Department: Police
Subject:
How to remain Cyber-Safe
How to remain Cyber-Safe
Contents at a glance
Password Threats
E-Mail Security
Online Scams
Social Networking Risks
ATM Threats
Online Banking
Online Shopping
Mobile Security
How to remain Cyber-safe
Here, we shall discuss eight technology-driven situations in Cyber-space and how to remain cyber-safe. Every citizen, while working with internet using computing or cell phone â should know the basics of these situations and take appropriate precautions â while working on-line. Please remember proper âawarenessâ and âalertnessâ can save you from getting into trouble in this e-world.
1. PASSWORD THREATS
The passwords should not be shared with other persons as they might be misused. The Stolen passwords can be used by unauthorized users who may collect your personal information.
Shoulder Surfing:
One way of stealing the password is standing behind an individual and note the password while he/she is typing it (Shoulder Surfing). Shoulder surfing is a direct observation technique to get passwords, PINs, other sensitive personal information one may listen in on your conversation if you give your credit-card number over the phone. Shoulder surfing is easily done in crowded places. Itâs comparatively easy to stand next to someone and watch as they fill out a form, enter a PIN number at an ATM machine, or use a calling card at a public pay phone. Do not write passwords in disk or paper so that the Cheater get it easily.
Bruteforce attacks:
Another way of stealing the password is through guess. Hackers try all the possible combinations with the help of personal information of an individual. They will try with the personâs name, pet name (nick name), numbers (date of birth, phone numbers), school name ⌠etc. When there are large number of combinations of passwords the hackers uses fast processors and some software tools to crack the password. This method of cracking password is known as âBrute force attackâ.
Dictionary attacks:
Hackers also try with all possible dictionary words to crack your password with the help of some software tools. This is called a âDictionary attackâ.
Sharing your passwords with strangers:
Sharing the passwords with the unknown persons (strangers) may also lead to loss of your personal information. They can use your login information and can get the access to your information. The operating system does not know who is logging into the system, it will just allow any person who enters the credential information into the login page. The persons like strangers after getting access to your information they can do anything with it. They can copy, modify or delete it.
Guidelines for maintaining a good password
Use at least 8 characters or more to create a password. The more number of characters we use, the more secure is our password.
Use various combinations of characters while creating a password. For example, create a password consisting of a combination of lowercase, uppercase, numbers and special characters etc.
Avoid using the words from dictionary They can be cracked easily.
Create a password such that it can be remembered. This avoids the need to write passwords somewhere, which is not advisable.
A password must be difficult to guess,
Change the password once in two weeks or when you suspect someone knows the password.
Do not use a password that was used earlier.
Be careful while entering a password when someone is sitting beside you.
Do not use the name of things located around you as passwords for your account.
Be aware of Shoulder Surfers at public places or schools while entering your passwords. Cover the keyboard with paper or hand or something else from viewed by unauthorized users,
You should not write the passwords on the paper or on any disk drive to store it, brain is the best place to store them.
You should not use a password that represents their personal information like nicknames, phone numbers, date of birth etc.
2. E-MAIL SECURITY
E-mails are just like postcards from which the information can be viewed by anyone. When a mail is transferred from one mail server to another mail server there are various stops at which there is a possibility of unauthorized users trying to view the information or modify it.
Since a backup is maintained for an e-mail server, all the messages will be stored in the form of clear text though they have been deleted from your mailbox. Hence, there is a chance of viewing the information by the people who are maintaining backups. So, it is not advisable to send personal information through e-mails.
Some examples of e-mail fraud
Say, you have won a lottery of million dollars, getting or receiving such kind of mails is a great thing, and really itâs the happiest thing. However, these mails may not be true. By responding to such a kind of mails many people lost huge amount of money. So ignore such kind of e-mails, do not participate in it and consider it as a scam.
Sometimes e-mails offering free gifts and asking personal information are received from unknown addresses. This is one way to trap your personal information.
Generally spammers or hackers try to steal e-mail address and send malicious software or code through attachments, fake e-mails, and spam and also try to collect your personal information.
Guidelines for using e-mail safely
Since the e-mail messages are transferred in clear text, it is advisable to use some encryption software like PGP (pretty good privacy) to encrypt e-mail messages before sending, so that it can be decrypted only by the specified recipient only
Use e-mail filtering software to avoid Spam or so unwanted mails that only messages from authorized users are received. Most e-mail providers offer filtering services.
Do not open attachments coming from strangers, since they may contain a virus along with the received message.
Be careful while downloading attachments from e-mails into your hard disk. Scan the attachment with updated antivirus software before saving it
Do not send messages with attachments that contain executable code like Word documents with macros, .EXE files and ZIPPED files. We can use Rich Text Format instead of the standard .DOC format RTF will keep your formatting, but will not include any macros. This may prevent you from sending virus to others if you are already infected by it.
Avoid sending personal information through e-mails.
Avoid filling forms that come via e-mail asking for your personal information and do not click on links that come via e-mail.
