&Follow SJoin OnSugar
Business builder, strategic marketer, security analyst, published author, television news correspondent, actor. Deliver presentations throughout the United States and Canada on identity theft protection and personal security. Work with Fortune 1000, IT and startups. Launching, branding, messaging, representation, m&a facilitator, SEO and media. Current private equity projects include dynamic biometrics, credit card platform multi-factor authentication, security investigations and telemarketing fraud mitigation. www.IDTheftSecurity.com

Are You Part of the 70 Percent Who Are Clueless About Identity Theft?

Email |
|
By Robert Siciliano · August 17, 2016 · 0 Comments ·

You'd think with all the media attention regarding data breaches, hackers and identity theft, that consumers would be more focused on their privacy and how to protect their information from prying eyes. Surprisingly, almost 70% of the people are clueless about how a criminal might have got a hold of their personal information.

We all have a lot going on in our lives, and this is exactly how identity thieves like us. Ever lurking, these criminals are counting on us being too busy to give any thought to who we are sharing our information to. These people are always there, and just waiting for us to make mistakes.

The startling truth is that most victims of an identity theft crime, about 68 percent, don't know how their information was obtained, and 92 percent of victims have no idea who stole their information. A further 45 percent of identity theft victims don't realize they are a victim until they hear from their financial institution. There are more than 16 million victims of identity theft each year.

IdentityForce created a very informative info-graphic (nice job IdentityForce!) that shows the public are essentially sitting ducks, just waiting to be picked off by identity thieves.

 

What did you do to expose your information? Consider the following:

  • Got married
  • Gave too much info away on social media
  • Responded to a fraudulent text, message, or email

Additionally, major life events put you at greater risk of becoming a victim, such as having a baby or getting a new job.

When most of us consider identity theft, we usually think immediately of credit card fraud, but there is much more to it than that. Though credit card fraud is a common type of identity theft, these thieves can use the information they have obtained to do the following:

  • Open up a new bank account or credit card…and make changes to your billing address, leaving you none the wiser
  • Take out a large loan, such as a mortgage or vehicle loan, and never pay the loan off
  • File a fraudulent tax return, and taking the money that comes from it

If you find yourself to be a victim of identity theft, you could be dealing with the aftermath for years to come, and could struggle to clear your name and repair your credit score.

Fortunately, there are several ways that you can protect yourself from becoming a victim of identity theft. Some of this includes:

  • Only give out your Social Security number when it is absolutely necessary
  • Do not allow mail to sit in a mailbox
  • Don't respond to suspicious requests for personal information
  • Only create complex passwords for online accounts

Here's how to be part of the 30% of informed, alert, aware and cyber smart consumers: Take the "Identity Theft Risk Quiz" here: https://www.identityforce.com/resources/quiz To further protect yourself, sign up for an identity theft service, today.

Robert Siciliano CEO of IDTheftSecurity.com, personal security and identity theft expert and speaker is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen. See him knock'em dead in this identity theft prevention video.

Protect your Privacy on your iPhone

Email |
|
By Robert Siciliano · August 16, 2016 · 0 Comments ·

If you have an iOS device, you may be leaking personal information about yourself—without even knowing it—because you're not familiar with the privacy settings.

Apps have "permissions," meaning, they can access private information such as your social calendar stored on the phone, appointments, anything. Go to the privacy menu under "settings" to learn which apps can gain this access and deactivate it. And there's so much more to know…

Ads

  • The Limited Ad Tracking option controls how targeted the ads are to your habits, not the amount of ads you see.
  • This feature does not apply to ads across the Internet; only the iAds that are built into apps.

Location

  • At the screen top is a Location Services entry.
  • Explore the options.
  • Shut down everything not needed beyond maps or "Find My iPhone"

Safari, Privacy

  • Check out the Allow from Current Website Only option; it will prevent outside entities from watching your online habits.
  • You can limit how much Safari tracks your habits (by activating Do Not Track requests).
  • You can also disable cookies, but you won't prevent 100 percent of the data collection on you.
  • Want all cookies and browsing history deleted? Choose the Clear History and Website Data option.
  • In the Settings app, go to Safari, then Search Engine to change the default search engine if you feel the current one is collecting too much data on you.

Miscellaneous

  • Every app has its own privacy settings. For every app on your device, you should explore the options in every privacy menu.
  • Set up a time-based auto-lock so that your phone automatically shuts off after a given time if you're not using it.
  • The fewer apps you have, the less overwhelmed you'll be about setting your privacy settings. Why not go through every app to see if you really need it, and if not, get rid of it?

