Doug Lhotka

Technical Storyteller

Opinions and commentary are mine, and do not reflect those of my employer.

(C) Copyright 2019-2023
Doug Lhotka.
All Rights Reserved.
Use of text, images, or other content on this website in generative AI or other machine learning is prohibited.

Equifax Breach – Have you frozen your credit yet?

By

I don’t usually do breaking news, but this one could be significant.  Equifax, the US credit reporting agency is saying that up to 143 million records could have been disclosed.  This happened on July 29th, and was just disclosed today.

They state that core credit report databases were not breached (which would be a massive problem), but that PII, including social security numbers were likely exposed.  They’re executing the typical ‘one year of credit monitoring’ playbook that I wrote about in June and my advice still stands:  get a freeze instead.

If you haven’t frozen your credit – and your kids – now would be an excellent time to do it:  instructions here.

The Problem of Android

By

(c) Depositphotos / @abidal

I’m an Apple guy, and have a love-hate relationship with their recent product strategy, and the tight control they keep over the ecosystem.  The downside is that we’re stuck with some bad decisions (like building apps that expect to be online all the time), but the upside is that everyone gets access to updates at the same time – Apple has the most up-to-date user base of any major computing platform.  Android, not so much.

Android took the opposite approach – open code base, licensed to manufacturers to customize, and then further customized by carriers.  The advantage to that is lower cost and wider adoption, but it comes at a significant price for security.  When Google releases a new version of Android, only their own devices immediately receive the patch.  Everyone else has to wait for 1) the manufacturer to test, certify, and release the patch, and then 2) the carrier to do the same.   That assumes of course, that both actually bother to do the work to make updates available.  The net is that the vast majority of Android devices are running known-insecure versions of the OS.

I’m seeing a broad movement among businesses to tighten controls over mobile OS versions, and to apply the same policies to both corporate owned and BYOD devices:  If you’re not N or N-1, you can’t use your device.  That means that those old iPhone 4’s get retired too, by the way.

So what to do?  Well, some would say ‘jailbreak’ and install your own code.  There may be something to that, but you run into serious risks there too.  Most jailbreaking tools are from the shady side of the internet, so you never really know what you get.  Most companies block jailbroken devices from business use (all really should).  It’s also technically beyond most users, so let’s leave that off the table.

The next option is to only purchase devices that get updates directly from Google.  That limits choices significantly, but as a side benefit, you don’t get the pre-installed spyware that comes with many of the dirt cheap android phones – that’s how those companies subsidize the phone.  Buyer beware.    This is a hard choice for businesses because it largely erases one of the advantages of Android over iOS (cost), but it’s one I’m seeing a number of organizations do.  For individuals who buy Android devices, it’s the one I’d recommend.

Next is to buy cheap devices, and simply dispose of them when the OS expires.  That’s all well and good, but it’s expensive, time consuming, and you have a window of vulnerability during the transition.  Of course, banning Android completely is an option too, and I do see some of that happening.

But the most common approach I see these days is some form of risk limiting via containerization, or other restrictions on what the devices are allowed to do.  Containers can be bypassed (e.g. compromise the underlying device with a keylogger), but do provide reasonable protection for moderate risk content.  Organizations should leverage their data classification projects to determine what information is suitable for mobile device access, and potentially change that based on how current the OS is.

I know this challenge is top of mind for Google’s Android team, and they’re starting to look at separating the Carrier bloatware layer from the underlying OS as well as other measures to speed up manufacturer release.  I hope they succeed – we need an alternative to keep Apple on their toes.  In parallel, consumers shouldn’t buy devices without clear statements of patch release timelines from vendors and carriers.  Until all that happens, and we have a better option, Android users beware.

Armor up! Personal Cyber Safety

By

A friend of mine recently lost their smart phone.  They did most of the right things – sent the wipe signal to it, and changed their passwords.  Unfortunately, they missed telling the cellular carrier, and it turns out that someone had simply moved the SIM card into another phone and used it to make hundreds of dollars in overseas calls (much like we used to see with calling card and conference call numbers).  It also meant that any inbound calls and SMS messages would have rung on that stolen phone – something to think about in the age of SMS-two factor authentication.

