Papers

Published on February 2nd, 2018 📆 | 7432 Views ⚑

0

Protect Your Identity, Personal Data and Property

iSpeech

Between malware, botnets, viruses, worms, ransomware and DDoS attacks, it may seem impossible to protect yourself online. The trick is to stay abreast of all the latest threats and to know what to do when the worst happens.

That's why we've created this page as a one-stop shop to safely protect your data and privacy. We're going to keep changing and expanding this page, so please use the comments to let us know what you'd like to see — and don't be afraid to hit us up with any security questions you may have.

Latest Security Alerts

— More than 500,000 Windows machines, mostly servers, have been infected by a massive coin-mining botnet that has generated at least $2.3 million in Monero cryptocurrency for the botnet's operators. ADVICE: Keep your Windows build updated to the latest version (the botnet uses infection vectors that have been patched), and install and run robust antivirus software.

— A new free tool automatically locates and penetrates of Internet of Things and smart-home devices. It combines the Shodan search engine and the Metasploit exploit tool. ADVICE: If you can, change the default administrative password and update the firmware on every smart-home device you own. Consider buying a network-security appliance such as the Bitdefender Box or a security-oriented router such as the Norton Core.

— The popular, free 7-Zip compression program has two serious security flaws. ADVICE: Get the latest version of 7-Zip here.

— Very serious security flaws have been found in Intel, AMD and ARM CPUs that could let rogue applications steal data from other applications or even from the system itself.

Current Scams

Tech-support scams: These usually come as random phone calls from technicians claiming to represent Microsoft or "Windows." They'll say there's something wrong with your computer, and that you need to install software so that they can get remote access to it. Advice: Hang up.

Fake IRS/police scams: These are phone calls or text messages from people who claim you've broken the law or owe back taxes. They'll say you face immediate arrest unless you pay a fine, often via Western Union or a similar service. Advice: Ignore them and report any such calls to the real police.

Fake antivirus: These mostly arrive as pop-up messages in a web browser. They'll say your computer is infected, and that you need to purchase and install an antivirus product immediately. Advice: Don't do it — the products are almost always bogus, and some might actually be malicious.

Security Terms You Need to Know

Banking Trojan: Malware designed to break into online bank accounts. Banking Trojans often infect web browsers, then lie in wait until the user logs into an online bank account. The end goal is to transfer money from your account into accounts controlled by cybercriminals.

Botnet: A network of otherwise unaffiliated machines running malware that has them working together on particular tasks. It puts the infected machines — often thousands at a time — to work cracking passwords, sending out spam or distributed denial-of-service attacks.

Cybercrime: An action that uses a computer, smartphone or computer network to commit a crime, or to target any of those devices during such a crime.

Data Breach: The accidental or deliberate release of digitally stored sensitive information to unauthorized parties. If a hacker were to break into Facebook's user database, that would constitute a data breach, but so would a health-insurance executive losing his laptop.

Identity Theft: The assumption of another person’s identity for financial or personal gain. In its mildest form, it may involve credit-card fraud; a worse scenario might involve a person who obtains mortgages or other loans while posing as someone else.

Malvertising: Malware that attempts to infect computers through infected browser ads. In many cases, you don’t even need to click on the ad to get your computer infected.

Malware: Any kind of unauthorized software designed to harm or steal from the user or the host computer system. Malware generally includes viruses, worms and Trojans (which refer to different infection methods) and spyware, rootkits and ransomware (indicating different kinds of post-infection activity).

Ransomware: A form of malware that locks up a computer screen, or encrypts the user’s personal files, and then demands that the user pay to free up the screen or files. Ransomware also hits Android devices and, occasionally, Macs.

Social Engineering: Tricking a human into doing something that compromises security. For example, today’s phishing emails trick you into opening malicious email attachments by saying you need to pick up a package, pay an invoice or respond to a lawsuit.

Spam: Unwanted messages, usually touting a service or product, that arrive in your inbox. Spam also comes via text messages and instant messages. Some spam contains malicious attachments, but that's rare, and most is perfectly legal.

Trojan or Trojan horse: A form of malware that hides inside a benign-seeming piece of software. The Trojan activates when a human opens the software. Malicious email attachments are usually considered Trojans, as is malicious software hidden inside web pages.

Virus: A form of malware that can’t exist on its own and must persist as a malformation of the code of a host piece of software. Viruses usually spread when infected files are copied from one computer to another. When the infected files are opened on a new machine, the virus will replicate by copying its own code from an infected file to an uninfected file.

VPN: A virtual private network creates a secure "tunnel" through the internet, encrypting all internet traffic between your computer or smartphone and a server on the other end. Companies use VPNs so employees working remotely can securely access the company network.

Worm: A form of malware that exists on its own, as a stand-alone program, and that can spread itself from one computer or device to another along a network.

Zero-Day Exploit: An attack that exploits a previously unknown software or hardware flaw. It's called a "zero-day" because it appears before software developers have had time to fix the flaw, or to prepare security software against the attack.