Category: Computers

The most essential transactions these days happen over the internet. However, even though the increasingly connected world makes work easier, we expose most of our personal information to hackers. Hackers have several ways of stealing essential information that is put to misuse. This article has detailed several new tricks that hackers can use to steal your data and the best practices to promote more robust security.

Latest tricks hackers use today and how to stay safe

Phishing

This is a fake email that hackers create that looks legitimate. The primary goal of using email phishing is to steal confidential information such as bank account details and passwords. The email may appear to have originated from the company you work for or your bank. The email tries to create panic or urgency by tricking users into providing their personal information. For instance, you may receive an email from your bank claiming that your ATM is disabled, and you have to confirm your card number for re-activation. Most users fall for the email, which malicious hackers send to have your data.

How to protect your data

When you receive a fake email, look for grammatical errors in email addresses or domain names. Hackers also use email addresses that resemble well-known organizations but slightly are altered.

Also, check if the email has a link. If one is present, hover your mouse on the link and check if the URL matches the link provided in the email.

Hackers use threats such as your account has been blocked or your security is compromised. Avoid such tricks.

Malware

Hackers write this malicious software intending to compromise your home computer cybersecurity to access confidential information. The software can perform functions that include deleting or stealing vital data, tracking the victim’s activities secretly, and modifying the system’s core functionalities. Some factors that lead to malware installation in your system, include running a pirated or older version of an operating system, installing pirated software or clicking on unknown links.

Some of these malware software’s include:

• A virus that can infect your software and disable system functionality
• Trojans that create backdoors in your home computer cybersecurity for hackers to monitor your activities
• Spyware that hackers design to spy on a user and track everything they do online including your surfing habits, passwords, and credit card numbers.

How to maintain safety

• Install legitimate antivirus software.
• Avoid clicking on fake antivirus pop-ups generated from websites.
• Avoid downloading fake software
• Update your operating systems often
• Avoid downloading pirated software or apps since they may contain malware

Insecure networks

Connecting your devices and systems to insecure networks creates an excellent opportunity for hackers to access your files and monitor your online activities. With that, a hacker can steal your bank account password and your social accounts or even inject malware on your trusted sites. With the wide range of programs available on the internet, a hacker can get close to your residence and gain access to your accounting data, passwords, usernames, and critical files. If such in-depth knowledge gets into the wrong hands, it can cause damaging consequences to your business.

Connecting to free Wi-Fi at the airport or coffee shop is dangerous, especially when carrying out essential activities online, like having private conversations, banking, or browsing your email. The networks are not protected and can give hackers an opportunity in the same region to snoop on you.

How to protect your data

Do not connect to open, untrustworthy Wi-Fi networks. Free Wi-Fi may not be safe. When in a hotel or bar with Wi-Fi, do not connect randomly to any open network. Ask the staff which Wi-Fi is safe to connect to. That can minimize the chances of your accounts being hacked.

Also, avoid accessing any vital information while connected or performing bank transactions. Use strong encryption like WPA2 on your home Wi-Fi router instead of WEP security or Open.

Physical security threats

This is threat involves people accessing your devices, such as mobile devices, laptops, and hard drives physically.

People underestimate physical security threats in favor of technical threats like malware and email phishing. However, physical security threats occur when one can physically gain access to vital information, such as information collected from stolen devices.

These physical breaches can take place at your home or workplace. For instance, one could access an unattended system that is not protected by a password or get access to your confidential files.

How to stay safe

• Use encrypted USBs and computer hard drives when storing confidential information. Avoid writing your passwords on a notepad or post-it.
• Also, protect your system with a strong password. Avoid leaving your pc or phone unlocked. Ensure that you have proper backup and enable remote wipe services in case you lose your phone.

Smishing

This is where a hacker tries to trick you into providing them with your data via either an SMS message or a phone call. This technique is becoming more common and is a growing threat to online security.

Smishing utilizes elements of social engineering to have you submit your vital data. The hacker earns the user’s trust and gets access to their personal information. The data can be anything from details of your bank account, OTPs, or online password to gain access your accounts. An attacker can use the information for various attacks. Sometimes the SMS messages come with short links with tempting offers and deals. When you click the link, the malware gets installed on your device.

How to protect your data

• Avoid sharing your personal information over an SMS or phone call
• Before clicking links in a message, make sure you verify its identity. If you get a message claiming it is from a person you know and requests for critical data, contact the person using the phone number in your contacts and verify that they have requested the data.

Malicious mobile apps

Most people believe that every app available on the Apple Store or Google Playstore is legitimate. However, not every app on these stores is safe. Some apps contain some malicious codes that can jeopardize your privacy.

