first on The Prepper Journal.

from The Prepper Journal Don't forget to visit the store and pick up some gear at The COR Outfitters. How prepared are you for emergencies? #SurvivalFirestarter #SurvivalBugOutBackpack #PrepperSurvivalPack #SHTFGear #SHTFBag