Robert Siciliano CEO of IDTheftSecurity.com, personal security and identity theft expert and speaker is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen. See him knock'em dead in this identity theft prevention video.

Your ransomware profile: passwords, profiles and protection

Email |
|
By Robert Siciliano · August 5, 2016 · 0 Comments ·

If your computer password contains the name of your dog, your favorite vacation spot, and an easy-to-remember numerical sequence, then you are breaking some basic rules of password safety. Even though "BusterBermuda789" might seem impenetrable to you, this is a password security experts say is vulnerable.

Here are five things to know about passwords:

  • A long, strong password goes a long way in helping prevent hacking.
  • Every account should have a different password.
  • A hacker's password-cracking software can easily expose any password composed of an actual word or proper name, or keyboard sequences. (i.e. Mike123)
  • Passwords should be a jumbled mix of upper and lower case letters, numbers and characters.
  • A password manager tool will make all of this easy for you. Here is one of password manager tool that can help you get started creating stronger passwords.

Need to Know: Four data protection tips

  1. Look out for suspicious emails: Hackers send out phishing emails to trick recipients into clicking a link or attachment that downloads a virus. Or, the link may take them to a website that tricks them into typing out login information. Fraudulent e-mails that look as if they could be from your bank, employer, medical plan carrier, the IRS, UPS, etc. But these will typically ask you do things the IRS and your bank would not. It's unlikely that your bank lost your account information, and now needs it urgently. Also ignore any email claiming you won a prize, or inherited money. Make sure not to click on any attachments in an email. Attachments are a common way that cybercriminals spread ransomware.
  2. Use 2FA when available. Always choose 2FA – two-factor authentication – option whenever it's available. Two-factor authentication is when a login attempt to an account prompts a text known as a One-Time Password (OTP) or voice-call to your phone with a unique numerical code that you can enter in a login field. Sign up for it if your account offers it. Yes, hackers have been known to lure users into texting them that special code. Always be suspect of any requests for your OTP.
  3. Protect online profiles. Many hackers get personal information from social media and then use those data pieces to figure out user names and your answers to security questions on your various accounts. Think about it: Do you really need to post the names of all your kids and pets, your wedding anniversary date (which you then might use in a password combination) and tell everyone where you work? It might be time to consider more carefully what you make public. And always make sure your settings are kept private, not public.
  4. Web and Wi-Fi safety. Consider multiple email addresses – not just multiple passwords – to distinguish from business and social contacts. Avoid Wi-Fi at hotels, coffee shops, etc. These are prevalent and convenient, yes, but extremely vulnerable. Never conduct financial transactions on public Wi-Fi. Use a VPN to secure Wi-Fi in remote locations. Your home network should use WPA-2 and not WEP connection. Ignore pop-ups.

A new level of awareness is needed as computer users navigate their professional and personal lives, and realize they are vulnerable – and their data is at risk – every time they log on to a system. Keep simple tips like this close by in order to avoid ransomware and other cyber threats.

Robert is a security analyst, author and media personality who specializes in personal security and identity theft and appears regularly on Good Morning America, ABC News and The TODAY Show.

Strengthen your Entry way Security

Email |
|
By Robert Siciliano · August 1, 2016 · 0 Comments ·

Did you know that often, burglars gain entry by simply kicking open locked doors? You just would not believe how easy this is. This is why it's crucial to beef up the strength of your house's doors. And this can be done several ways.

Deadbolt Strike Plate

  • It's ironic that this piece of hardware is called a strike plate, because an inferior type can be struck by the burglar's foot and blasted apart.
  • The strike plate is that metal piece that's on the door frame, where the deadbolt latches into.
  • A low grade strike plate serves the purpose of holding the door shut. Period. It's no match for a burglar's foot.
  • In addition to a sturdier strike plate, you need a full metal enclosure and longer screws. The burglar will then worry about breaking his ankle as he continues to try to budge this hardware—which is possible, if he's persistent, has a decent kick and doesn't tire easily.

Door and Door Jamb

  • So to stop a persistent burglar who doesn't mind repeatedly kicking, you must reinforce the door and door jamb.
  • Sturdy door reinforcement can be found at Door Devil.

Solid Wood or Metal Doors

  • A hollow wood construction has no place in an exterior door.
  • A solid wood door would ideally be made of a hardwood variety. It's not cheap, but it will buy you peace of mind.
  • A steel door is even more secure.
  • The ultimate door may be a hurricane-resistant steel door.