A malicious app may have a code snippet that installs on your mobile phone or tablet. The app may also request permissions that may be valuable to hackers in getting your vital information, including your text messages, media, and contacts.

It is essential to be smart before accepting permissions such as:

• Accounts access
• SMS permission
• Microphone access
• Contacts
• Device admin permission

How to protect your data

• Before downloading an app from Google Playstore or Apple store, first, check the permissions.
• Check the app’s reviews and ratings
• Avoid downloading applications from unknown sources
• Do not download cracked or pirated apps

Top 10 vulnerabilities of using the same password

Password reuse is among serious cybersecurity concerns. Users and administrators can use several ways to increase their password security, but they are often not adopted. Below is how you can ensure vital information in your web application is not compromised because of password reuse.

The danger of password reuse

Even with the most secure password, using it on several applications and websites can make it insecure. With the increasing global data breaches, there is a high chance that your password is stored in some applications or sites. Fortunately, some sites do not store passwords in plain text, meaning that the hacker only compromises the password hash in case of a data breach. In that case, a hacker only requires less time to get the password.

Password manager security

Most users resort to password managers to deal with password reuse. Most of the password managers are easy to use and cross-platform. That means that one can store their password database in the cloud and access it via a web interface from your mobile phone or PC. Password managers deal with password reuse and can generate unique passwords. However, such passwords can be challenging to remember.

Length or complexity

The most common password policy that administrators enforce in web applications, among other systems, is the length and complexity policy. However, the policy is weak.

A few websites can check how long it can take a hacker to crack their password using a brute-force attack. For instance, if you feed an 8-character password with special characters, upper and lowercase, as well as numbers into the website, it can determine how long it can take to break the password. The sites can guide you on how to increase the complexity of your password.

Is length enough?

If the brute-force method is the only password cracking process, password length would be the best way to outdo attacks. However, dictionary attacks can decrypt passwords with commonly used words. A password with similar letters would be a hard nut to crack. If you use fake words that are easy to memorize, you can avoid the dictionary attacks.

A false sense of security

Force users to change their passwords regularly to increase your password security. Web applications and other systems use this common mechanism. Such mechanisms store hashes of old passwords, limiting the user to reuse their previous passwords.

However, this policy introduces a false sense of security since most people only one character at the end, and they keep replacing it after every few months. Therefore, it is better not to implement this mechanism in your web application since it does not prevent dictionary attacks.

Clear text passwords

They are passwords stored in configuration files in exact text or passwords that remain visible even after the end-user types them. They are vulnerable to password hacking, be it as configuration files or inputs.

The passwords pose a threat to password security since they expose the user’s credentials and allow attackers to act as legitimate users to access the accounts.

Multi-factor Authentication

Nowadays, the most robust defense against password attacks is the (MFA) multi-factor authentication. The mechanism is also part of most compliance requirements of DSS, PCI among others.

The common (MFA) method is the one that the web application sends a one-time code SMS to the user’s mobile number. However, hackers compromise such mechanisms using SIM-swap attacks. They trick the mobile operator into providing a duplicate SIM card of the user and use it to get the SMS with a one-time code.

To avoid that, use one-time-password (OTP) solutions like FreeOTP or Google Authenticator. Mobile apps send a push notification to your phone or send a one-time code generated by the app.

Password recovery systems

Applications with systems that allow users to reset or recover their password can also offer hackers the opportunity to access your vital information. The remember, a forgotten password mechanism is a possible way of authenticating a user, but it must be strong.

Hackers can act as users and attempt to access users’ accounts by trying resetting the password. Applications that depend on security questions like a pet’s name or birthday are insignificant for authentication since attackers can access vital information for users in social networking accounts.

Hardware tokens

It is the ultimate security option for MFA. They are now becoming popular, especially the hardware keys. The idea has been in existence for several years and was used by certain software designers to combat piracy. Besides, there are keys one can use for mobile phones and computers. They can use either a wireless one or a physical interface.

The hardware security mechanisms are now part of regular computing machines like laptops and desktops. Computers have hardware modules that offer encryption technologies. Operating systems like Windows 10 is compatible with the FIDO2 standard. That means that any device with Windows 10 and the hardware module can function as a hardware key. Nowadays, phones come with facial recognition or fingerprint scanners. With all these features and password combinations, one is sure of extra security.

All passwords matter

Most web application developers think that when an unprivileged user experiences a password breach, it will not endanger the web application. However, that is not the case. For instance, if a hacker uses SQL injection to a list of password hashes and hacks a user’s password, they can use it to gain access to privileged accounts in the system. The hacker can also get a user’s password via email phishing, social engineering, or malware, which is beyond a web application developer.

Therefore, the application developer should make sure that users are using secure passwords at all times. You can test for weak passwords or use a password security mechanism in your application.