He asked me for an updated list of suggestions on how to get secure and stay safe online, and rather than doing a one-off, I thought I’d share here – feel free to add suggestions in the comments, and I’ll keep this current.  The first is the most important, and the rest are in no particular order.  Many of these are involved topics that deserve posts in their own right – this is just a quick summary.

[Updates at the end]

#1 – Keep Current

Make sure you’re on a current and supported operating system, and keep up with patches.  For Windows that means 7 or higher, for Mac El Capitan or higher, and for iOS it means 9 or higher.  For both Windows and Mac, that’ll change soon – Windows 10 and Sierra are better options.  Android is much harder unless you get updates directly from Google.  If you don’t, you’re behind – that’s one of the reasons I don’t recommend non-google Android devices.

This also means keeping your applications up to date.  If you still have Office 2003 because it’s all you need, unfortunately, you’ll have to pay the Microsoft tax and get a current version to get patches.  Ditto on the Adobe products, and pretty much everything else.

For both OS and apps, apply patches and updates on a regular basis.  For Windows machines, makes sure you watch for ‘Patch Tuesday’ and apply patches right away – often the bad guys release new malware shortly afterwards that attacks unpatched machines.   We all find it hard to keep up with patches (Window takes far more care than Mac), so when possible, turn on automatic updates.  Which brings us to the importance of the next item:

 

Backups

Things will go wrong.  Consumer cloud has no guarantee of backup or restoration of data, so don’t trust Google, Apple, Microsoft, DropBox, or any other service as the sole place your information lives: any critical information (i.e. family photos) should live in at least two physical places, one of which should be in your personal controls.  For example, one of the first things I disabled in Sierra was the ‘automatic migration of data to iCloud’.  Aside from not controlling what’s uploaded, the last thing I’d trust a consumer-grade service to do is delete anything off my machine automatically.

Backups should be encrypted (see below), and at least one stored offsite – either a cloud-based backup like CrashPlan, or a drive in a safety deposit box or at a friend’s house.  If you use cloud backup, remember that they don’t work for things like virtual machines, and can blow out your data charges.

So I backup my iOS devices to my local computer (not iCloud), then backup the Mac using Time Machine (for the oops I deleted it situations), and Carbon Copy Cloner (www.bombich.com) for my disaster backups.  CCC has saved my bacon more times than I can count, and I highly recommend it for Mac users.

I also strongly recommend that at least one of your backups be physically disconnected from your computer when not actively backing up.  That’s the single best defense against ransomware.

 

Securing the browser

Absolutely run a current browser version.  I recommend using uBlock Origin and Privacy Badger to cut down on the worst of the tracking and funky sites.  Don’t use shady extensions like video downloaders.  To be extra safe, use two browsers – one for general browsing, and one for sensitive sites.  Be careful of typo-squatting sites.  That’s one reason I like 1Password – it validates the URL before pasting in credentials.  Stick with one of the big three – Edge, Firefox, or Chrome.  Retire Internet Explorer.

 

Trust the cloud – sort of

There are three kinds of cloud services:  free/consumer, and enterprise.  Free services monetize you in some fashion (more below), usually by selling your data to advertising – and I recommend avoiding them.  This includes services like Gmail, Facebook, Twitter, and such – if you’re not paying for it, you’re the product, not the customer.

iCloud is paid for as part of buying Apple products, and while Apple uses the data for marketing and product development, they don’t sell it to third parties, so it’s somewhat better.  One thing that all consumer services have in common is that they disavow any responsibility for data loss or disclosure.

So, for backups and email, I recommend paying for the service.  You’ll get much better responsiveness and much less privacy compromise.  And make darn sure the data is encrypted before uploading.

