Something Smells Phi-shy
I was going to talk about password manager, but I have been running into more and more phishing emails while working. I then realized that we are now in the era of cyberpunk. To quote the famous line from the "Hackers Manifesto."
" This is our world now... the world of the electron and the switch, the beauty of the baud. "
Looking at the SolarWinds and Microsoft Exchange hack, we can see now that criminals and nation-states are moving away from the physical world and going into the digital world.
You shouldn't only rely upon big tech companies to protect from cybercriminals. There is only so much that Google and the other big five can do to protect you. Moving forward, I want to go over the ways criminals try to get your information. Let's start with Phishing emails.
What is a Phishing email?:
Phishing is when a cybercriminal sends an email that looks to be sent by a reliable source to trick you into sending passwords, credit card numbers, and other PII (Personal Identifiable Information).
One technique used is for a cybercriminal to send an incorrect URL sent as a shortened URL that will redirect you to a download page that will have malware. Another trick is to have a fake page with a keylogger (a program that can track the inputs from your keyboard) to get your passwords and usernames.
How do I protect myself?
There are some simple ways to protect yourself from phishing attacks.
1. Use two-factor authentification. All websites in their settings have the option of setting up 2FA. I would suggest against using SMS because SMS text can easily be bypassed. Authenticator apps and Yubikey are safer options. This will make it so even if your passwords are discovered, they will need physical access to your phone or yubikey.
You and your Yuibikey — Alex's infosec journey (atphinn.com)
2. Update. Update Update. Whenever Windows or Mac tells you there is an update, please do it. Yes, it is annoying, but what is more annoying is dealing with identity theft. Apple updates are usually aways when a vulnerability is found. Windows have a patch Tuesday, the second Tuesday of the month.
3. If you receive an email or chat with a link, hover over the link to confirm if it goes to the actual website. It is safer to go to the site directly and not click the link in the email.
4. Check for misspellings and grammatical errors. I can confirm that big companies have people who specifically write client/customer-facing texts and check multiple times for spelling and grammar errors.
What do I do if I receive a phishing email?
If you receive a phishing email at work, notify your IT/Security team, even if you are unsure. Their motto is better safe than sorry. I was at a company that got hit with Ransomware from phishing, and we were down for a month, and that was a lot of sleepless nights that the IT team has. They instead have a red herring than a month-long fix.
In your personal life, the same thing applies. Even if it looks somewhat suspicious, report it. Gmail, apple mail, Outlook all have a report spam button in their toolbar and block the email address.
Currently, this is how cybercriminals and scam artists work. They send a text, email, or call to trick you into giving you PII. By doing the above, you will be able to protect yourself.