Hinges

  • Burglars have been known to remove the hinge pins and lift the door up and out of the frame.
  • A door that swings out and exposes the hinges is not secure.
  • Safety studs, crimped pins and a setscrew in the hinge will prevent a burglar from removing the hinge pin.

Still More…

  • A door that's highlighted with a motion detecting light (out of reach from an adult) will help deter intruders.
  • A fake surveillance camera (again, out of reach) is an effective deterrent.

Robert Siciliano is a home and personal security expert to DoorDevil.com discussing Anti-Kick door reinforcement on YouTube. Disclosures.

Your Ransomware Response: Prepare for the Worst

Email |
|
By Robert Siciliano · July 22, 2016 · 0 Comments ·

A ransomware attack is when your computer gets locked down or your files become inaccessible, and you are informed that in order to regain use of your computer or to receive a cyber key to unlock your files, you must pay a ransom. Typically, cybercriminals request you pay them in bitcoins.

The attack begins when you're lured, by a cybercriminal, into clicking a malicious link that downloads malware, such as CDT-Locker. Hackers are skilled at getting potential victims to click on these links, such as a phony e-mail, apparently from a company you do business with, luring you into clicking on a link or opening its attachment.

And if you find your computer is being held hostage:

  • Report it to law enforcement, although it's unlikely they can provide help. It's just good to have it recorded.
  • Disconnect your computer from its network to prevent the infection from spreading to other shared networks.
  • You need to remove the ransomware from your computer. Remember, removal of the ransomware won't restore access to your files; they will still be encrypted. To remove ransomware from your computer, follow the steps provided here.
  • If you already had your data backed up offline, there's no need to even consider paying the ransom. Still, you will want to remove the ransomware and make sure your backup solution was working.
  • But what if very important files were not backed up? Prepare to pay in bitcoins. The first step is to find out what the experts say about making payments in bitcoin.
  • The crook will be essentially impossible to trace. You'll be required to make the payment over the Tor network (anonymous browsing).
  • Finally, don't be shocked if the crook actually provides you the decryption key—essentially a password; ransomware thieves often follow through to maintain being taken seriously. Otherwise, nobody would ever pay them. But it would not be unprecedented to not receive the key. It's a gamble.
  • The best course of action is to prevent a ransomware attack, and that means looking for all the clues to malware and phishing scams. Don't let threatening e-mails, saying you owe back taxes or bank fees, jolt you into hastily clicking a suspicious link or attachment. If you regularly back up your data online and to an external drive, then you'll never feel you must pay the ransom.

Robert is a security analyst, author and media personality who specializes in personal security and identity theft and appears regularly on Good Morning America, ABC News and The TODAY Show.

32 Million Twitter Pass for sale Add two-factor NOW

Email |
|
By Robert Siciliano · July 21, 2016 · 0 Comments ·

The Dark Web, according to LeakedSource, got ahold of 33 million Twitter account details and put them up for sale. Twitter thus locked the accounts for millions of users.

Twitter, however, doesn't believe its servers were directly attacked. So what happened? The bad guys may have created a composite of data from other breached sources. Or, they could have used malware to steal passwords off of devices.

Nevertheless, the end result meant that for many Twitter accounts, there was password exposure—leading to the lockdown of these accounts. The owners of these accounts had to reset their password after being notified of this by e-mail.

Some users who did not receive this e-mail notification will find that their accounts are locked.

An Ounce of Prevention

  • Go through the passwords of all of your vital accounts, and see which ones are unique, long and strong. You'll likely need to change many passwords, as most people use simple to remember passwords that often contain keyboard sequences and/or words/names that can be found in a dictionary, such as 890Paul. These are easily cracked with a hacker's software.
  • Who'd ever think that Facebook's chief executive Mark Zuckerberg's Twitter account could be hacked? It was, indeed, and it's believed this was possible due to him reusing the username of his LinkedIn account several years ago.
  • So it's not just passwords that are the problem; it's usernames. Not only should these be unique, but every single account should have a different username and password. However if a username is an email address, you can't do much here.
  • Passwords and usernames should be at least eight characters long.
  • Use more than just letters and numbers-use characters if accepted (e.g., #, $, &).
  • So Paul's new and better password might be: Luap1988($#.
  • Sign up with the account's two-factor authentication. Not all accounts have this, but Twitter sure does. It makes it impossible for a crook to sign into your account unless he has your cell phone to receive the unique verification code that's triggered with every login attempt.

