Cyber Threats


With all the craziness on the internet these days I decided to put together a general guide and very simplified overview of various things you need to be aware of on the internet that are jeopardizing your digital world.
With a little knowledge you can help protect yourself and others around you from getting scammed and potentially losing thousands of dollars.

I feel it is important to review this entire document so get a summary of the threats online.

To start with watch this 2 minute youtube video as it shows the severity of the dangers online.

Cyber criminals target city of New Orleans
https://www.youtube.com/watch?v=BDKZ7HMpEVw


Scams and Misleading Information
Scams can range in severity from trying to get your login info to stealing thousands of dollars from your bank accounts.
Typically most all scams play on your fears or they can be a complete deception.

When you get an email look at the from email that is often your biggest clue that it’s not real. When you are browsing the internet look at the address bar and see if the website is secure and if it is the website you are intending to visit.

Phishing Emails
https://www.phishing.org/phishing-examples
These emails are anything that attempts to mislead you and trick you into handing over your email logins and other information. The emails typically take on scare tactics to persuade you to click the link to fix a problem.
For example: "Your account is about to expire please take immediate action to prevent your emails form being deleted."
or "Your invoice is past due please submit payment immediately."

Once a hacker has your email credentials they can impersonate you and if that person is high enough in a company can even extort large sums of money from a company.

Pop Ups
https://support.microsoft.com/en-us/help/4013405/windows-protect-from-tech-support-scams
Popup Scams typically take on similar scare tactics that attempt to make you download or install a program which then opens a back door to additional hacking. These popups may look like a very real windows update notification. your biggest clue here is if it’s in a browser window it’s likely not real.
Also keep in mind Microsoft does not put their phone number on support messages.

Redirects (Browser Hijacking)
https://malwaretips.com/blogs/remove-browser-redirect-virus/
Redirects usually happen as a result of a bad plugin or extension that has been added to your browser. These will often change your home page to something new. They can also hijack your search engine and address bar so that anything you search for can be sent to one of their sites to make them even more money.
A very common tick that is used is to send you to a site that looks like the real site then then passes anything you type like your email login to you real site.
As a result your email or account will then be compromised.
Keep and eye on your address bar visiting microsoft.com is not the same is microsoft.com.windowssupport.net.
A real website will have a proper address followed by a slash microsoft.com/

Fileless Malware
https://www.techrepublic.com/article/fileless-malware-an-undetectable-threat/
Fileless Malware is extremely difficult to detect and prevent. This type of malware looks to exploit vulnerabilities in software like your web browser. By going to a website that is potentially unsafe your computer can get infected just by being on the website. They can also be loaded file attachments in email or downloaded programs.
The best way to prevent this type of threat is to ensure you are going to trustworthy websites and not installing random software.

Phone Call Scams
Jim Browning - https://www.youtube.com/channel/UCBNG0osIBAprVcZZ3ic84vw
Phone call scams can be down right scary if they are done right. These scams will often extort money form you in one way or another. Jim Browning has several videos where he reverse hacks the scammers.
These scammers will attempt to impersonate some agency of authority and make threats to your freedoms.
One example is the IRS scam. The scammer will call saying you are being investigated by the IRS and it has been discovered that you have not paid enough. If you don’t pay they will come to arrest you and you need to stay on the phone and work with them until it is resolved.

With any phone call scam do not be afraid to hang up. If you are at work and they call you back tell them to call the corporate office. Do not give them the number and hand up. Take note of when this occurred and notify IT of the attempted Scam. Any real and genuine issue will typically go through your corporate office through official channels.

Keep in mind that any phone number can be spoofed.

If you get a scam targeting you personally try to get as much information and see if you can get a call back number. Do not give any personal information even if they seem to know a lot. Do not call the number back. If they claim to be some agency you can lookup the information for the agency and call them directly if you feel it might be real. If you discover it is not real call your local non emergency number for the police and give them the information. Notifying the police is important if it turns out to be an identity theft issue.

Remote Computer Access
Do not give anyone remote access to your computer.
If anyone ask for access to your computer for any reason be sure to verify it is for a legitimate reason.
Lets say someone calls saying they are from Microsoft to say your computer has an issue and they need remote access to your computer.
First off Microsoft won't do that. You would have to call microsoft and if they request remote access they won't send you to team viewer or some other remote software site. They will send you to a microsoft.com site.
The other way to know if remote access is legitimate or not is if you are asked to use a trial version of remote software.


