Visiting a website and putting in personal details is not quite as
simple and straight forward as it used to be, with cyber-criminals
on the prowl to hack into website databases to steal personal
particulars.
On Wednesday, eBay said that its corporate network was hacked and
hackers made away with customer details such as their names,
encrypted passwords, e-mail addresses, home addresses, and phone
numbers. Cyber-security experts said such information, while not
financial in nature, could be useful for crooks to send spam
e-mails, fill-up bogus applications and more.
What can consumers do to protect their personal data when they are
surfing online? The Straits Times speaks to cyber-security experts
for some handy tips.
1. Avoid easy-to-guess passwords
One of the cardinal sins when it comes to cyber-security is to use
a weak password that is short and made up of words found in the
dictionary.
Using passwords that are easy to guess are a no go, too, because it
makes it that much easier for cyber-crooks to use software to
figure out what consumers' passwords.
Notorious examples to avoid at all cost include: password, 123456,
111111, 123123 abc123, Admin and iloveyou.
These are among the 25 most popular passwords from 2013 compiled by
security and productivity software firm SplashData.
2. Get "wacky" with passwords
Cyber-security experts advise using a complex password to secure
online accounts.
To make a password strong, Sophos senior security adviser Paul
Ducklin suggested using one made up of 12 to 14 characters. It
should comprise letters in upper and lower case, numbers and "wacky
characters", which could include symbols like %, $, ^, +, - and
*.
Ms Macky Cruz, the security focus lead at Trend Micro, said
consumers could string a few words from a phrase they can remember
easily as a password, and then replace some characters with symbols
and use letters in upper and lower case.
Passwords should also be changed on a regular basis, said Mr Eugene
Teo, Symantec Singapore's senior manager for security response.
Another good practice is to use a two-factor log-in if it is
available, said Mr Teo. This could involve a password and a
one-time password generated by a security token.
3. One password for one account
Another bad habit among consumers is to reuse the same password for
multiple accounts, said Ms Cruz.
This is problematic because a hacker can use one password to log
into a variety of online accounts and pose as the victim. Things
get worse if the crook accesses an online account linked to payment
methods, as this means he is one step closer to stealing money from
the victim.
People who have trouble remembering different passwords for
different accounts might want to try out password managers, experts
advised. These can use one strong password to manage several online
accounts.
4. Revealing your pet's name online may be risky
Perhaps more worrisome is that with access to different online
accounts, a hacker can start creating a profile of the victim. The
hacker's job is made infinitely easier if a victim publicly shares
personal details online such as on social networking sites.
With that information, a crook could use it to guess security
questions - such as asking for pet's names a user unwittingly
disclosed in a Facebook post - to online accounts to reset a
consumer's password.
Users who use personal information as passwords - like their birth
dates or pet's names - should be wary of revealing such details
online for obvious reasons.
Crooks could also use a consumer's data to craft very targeted
e-mails to trick the victim to give-up more personal
information.
For instance, the hacker could pose as a Facebook friend and send
an e-mail to gush about seeing the victim's selfie on Instagram
with a celebrity at a fan meet. The hacker might then urge the
victim to check out a link to his own photos from the event.
When the victim clicks the link, he could be sent to a malicious
website that automatically downloads malware onto the user's
computer. This malware could then start sending the hacker a lot of
sensitive information about the user, such as log-in details when
he visits a banking website.
5. Information you should avoid sharing
Consumers should avoid storing or sharing credit card information
on retail, commerce, or social networking websites, said Mr
Teo.
They should also not provide more information than necessary when
signing up for an online account. If the information that the
website has requested does not make sense, then it probably is.
When posting online, such as on a public forum or mailing list, do
not share personal details, he added, because information shared
online can remain in cyberspace indefinitely.
6. How to figure out if an e-mail is bogus
Looking at an e-mail sender's name is not a good gauge of whether
the mail is bogus because it can look like the real deal.
More telling is the sender's e-mail address. If it looks really
strange and unrecognisable, chances are it is not legitimate. Any
links and attachments in the e-mail should not be opened as
well.
Also, if the message in the e-mail seems very terse and
uncharacteristic of a friend, the e-mail is likely to be a fake
one.
7. What you should do with bogus e-mail
Such e-mails should not be replied to as well as it can be a signal
to hackers that a user's e-mail address is actively checked, so
they might send over more spam e-mails.
Organisations typically do not ask for consumers' log-in details,
personal details or financial information in e-mails. Hackers do,
however.
So, if such e-mails arrive seemingly from a bank or a retailer,
they should be deleted. Consumers who are unsure should call up the
organisations to check, although dialling numbers in the
questionable e-mails should be avoided.
Other tell-tale signs include bad grammar and spelling mistakes in
the e-mail message, urgent sounding e-mails, and e-mails from
organisations users have no prior relationship with.
8. How to tell if websites and links are legitimate
By hovering the mouse cursor over a web link without clicking it,
it is possible to see its Web address. If the address comprises a
string of numbers, it is likely a bogus link.
Fake sites and links sometimes have addresses that do not tally
with the content or organisation stated in the e-mail. They may
also contain spelling mistakes of the organisation's name.
Legitimate sites that are secure also tend to have "https" in their
Web addresses instead of just "http".
Many Web browsers can also tell users if a website is legitimate.
Typically, if a green padlock appears beside the Web address bar,
it means the website has been verified to be run by legitimate
organisations and is a secure website.
Mr Teo said some security software can also help verify if a site
is a secure or malicious one, as well as determine if websites
called up in search engine results are safe to visit.
9. What to do when a website is hacked
If, like in eBay's case, a consumer learns that a website he has an
account with has been hacked and personal data could have been
stolen, he should change his passwords as soon as possible.
The password should be complex and also not be the same one used
for other online accounts.
Ms Cruz advised affected consumers to keep a close watch on their
online activities and look out for any strange transactions online
or in their bank accounts and credit card statements.
10. Closing an account may not mean end of story
After a data theft incident, some concerned users might close their
accounts to limit the risks from hackers taking over their digital
lives.
However, it does not necessarily mean the information associated
with the compromised account is safe. The data could still be
stored somewhere.
Mr Teo said one consideration for users is whether their
information on a website is encrypted from one end to another, and
stored securely.
Users will have to do their due diligence to check that a website
they want to sign up with is trustworthy. They could check out
website policies and look at the site's past history to determine
if past data breaches or security issues have been reported before,
said Mr Teo.
- See more at:
http://www.straitstimes.com/news/singapore/more-singapore-stories/story/10-tips-how-protect-your-personal-data-online-20140523#sthash.7FEa5Zrd.dpuf