Robert Siciliano CEO of IDTheftSecurity.com, personal security and identity theft expert and speaker is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen. See him knock'em dead in this identity theft prevention video.

Filed in: Twitter
Tagged with: malware, Social Media, Twitter, password

Facebook CEO Password dadada hacked

Email |
|
By Robert Siciliano · July 19, 2016 · 0 Comments ·

If you've heard this once, you need to hear it again—and again: Never use the same password and username for more than one account!

If this got Mark Zuckerberg's (Facebook's chief executive). Twitter account hacked, it can get just about anybody hacked.

A report at nytimes.com says that the OurMine hacking group takes credit for busting into Zuckerberg's accounts including LinkedIn and Pinterest. It's possible that this breach was cultivated by a repeated password of Zuckerberg's.

According to OurMine, Zuckerberg had been using the same password for several accounts. Not only is that asking for trouble, but the password itself is highly crackable: dadada. Don't laugh. A hacker's software will find this in minutes.

How to Protect Your Accounts

  • Change any passwords that are used more than once.
  • Change any passwords that contain keyboard sequences, repetitions of letters or numbers (252525 is akin to dadada), or actual words or proper nouns.
  • If the idea of overhauling your passwords is overwhelming, use a password manager (e.g., RoboForm). A password manager will create long, unique passwords that are different for every account, and you won't have to remember them because the manager will issue you a master password.
  • See which accounts offer two-factor authentication, then sign up. This is a tremendous step towards preventing being hacked. So if an unauthorized person attempts to log into your Twitter or LinkedIn account, this will send a code to your cell phone that needs to be entered before the account is accessible. Unless the hacker has your cell phone, he won't be getting into your account.
  • Some say every 90 days, or at least twice a year, change all of your passwords. I think that's a bit much. Different and strong is what matters most.

Visit Have I Been Pwned to see if your e-mail account has been hacked. I did. 6 of my accounts showed up as being part of data dumps of sites that were hacked. Then I checked all 6 accounts, all had different passwords, but I still changed them. One was gmail, but with two factor verification/authentication, I've had no issue. Simply type your e-mail address into the field and click "Pwned?" If the result shows bad news, then you must immediately change your password to one that you've never had before—and at least eight characters and unique.

Robert Siciliano CEO of IDTheftSecurity.com, personal security and identity theft expert and speaker is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen. See him knock'em dead in this identity theft preventionvideo.

Phone Account of FTC Chief Technologist hijacked

Email |
|
By Robert Siciliano · July 14, 2016 · 0 Comments ·

An impostor posed as Lorrie Cranor at a mobile phone store (in Ohio, nowhere near Cranor's home) and obtained her number. She is the Federal Trade Commission's chief technologist. Her impostor's con netted two new iPhones (the priciest models—and the charges went to Cranor) with her number.

In a blog post, Cranor writes: "My phones immediately stopped receiving calls." She was stiffed with "a large bill and the anxiety and fear of financial injury."

Cranor was a victim of identity theft. She contacted her mobile carrier after her phone ceased working during use. The company rep said her account had been updated to include the new devices, and that her Android's SIM cards had been disabled. The company replaced the SIM cards and restored use of her phones.

The company's fraud department removed the charges but blamed the theft on Cranor.

So how does an impostor pull off this stunt so easily? Stores owned by the mobile carrier are required to ask for a photo ID and last four digits of the customer's SSN. However, at a third party retailer, this requirement may not be in place. In the Cranor case, the crook used a photo ID of herself but with Cranor's name—and was not required to reveal the victim's SSN last four digits.

Cranor's Actions

  • Changed password of online account
  • Added extra security PIN
  • Reported the theft to identitytheft.gov
  • Placed a fraud alert and got a free credit report
  • Filed a police report

Hijacking a smartphone is becoming more common, with the FTC having received over 2,600 reports just for January this year.

You may not think that this type of fraud ranks as high as other types of fraud, but it all depends on the thief and his—or her—intentions. Though the thief may only want to sell the phones for a little profit, a different kind of crook may want to hijack a phone to commit stalking or espionage. Or the thief can gain access to the victim's text messages. If the phone is used for two factor authentication, then a thief would have access to your One Time Passwords (OTP) upon logging into a critical website. There's all sorts of possibilities. The most important tip: add an extra security PIN to your account. This way, whether over the phone, web or in person, this "second factor" of authentication will make it harder for a thief to become you.