Malware and Viruses
Malware and Viruses can be very damaging and extremely disruptive. Depending on how bad the infection is it has the potential of being something as basic as a small program that sits and waits for instructions on what to do next or it could actively spread and bring down entire systems and networks and even as bad as taking down an entire city government.
https://www.youtube.com/watch?v=BDKZ7HMpEVw

There are many forms of Malware and Viruses. Some can log everything you type and send it to a server on the internet while others will hijack your browser and start showing you ads for anything and everything which can lead to more and more malware and viruses bing installed on your system.
The worst of these currently is ransomware which can be loaded by a trojan virus from a website or a email attachment.


Ransomware
What is Ransomware?
https://en.wikipedia.org/wiki/Ransomware
In short ransomware is a malicious program that has been run on your computer from an infected file that was received through an email attachment, fake update or even a fileless attack from a malicious website.
The ransomware program encrypts all the documents, images and other files on your computer and leaves you a ransom note telling you to pay a certain amount of money in exchange for a decryption key.
Some ransomware also transmits your data to a server to ensure that you pay or they will release some of the information if you don’t.
Ransomeware is such an issue currently that it is critical for you not install anything from unknown or untrusted sources.

As an example of how dangerous this is look at the city of New Orleans. Their entire city was taken down as a result of ransomware.
https://time.com/5750242/new-orleans-cyber-attack/

Nursing homes and healthcare providers have been cut off from medical record leaving them unable to provide medications which are resulting in life-threatening situations.
https://krebsonsecurity.com/2019/11/110-nursing-homes-cut-off-from-health-records-in-ransomware-attack/


Web Browsers
What browser do you use?

Internet Explorer - NOT SAFE!
This browser is not safe for todays internet. The latest version of IE was released in 2014.
While this browser is still on all Windows systems it is only there for compatibility with older applications and is not intended for every day internet browsing.
Microsofts own security chief says to stop using Internet Explorer.
https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/The-perils-of-using-Internet-Explorer-as-your-default-browser/ba-p/331732

Microsoft Edge - Ok if you have to.
While Microsoft release the edge browser as a replacement to internet explorer it is still not fully standards compliant.
This is about to change however as Microsoft is actively building a browser based on the same engine that the Google Chrome browser is based on.

 Google Chrome - Good options for every day browsing.
There are a couple privacy concerns at this time as Google appears to have changed what some websites can see about how your browser is setup. This can as a result lead to advertisers exploiting this and building a new way to identify you and track you on the internet.
Install link - https://ninite.com/chrome/

Mozilla Firefox - Great option focused on privacy and has a builtin monitor to check your info in data breaches.
Firefox at this time is the top of the list for everyday browsing. The new feature to help guard your privacy are unmatched currently by the majority of the other browsers out there. They also have an options to Contain Facebook and Instagram to reduce the amount of tracking done by Facebook.
The Firefox Monitor will also notify you of data breaches that may affect you. Unlike other browsers this feature extends to also show you a notification of breaches when you visit a site that has been part of a known breach.
Install Link - https://ninite.com/firefox/

Brave - The best browser for privacy and security.
Brave is focused on privacy and securing your information. By default Brave blocks ads so you don't have to install any ad blockers and it also has malware and phishing protection. There is also a very useful browser sync feature that doesn't require you to sign up for an account allowing you to keep your bookmarks, history, and passwords updated across multiple computers.
Install link - https://brave.com/

Other Browsers
While there are other browsers out there Brave is the best all round browser for protecting your privacy and blocking malicious trackers and sites and is actively maintained.


AdBlockers
AdBlockers are very important as they will help reduce the number of potentially damaging and misleading popups on your computer while browsing the internet.
The only AdBlocker I recommend is Adblock Plus (https://adblockplus.org/) it has been around the longest and is very affective. While no AdBlocker can block all ads this one works exceptionally well. By default it does allow acceptable ads. What this means is it will allow ads that are not intrusive to your browsing experience.
Be very cautious of other AdBlockers out there as there are many that pretend to be AdBlockers only to later reveal themselves to be malware and browser hijackers.


Passwords
Don’t use the same password everywhere. The first thing a hacker attempts is to try your compromised logins on other sites.
If your information is part of a data breach it would essentially make it simple to take over your digital life if you use the same password everywhere.
Longer passwords are safer. While shorter passwords are fine if you include special characters the longer the password is the harder to crack. These days as powerful as computers are 8 a-z character passwords can be cracked in about 3 minutes. Some hacker networks use botnets and can crack passwords in as little as 30 seconds.

Here are some very important questions to ask yourself!
What is your email password? Is your email password used anywhere else?
What is the first thing you do if you forget your password for your bank account?

If you email password is simple and used in more than one place you are setting yourself up to lose a lot.
An attacker that gains access to your email can see what bank account you have and can attempt to reset your password allowing them to gain full access to your bank account.
Always keep your email password unique and complex. Your email is the backdoor to most if not all of your online accounts.