Do not click on the e-mails that you receive from unknown users.
3. ONLINE SCAMS
Online scam is an attempt to trap you for stealing money There are many types of online scams, this includes stealing money with fake names, fake photos, fake e-mails, forged documents, fake job offers and many more. Generally, it happens by sending fake e-mails for your personal details like online banking details, credit card details. Sometimes e-mails are sent from lottery companies with fake notice, whenever you participate in online auction and e-mails received for fake gifts.
Phishing scam: Online scammers send you an e-mail and ask your account information or credit card details along with a link to provide your information. Generally, the links sent will be similar to your bank. So whenever you post your details in the link then the details will be received by scammers and money is misused.
Lottery scam: Sometimes you receive an e-mail like âyou won a lottery of million dollarsâ receiving such kind of mails is a great thing, and really itâs a happiest thing. By responding to such kind of mails huge amount of money will be lost. As these e-mails are not true, scammers try to fool and trap you to obtain money.
Online Auction: If you bid for a product you never get the product promised or donât match the product, and the description given to you may be incomplete, wrong, or fake. The scammer accepts the bid from one person and goes for some other sites where they can get less than the winning bid so scammers may not send the product you wanted.
Forwarding Product or Shipping Scam: Generally, it happens for products that are purchased through online advertisement. Cheating may be done using stolen credit cards and shipping to your mail address. You will be fooled and asked to reship the product to others they might have deceived, who would again reship the product overseas.
E-mail Scam: Sometimes you get an e-mail with a message like â you have won something special like digital camera, webcam â all you need to do is just visit our web site by clicking the link given below and provide in your debit or credit card details to cover shipping and managing costs. However, the item never arrives but after some days the charges will be shown on your bank account, and you will lose money.
By e-mails: Generally, fraudsters send you an e-mail with tempting offers of easy access to a large sum of money and ask you to send scanned copies of personal documents like your address proof, passport details and ask you to deposit an advance fee for a bank account. So once you deposit the funds, they take money and stop further communication, leaving you with nothing in return.
Tips to Prevent Online Scams
Confirm whether e-mail is received from bank or not: Be cautious while providing bank details online and before proceeding further confirm with the bank about the e-mail you received. Think that, if something is important or urgent why doesnât the bank call me instead of sending e-mail?
Confirm the shipping: Beware of shipping scam. Make sure you get authorized signed document via fax before proceeding further and make sure that you receive it from an authorized company.
Be cautious during online auction: Donât be trapped with discounts and think wisely before you proceed with online auction. Think why $200 product would be $20.
Be aware about the product you receive via e-mail: Be aware about the products you get for a discounted price. Think why you have received e-mail for products when you never enter any online shopping or contest.
Donât be trapped by lottery scam: Donât get trapped by scammers and e-mails with a subject line you won some $10000. Just think why only you have received the e-mail without your participation!
4. SOCIAL NETWORKING RISKS
Social networking has become most popular activity in todayâs Internet world, with billions of people across the world using this media to meet old friends, making new friends, to collect and share information. Social networking while being a/ popular media has several disadvantages associated with it. These sites can be trapped by scammers or hackers leading to loss of confidentiality and identity theft, of the users. Social Networking sites are becoming very popular especially among the youth. These sites expose the kids to various risks like online bullying, disclosure of personal information, cyber-stalking, access to inappropriate content, child abuse, etc. In addition, there are many more risks like fake profiles with false information, malicious application, spam, and fake links which lead to phishing attacks etc.
Spam: Spam is usually unwanted e-mail advertising about a product sent to list of e-mails or group of e-mail addresses. Spammers send the unwanted mails or messages to the billions of users of social networking sites which are free; and are easily accessable to gather the personal information of the unsuspecting users.
Scams: Online scammers generally send an e-mail or message with a link to the user which ask for the profile information and tells the user that it would add new followers. These links sent to the user would be similar to applications, games etc. So whenever the user post his details in the link then the details will be received by scammers and information would be misused.
Phishing: Phishing attack is creation of fake site just similar to original site. These days even social networking phishing has come in different flavours just like phishing attacks on banks and popular trading websites. Social networking phishing has come up with fake mails and messages like offering some specialized themes, updating the profile, updating the security application/features etc.
Clickjacking: Generally, clickjacking is a malicious technique of tricking Web users into revealing confidential information or taking control of their computer while clicking on seemingly innocuous Web pages. A clickjacking takes the form of embedded code or script that can run without the userâs knowledge.
Malicious applications: Malicious application might come through different applications while using or installing software. Similarly, the clicking on the social networking application starts the application installation process or link to view the video, etc. In order to fulfil its intended operation the application requests for some elevated privileges from the user like access to basic information, update, post, etc. Sometimes e-mails are received with fake e-mail address like services@facebook.com by an attachment named, âFacebook_Password_4cf91.zip and includes the file Facebook_Password_4cf91.exeâ that, the e-mail claims, contains the userâs new facebook password. When a user downloads the file, it could cause a mess on their computer and which can be infected with malicious software.