 

Passwords & Password Managers

That’s especially true of Password Managers.    I’m not a fan of cloud-storage for my password vault – it’s too inviting a target.  That’s one of the reasons I use 1Password from www.agilebits.com – they offer a local sync option.  But using one with the cloud is far better than not using one, and I have a number of family and friends using the 1Password cloud options.  I’ve written recently about 1Passwords migration to the cloud, and while I have concerns, it’s still the best option out there.

Your password manager password needs to be a good one – a passphrase is best.   The new advice is to pick four or five words:  cheetah shark Saturn smiley mayonnaise.  You’ll remember it much easier than a random set of characters, and most good cracking tools now easily bypass backwards words, replacing letters with numbers, and all the other tricks.

All this implies, yes, use a password manager that generates unique random passwords for each site.  That way you only need to remember one single password (hence 1Password) that’s really good and strong, then it does the rest for you.

Note:  Do not use the web-version of a password manager.  Use the application on a device that you control.

 

Lie

That brings me to one of the toughest ones – lying to sites by intent.   This falls into two categories – lying for protection, and lying because it’s none of their business.  For the former, when a site asks you to create a secret question and answer, lie – use a random word, and then store that in your password manager.

More importantly, when a site asks you for information it doesn’t need – your birthday for a shopping site for example, make something up that’s completely random.  I started getting retirement spam after using a 1940’s date…interesting.

This is also true for sites or companies that ask for ‘mother’s maiden name’.  Go change all those and record the new random answers in your password manager.  For companies that continue to insist on the single worst authentication mechanism (last 4 of SSN), pester them to see if you can get it changed.  If not, then we should all shame them on social media.

 

Use two-factor

When offered, use two-factor authentication.  It’s not perfect, but it’s better than just a password.  Do not use just device-based authentication though, always use both factors.

 

Disk/device encryption – backup and machines

Turn on whole disk encryption on your system.  For mac: https://support.apple.com/en-us/HT204837 and for Windows: https://support.microsoft.com/en-us/instantanswers/e7d75dd2-29c2-16ac-f03d-20cfdf54202f/turn-on-device-encryption

 

Set mobile devices to lock and wipe

If you have options to disable biometrics, and force a passcode after a handful of attempts turn it on, and then turn on the options to wipe the device after 10 failed attempts.

And use something stronger than a 4 digit PIN – at least 6.  Alpha numeric is better.  Pick one that’s not your, your spouse, your kids or any other date, address, phone number, or anything else that’s easy to guess or on social media.

While you’re at it, set airdrop to ‘contacts only’.  Better to stay off the grid.

 

Biometrics

Biometrics are a mixed bag.  Right now there’s tons of snake oil out there.  The only one that I trust for regular use is the fingerprint reader on the iPhone – and that’s because of the lock/wipe options.  I do not use it on a computer – type the passphrase instead.  Facial recognition, swipe patterns, and such can be spoofed trivially, and many consumer grade fingerprint readers can be as well.
Stay off public (and other) computers.

Using a public computer is like licking the seat in an outhouse.  Just don’t.  Ever.  Your friend’s computer isn’t quite as bad, but unless you know that they have good hygiene, it’s best to only use your own devices.

 

Uninstall Flash and Java 

It’s time to get rid of these two applications from your personal machines.  Corporate machines should too, but that’s a whole more involved story.

Flash:

Mac: https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-mac-os.html

Windows: https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-windows.html

Java:

Mac: https://www.java.com/en/download/help/mac_uninstall_java.xml

Windows: https://www.java.com/en/download/help/uninstall_java.xml

If you have to use Flash, use Chrome (but disable all the tracking first).

 

Get accounts before the bad guys do

As Brian Krebs recommends, get accounts on https://www.ssa.gov/ and IRS.gov https://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-it-for-you/ before someone does it first.

 

Credit Freeze

And again a shout-out to Brian, for his information on getting credit freezes from all four agencies.  Credit monitoring is useful for telling you it’s been compromised – a freeze protects it up front.  https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/

If your homeowners insurance offers identity theft protection as a rider, that’s not a bad investment for the price.

Note:  If you have kids, freeze their credit too.

