|
Welcome back to another action-packed month of cybersecurity news! We had some pretty heavy topics to cover the last two months, so let’s get back on track with the usual TCE Strategy tone that makes cybersecurity fun. From the magic of password keepers to the dangers of selling your old electronics, let’s see how this month’s cybersecurity news can help us make better decisions about what is Secure Enough for us, the companies we work for, and our families.
Disposing of electronics
Yes, I still have a house phone. It’s a dying breed, but it still serves a purpose worth keeping in our household. However, a lightning strike power surge took out my wireless handsets that plug into the house phone, and, well, wireless house phones aren't flying off the shelves these days, making them more difficult to purchase. So, I was excited to find a matching set of 6 used handsets on eBay, and they arrived in great shape. Terrific! It was when I plugged them in that things got interesting...The previous owner had taken the time to program in the phone numbers of LOTS of friends and family, but didn’t delete them when they sold the phones. I'm not sure who Audrey or Barb or Bob or Margaret or Shayna or Steve are, but I had all of their phone numbers and first names. Here is a redacted partial list:
AUDREY XXX-XXX-X815
BARB CELL XXX-XXX-X315
BOB&MARGAR XXX-XXX-X940
CHAD XXX-XXX-X330
DANNY CELL XXX-XXX-X380
DANNY HOME XXX-XXX-X293
DAVID CELL XXX-XXX-X569
EILEEN CELL XXX-XXX-X483
ERIN CELL XXX-XXX-X047
GARY CELL XXX-XXX-X803
JESSICA XXX-XXX-X834
JESSICA CELL XXX-XXX-X565
LARRY CELL XXX-XXX-X337
MARJORIE CELL XXX-XXX-X793
MARJORIE XXXXX XXX-XXX-X339
MARV XXX-X117
MAXINE XXX-XXX-X092
MIKE CELL XXX-XXX-X931
ROBERTA CELL XXX-XXX-X822
ROBERTA HOME XXX-XXX-X763
RON CELL XXX-XXX-X413
ROSS CELL XXX-XXX-X074
SARAH CELL XXX-XXX-X883
SASHA CELL XXX-XXX-X989
SD POLICE SERVIE XXX-XXX-X154
SHAYNA XXX-XXX-X084
SHAYNA CELL XXX-XXX-X225
STEVE CELL XXX-XXX-X305
WARRIOR XXX-XXX-X238
YELLOW PAGES 800-935-5697
Takeaway: Imagine how useful this information would be for me to impersonate these people. I could call Ross while I pretend to be a police officer and tell him that Shayna was in a car accident and she's being held in jail on a DUI charge. She needs $5000 wired for bail or she is going to spend the weekend in jail. I can even spoof caller ID and call Ross from Shayna's phone number and say that I took her phone from her while she's sitting in a jail cell. Malicious calls like this happen all the time, and it's information like this that gives the bad guys an advantage. It's critical to wipe your electronics before reselling them, or even disposing of them.
Wired data breach
I'm a big fan of the magazine WIRED because they cover a lot of terrific cybersecurity topics, but they have some egg on their face because of a data breach a few months ago. A hacker called "Lovely" stole 2.3 million WIRED customer records that included "full names, email addresses, user ID, display names, account creation and update timestamps, and in some cases, last session dates." Thankfully in this case passwords were not stolen, but in many other breaches, passwords are part of the exposed data. This breach underscores a very important point: if you are using the same password everywhere in your online life, when any website gets breached, it could expose the password you use for your email account, your banking accounts and so on. A password keeper solves this problem, in that it will make very complex passwords for every online service you need, they will all be different, and the magic lies in where you only need to remember one password to open your password keeper. I'm a fan. Unfortunately, I can't recommend LastPass because they have had some very notable breaches themselves, but most of their competitors have not. If using a password keeper isn't something you are likely to do, at a minimum use a completely unique and complex password to protect your email account(s) and enable Multi-Factor Authentication (MFA), as your email account holds the keys to your cyber kingdom: if you can't remember a password for some website, you click "forgot password" and then it will send a password reset email to your email account on file. If a cybercriminal can compromise your email account, they can compromise many other online accounts you have.
Until next month, please stay safe!
|