Robert Siciliano CEO of IDTheftSecurity.com, personal security and identity theft expert and speaker is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen. See him knock'em dead in this identity theft prevention video.

Viruses as Cyberweapons for sale

Email |
|
By Robert Siciliano · July 12, 2016 · 0 Comments ·

It's all about code—the building blocks of the Internet. Software code is full of unintentional defects. Governments are paying heavy prices to skilled hackers who can unearth these vulnerabilities, says an article at nytimes.com.

In fact, the FBI director, James B. Comey, recommended that the FBI pay hackers a whopping $1.3 million to figure out how to circumvent Apple's iPhone security.

So driven is this "bug-and-exploit trade market," that a bug-and-exploit hacking company, Hacking Team, ended up being hacked last summer.

The software companies that create code don't get to learn what the vulnerabilities are that the richly paid hackers discover. This has been going on for two decades-plus.

Here are some sizzling facts from nytimes.com:

  • Over a hundred governments have reported they have an offensive cyberwar program.
  • Iran boasts being in the No. 3 spot in the world for digital army size (trailing the U.S. and China), though this can't be confirmed.
  • However, Iranian hackers have demonstrated their skill more than once, and it's not pretty. For instance, they were responsible for the rash of U.S. bank hacking incidents in 2013.
  • Though Iran's cyber power lags behind that of the U.S.'s, they're steadily closing the big gap.
  • Most nations keep details of their cyberwar programs classified.

It has been surmised by many a security expert that WWIII will be largely digital. Imagine how crippling it would be if a nation's grid was dismantled—affecting major networks across that country—such as healthcare, shipping and banking and other critical infrastructures such as food and water supply.

There's not a whole ton you can do about this battle. However, you should, at a minimum, prepare your physical life for any digital disasters. Prepare the same way you would if you knew there was a severe storm coming. Store dry foods, water, extra climate appropriate clothing, and cash, preferably lots of small bills. This is just a short list. Seek out numerous resources on ready.gov to learn more.

Robert Siciliano CEO of IDTheftSecurity.com, personal security and identity theft expert and speaker is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen. See him knock'em dead in this identity theft prevention video.

Filed in: cyber fraud
Tagged with: cyber fraud, cyber crime, virus

TeamViewer Clients Victims of other Hack Attacks

Email |
|
By Robert Siciliano · July 8, 2016 · 0 Comments ·

Get an account with TeamViewer, and you will have a software package that enables remote control, online meetings, desktop sharing and other functions between computers.

But recently, customers of TeamViewer have reported remote takedowns of their computers that resulted in different forms of monetary theft, such as bank accounts being cleaned out.

The cyber thieves controlled the victims' computers via their TeamViewer accounts. Customers would witness their mouse arrow suddenly moving beyond their control.

The infiltration, though, did not occur on TeamViewer's end, insists the company. Instead, the software company called users "careless" because they reused their TeamViewer passwords on other sites like LinkedIn, reports an article at theregister.co.uk. The company has since apologized. Frankly, I agree with TeamViewer. Careless password reuse is one of the main reasons why so much fraud is occurring.

The stream of support tickets from customers prompted TeamViewer to implement two new security checks which will warn customers via e-mail of suspicious login attempts to their TeamViewer account and ask their permission to allow this or not.

Another safeguard newly in place will be that of the company checking the GPS of login attempts, plus requiring a password reset when anybody tries to log in from a new location.

Some customers have been critical that the release of these new security features took too long, since the reports of the hacking began a few weeks prior to the finalization of these new features.

As mentioned, the origin of these hacks is apparently the reuse of TeamViewer passwords on other sites that were then hacked. TeamViewer managed to get ahold of the leaked passwords, and also leaked e-mail addresses, that were all the cyber crooks needed to remotely hijack the computers.

However, some victims reported that they never reused their password and even had two-factor authentication. Further, some victims are placing blame on the company for the breaches.

The company is taking the breach seriously and wants its affected customers to upload their log files. TeamViewer especially wants to hear from customers with two-factor authentication who were compromised.

Robert Siciliano CEO of IDTheftSecurity.com, personal security and identity theft expert and speaker is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen. See him knock'em dead in this identity theft prevention video.

About Me

  • Member for 7 years 22 weeks
  • Last online 4 hours 23 minutes ago

Sites I Follow


Twitter