Tips to avoid risks by social networking
Limit the information you put in the social networking sites.
Donât put personal information like your family details, addresses, personal photographs, video, etc. In case if you put your personal photographs try to change settings and make visible only for friends
Most of the sites and services provide options for privacy settings to prevent attackers to view your information. You can make use of these options to choose/deny whom you want to allow to see your information.
Be careful if you want to meet social networking friends in person, sometimes it may not be their true identity which is posted on the social networking sites.
Always think before you meet such strangers. If you decide to meet them do it in a public place during the day. Kids should never be allowed to meet such strangers alone.
Donât ever click suspicious link while logged into social networking accounts.
Always clean browserâs cookies and cache.
Install a good and latest version of Anti-virus to keep your system free from malicious applications like virus, worms and Trojans.
Donât ever run any javascript while logged into your social networking accounts.
Donât ever share your password with anyone; and keep changing your password regularly. Always use proper password (min 8 digits with a mix of alpha numeric & special characters)
Donât ever login to any site other than the legitimate sites and always check the URL for misspelled links before you proceed further.
Use Virtual Keyboard, wherever possible to enter your password for better security as these cannot be captured by key-loggers.
5. ATM THREATS
The Automated Teller Machine (ATM) was first commercially introduced in the 1960s. By 2005, there were over 1.5 million ATMs installed worldwide. The ATM has enhanced the convenience of customers by enabling them to access their cash wherever required from the nearest ATM. Financial institutions have implemented many strategies to upgrade the security at their ATMs and to reduce scope for fraud. These include choosing a safe location for installing the ATM, installation of surveillance video cameras, remote monitoring, anti-card skimming solutions, and increasing consumer awareness.
RISKS
The fraudster inserts a folded piece of plastic film into the ATM card slot so that it will hold the card and will not allow it to be expelled by the machine.
Another method involves use of fake cards using data collected from tiny cameras and devices called âskimmersâ that capture and record bank account information.
Another interesting method of ATM frauds involves the use of âduplicate ATMsâ by the fraudsters that uses software which records the passwords typed on those machines.
TIPS
Enable your mobile phone number and e-mail with your banking transactions for timely SMS and e-mail alerts.
Your Financial Institution or Bank will never send you an e-mail asking you to enter your Banking details online.
Check regularly your credit card or bank account details and keep track of your transactions.
Update your details such as change of address for receipt of cheque books, statements, debit/ credit cards at the right address.
For protecting phishing attacks, your browser should be enabled with phishing filters and never click links in your e-mail for updating and transactions.
Keep a strong and easy to remember password and change it regularly.
Vishing is a form of phishing, where instead of people receiving an e-mail trying to lure them into giving personal information, the criminal uses a phone call, either live or automated to attack the bank or credit union customer and get critical information.
Try to restrict yourself from giving personal information when you receive a call from a Bank or Credit Card Provider.
Look for a âno tamperingâ sign. Crooks often place these to stop anyone curious about a new piece of equipment.
Steer clear of a jammed ATM machine that forces customers to use another ATM that has a skimmer attached. Often, the criminal will disable other ATMs in the area to draw users to the one that has the skimming device on it
Customers should check their bank accounts regularly to make sure there are no unusual or unauthorized transactions. If you find any unauthorized ATM transactions on your bank account, immediately notify local law enforcement agency as well as your Financial institution and/ or the establishment where the ATM is located.
Always protect your PIN: Donât give the number to anyone, and cover the keypad while you are entering yours.
6. ONLINE BANKING
Online Banking can also be referred as Internet Banking. It is the practice of making bank transactions or paying bills through the internet. We can do all financial transactions by sitting at home or office. Online banking can be used for making deposits, withdrawals or we can even use it for paying bills online. The benefit of it is the convenience for customers to do banking transactions. The customers need not wait for bank statements, which arrive by e-mail to check their account balance. They can check their balance each and every day by just logging into their account. They can catch the discrepancies in the account and can act on it immediately.
RISKS
Link Manipulation: Most methods of phishing use some form of technical deception designed to make a link in an e-mail (and the spoofed website it leads to) appear to belong to the spoofed organization. Misspelled URLs or the use of sub domains are common tricks used by phishers.
Filler Evasion: Phishers have used images instead of text to make it harder for anti-phishing filters to detect text commonly used in phishing e-mails.
Phishing Attacks: An e-mail message from a large online retailer or Internet Bank website announces that your account has been compromised and need to be updated and gives the link to update the same. So you follow a link in the message, if you click on the link it leads to the website that is as similar as original website, it is spoofed login page. If you give the account details that will be redirected to the attacker and it might be misused.
Malware attacks: Attackers try to send the malware through attachments, try to trap you by sending false e-mails with attachments saying to update your account information.
Clampi Virus Targets Users at Banks and Credit Card Sites: Keeping up with the latest Web security threats is a daunting task, because viruses and Trojans emerge, evolve, and spread at an alarming rate. While some in