Welcome back to another action-packed month of cybersecurity news! We had some pretty heavy topics to cover the last two months, so let’s get back on track with the usual TCE Strategy tone that makes cybersecurity fun. From the magic of password keepers to the dangers of selling your old electronics, let’s see how this month’s cybersecurity news can help us make better decisions about what is Secure Enough for us, the companies we work for, and our families.

Disposing of electronics

Yes, I still have a house phone. It’s a dying breed, but it still serves a purpose worth keeping in our household. However, a lightning strike power surge took out my wireless handsets that plug into the house phone, and, well, wireless house phones aren't flying off the shelves these days, making them more difficult to purchase. So, I was excited to find a matching set of 6 used handsets on eBay, and they arrived in great shape. Terrific! It was when I plugged them in that things got interesting...The previous owner had taken the time to program in the phone numbers of LOTS of friends and family, but didn’t delete them when they sold the phones. I'm not sure who Audrey or Barb or Bob or Margaret or Shayna or Steve are, but I had all of their phone numbers and first names. Here is a redacted partial list:

AUDREY XXX-XXX-X815

BARB CELL XXX-XXX-X315

BOB&MARGAR XXX-XXX-X940

CHAD XXX-XXX-X330

DANNY CELL XXX-XXX-X380

DANNY HOME XXX-XXX-X293

DAVID CELL XXX-XXX-X569

EILEEN CELL XXX-XXX-X483

ERIN CELL XXX-XXX-X047

GARY CELL XXX-XXX-X803

JESSICA XXX-XXX-X834

JESSICA CELL XXX-XXX-X565

LARRY CELL XXX-XXX-X337

MARJORIE CELL XXX-XXX-X793

MARJORIE XXXXX XXX-XXX-X339

MARV XXX-X117

MAXINE XXX-XXX-X092

MIKE CELL XXX-XXX-X931

ROBERTA CELL XXX-XXX-X822

ROBERTA HOME XXX-XXX-X763

RON CELL XXX-XXX-X413

ROSS CELL XXX-XXX-X074

SARAH CELL XXX-XXX-X883

SASHA CELL XXX-XXX-X989

SD POLICE SERVIE XXX-XXX-X154

SHAYNA XXX-XXX-X084

SHAYNA CELL XXX-XXX-X225

STEVE CELL XXX-XXX-X305

WARRIOR XXX-XXX-X238

YELLOW PAGES 800-935-5697

Takeaway: Imagine how useful this information would be for me to impersonate these people. I could call Ross while I pretend to be a police officer and tell him that Shayna was in a car accident and she's being held in jail on a DUI charge. She needs $5000 wired for bail or she is going to spend the weekend in jail. I can even spoof caller ID and call Ross from Shayna's phone number and say that I took her phone from her while she's sitting in a jail cell. Malicious calls like this happen all the time, and it's information like this that gives the bad guys an advantage. It's critical to wipe your electronics before reselling them, or even disposing of them.

Wired data breach

I'm a big fan of the magazine WIRED because they cover a lot of terrific cybersecurity topics, but they have some egg on their face because of a data breach a few months ago. A hacker called "Lovely" stole 2.3 million WIRED customer records that included "full names, email addresses, user ID, display names, account creation and update timestamps, and in some cases, last session dates." Thankfully in this case passwords were not stolen, but in many other breaches, passwords are part of the exposed data. This breach underscores a very important point: if you are using the same password everywhere in your online life, when any website gets breached, it could expose the password you use for your email account, your banking accounts and so on. A password keeper solves this problem, in that it will make very complex passwords for every online service you need, they will all be different, and the magic lies in where you only need to remember one password to open your password keeper. I'm a fan. Unfortunately, I can't recommend LastPass because they have had some very notable breaches themselves, but most of their competitors have not. If using a password keeper isn't something you are likely to do, at a minimum use a completely unique and complex password to protect your email account(s) and enable Multi-Factor Authentication (MFA), as your email account holds the keys to your cyber kingdom: if you can't remember a password for some website, you click "forgot password" and then it will send a password reset email to your email account on file. If a cybercriminal can compromise your email account, they can compromise many other online accounts you have. 
 

Until next month, please stay safe!

TCE Strategy in the News

Interesting Articles