Use this link to test how secure your password is https://random-ize.com/how-long-to-hack-pass.
Password Managers
Lastpass has the best option for free accounts.
https://lastpass.com/f?100979391
Lastpass encrypts all your information so that it is not even visible to anyone without your master password.
They also have a Security Challenge where they will look at the passwords you have saved and tell you if they are secure or not.
Using a password manager can also help you discover phishing attempts. Password managers detect the login pages of websites you use and associate the username and password accordingly. If you end up on a Phishing site the password manager likely will not give you an option to fill in the password as the Phishing site will not match the real site.

Two Factor Authentication
Enable 2FA everywhere you can. This way even if your account login is compromised an extra step is needed for the hacker to gain access to your accounts.

Protect your email!
Use a long password on your email and don’t use that password anywhere else. Your email is the doorway to your digital life.
As an example lets say you forgot your password on one of your accounts. The typical way to recover access to your account is to send a password reset to your email. As a result anyone with access to your email can take over any of your accounts.
They can also create rules in your email to prevent you from seeing certain emails and also setup a forwarder to send all your emails to another email account.


Keeping your computers safe
Installing system updates is important as it closes security loopholes that can be exploited by hackers.
Do not click on any popups saying your system needs a update of any kind. Use the operating systems built in tools to check for updates.

Having a good antivirus and anti-malware solution on your computer is critical to ensuring your information is kept safe.
There are many solutions out there but I am always a big fan of free solutions.

While McAfee and Norton are the biggest names out there the products they offer very often slow your computer down and come with fees.
One of the other options that is offered frequently when you buy a new computer is Kaspersky. while their product is good it is slower at scanning your system. It is not necessary to purchase this.

AVG Antivirus and Avast Antivirus are not as big and are no longer a good option as they once were. These two have essentially sold out to advertisers and make money off your browsing habits and computer usage. I now consider these two programs as Malware. Mozilla Firefox has also removed there extensions from their browser.

If you have McAfee, Norton, AVG or Avast on your computer I would recommend removing them.

Below are the options I would recommend. These options have so far proven very affective in keeping systems clean and clear of dangers.

Bitdefender Free
https://www.bitdefender.com/solutions/free.html
The free version is great and very effective in what it does. For the most part it’s an install and forget it’s there type of program. The only downside to the free version is there is no way to schedule a full scan of your system. The daily active scan is very good and if you remember to run a full system scan at least once per month there is no reason to purchase an upgrade.

MalwareBytes
https://ninite.com/malwarebytes
This program is very affective in clearing up potentially unwanted programs (PUPs) and can also remove tracking cookies put on your system by advertisers trying to make money on your browsing habits by monitoring your activity online.

CCleaner
https://www.ccleaner.com/ccleaner
The free version of this program can help clean up a few more things to keep your system running smoothly. The default settings are usually sufficient.

HitManPro
https://www.hitmanpro.com/en-us/hmp.aspx
HitManPro isn’t free but will let you scan you system for free. If you have a particularly nasty infection that nothing else can clear up. You can run this to see what else may be hiding on your system. If all the other tools fail sign up for the 30 day trial and then use it to clean your system.


Installing software.
Company systems. Please do not install any software without asking first.
POS systems. You should NEVER EVER install any software on these systems.
The POS systems also should NEVER be used to to browse any websites unless specifically allowed by IT.

Personal Systems.
Use http://www.ninite.com to see if the software you need is there.
Ninite is great in that it prevents additional software being installed at the same time.

If the software you need is not on Ninite make sure it is from a reputable source.
Don’t click on the first link in your search and download from file hippo or some other file sharing site.
It is best to go the the actual companies website to download the installer directly. Other file sharing sites could have compromised installers with malicious payloads that can infect your computer.

When installing software check what else the software is installing.
i.e. https://get.adobe.com/reader/
Adobe reader is a good example as by default it has other software installs checked for download. Be sure to uncheck these additional installs and install only what you need. Again if this is a company system you need to ask first.


Preventing Spam
This is almost impossible these days but you can try to reduce it but checking for the little “sign up for our new letter” check boxes or similar marketing options that are on almost every website. Very often if you sign up for any of these the list is shared with a 3rd party.
If you need to sign up for an account somewhere but don’t intend on keeping the account use a fake name and email if possible.

A lot of websites these days will make you verify your email so you can’t use a fake email. in that case use a temporary email that expires minutes after it’s used.

Temporary Emails
https://dropmail.me/en/



The information above was written in December 2019. The internet is constantly changing and new threats are constantly emerging so some information here may become out date. Tricksters will always be there and as a result even some out dated information can be educational in protecting your systems from infection.