 

eMail security

Email is not private.  If you have a standalone email application, using SSL only keeps it secure between your machine and the server.  If you do it in the browser, same situation – and you’re also exposed if the browser is compromised.  Never email any sensitive information like bank account numbers, social security number, credit card numbers, and so on.  If you’re emailed a new password after a reset, immediately go change it on the site itself.

Note:  Yes, there are ways to technically encrypt email end-to-end.  It’s not clean or easy, and pretty fiddly.  If you absolutely positively must email something sensitive, my recommendation is to encrypt the document itself then attach that to a regular email.  That’s beyond the scope of this post.

Because password resets are done via email, this is the most important account you have.  It must be used with a robust random password, and you should never login from any device that you don’t own and control.  If the bad guys get your email, they get all your other accounts.

 

Have a throwaway email

So that means having more than one might make sense.  Ever have a site that you might want to get information from, but don’t want them to have your details?  Get and use a throwaway email account – or a junk mail account to use for all of them.

 

Never click links

And never, ever, click on any link in anything on that junk account.  That’s good practice for all email and all links.  Go manually to their site, and login by hand.  Related – stop sending emails with links in them (internal corporate communications I’m looking at you).

 

Stay off the seedy side of the internet

It goes without saying, stay off the seedy side of the internet.  Get legal software and content, avoid torrents, and naughty sites.

 

VPN/Public Hotspots/Cellular Data

I avoid using any public hotspots – it’s far too easy for someone to sniff what you’re doing, Use your cellular hotspot when you can.  For better protection, use a personal VPN like www.getcloak.com to prevent traffic monitoring and cellular carrier supercookies.  This includes hotel internet.

 

Never respond to inbound phone calls

If you get a call allegedly from your credit card company, bank, insurance company, or similar company, don’t give any information or acknowledge that you even have an account.  Politely thank them, and call the number on your credit card or statement (not the one they give you over the phone).  Hiring a fake call center is trivial.

 

Firewalls & Antivirus

Turn on the Firewall on a Mac https://support.apple.com/en-us/HT201642 and Windows https://support.microsoft.com/en-us/instantanswers/c9955ad9-1239-4cb2-988c-982f851617ed/turn-windows-firewall-on-or-off

As a minimum, turn on Xprotect on the Mac https://support.apple.com/en-us/HT201940 and Windows Defender on Windows: https://support.microsoft.com/en-us/help/17464/windows-defender-help-protect-computer

On both Mac and Windows use www.malwarebytes.com to scan and remove malware, including adware.

On Windows, seriously consider paying for antimalware software.  At this point I’d probably recommend Symantec over the alternatives – the free solutions aren’t worth it.  If your bank offers Trusteer Rapport, download and install it.

Oh, and disable file sharing if you haven’t already.

Don’t tweak the bad guys

I know folks who will keep the ‘tech support’ spoofers on the line, or text with the thieves who stole a phone, or respond to phishing emails with ‘nice try’.  Don’t.  These folks are very good at what they do, and most of the time you’re just a drive by as they conduct a massive campaign.  But if you get them mad and they target you, it’s a whole different ball game.   Respect their skills.

In the end

Be skeptical, be wary, and be prepared to be hacked.  I had a bank ask me to send mortgage paperwork via email.  I said no.  I’ve had calls to my phone that spoof my own callerID.  I hung up.   I’ve also had really clever phishing emails that I almost clicked.  I did – to delete.  We’ve had our credit card stolen several times – caught it by watching my bills weekly.

As one of the characters in Harry Potter was fond of proclaiming, ‘Constant Vigilance’.

 

[Update]

Shred it

Shred anything and everything that has your information on it.  That includes envelopes from bills (they identify targets for the bad guys to hit), junk mail, receipts, boarding passes, hotel room cards, credit cards (unless metal – cut those with tin snips), conference badges (I punch out the RFID chip as soon as I get one), old business cards, and so on.  Bar codes are the most insidious as they can hide a lot of personal information, as Brian Krebs points out in the link about boarding passes.