Introduction to Computers

Attacks come in multiple forms Phishing, trojans, key loggers, and other identity theft scams get lots of media attention But sometimes hacking into someone’s data takes nothing but time and persistence Twitter was the target of a persistent attacker No sneaky software tools were used Little in-depth knowledge of security was needed All it took was time, research, and trial & error How do you guard against this type of attack?

reset/remember Password Feature Web sites use two common methods to assist users who have forgotten their password Send password to alternate email already on file Ask one or more “secret questions” Or use both… ask a “secret question” and send the password to an alternate email address The password may or may not be changed in the process What could go wrong?

Password reset/remember Dangers Alternate email address might be compromised Security is only as strong as the weakest link “Secret question” might be guessed by others Your Mother’s maiden name can be readily found Kindergarten teacher’s name is much more difficult Can strengthen “secret questions” by: Asking multiple questions Limiting number of guesses Locking account after guesses exceeded

Anatomy of an attack - Research Once Twitter is targeted, online sources are then used to build a company profile Employee names, email addresses, role in company Research personal data about employees Birth dates Spouse, children’s, parent’s and pet’s names Addresses and schools attended Hobbies Commonly used user names Social networks can provide much of this data

Anatomy of an attack – poor habits Search for an individual with poor habits Uses passwords that are easy to guess Consistently uses the same password everywhere Uses a Web application with a known security flaw Mixes business and personal data When business and personal data are mixed, a personal weak point may offer access to business data Just need one weakness… one entry point… and security can fall like a house of cards

Anatomy of an attack – Persistence Locates an employee’s personal Google email Uses the “password reset” feature of Gmail Uses research of personal data about employees to successfully answer the challenge questions Gets a message that reset was sent to the user’s secondary email account ******@h******.com Logical assumption is this is a Hotmail account, a common provider of web-based email This was just one of many attempts to break into various accounts of many individuals

Anatomy of an attack – A fatal flaw Makes educated guess of Hotmail user name Attempts another password reset at Hotmail Finds Hotmail account deactivated for lack of use So this user name is now available to anyone Creates new Hotmail acct with this user name Performs another password reset in Gmail New Gmail password sent to Hotmail account, which is now owned by the hacker This one flaw compromises Twitter’s entire security

Anatomy of an attack – Paydirt! Hacker now has access to a Twitter employee’s personal email provided by Google Goes through Gmail looking for more passwords Sees the same password used over and over Resets Gmail password back to this password Since Gmail password now set back to the original password, the user has no reason to suspect Employee’s Twitter email uses same password! Hacker now has access to Twitter corporate email

Anatomy of an attack – it gets worse Twitter makes heavy use of Google Apps Google Apps stores data on public web servers This makes a wealth of sensitive Google corporate information available if you have the password Hacker has a Google Apps password... it’s the same as employee’s email password Twitter documents now available to the hacker include more user names and passwords Hacker now has enough information to take over the accounts of senior Twitter executives

What lessons are here? Don’t use the same password over and over Do change your passwords Don’t use “secret questions” that can be guessed by doing some research Don’t allow a secondary email account used for password reset to expire due to lack of use Don’t place sensitive corporate documents on public web servers, even if password protected Do remove emails that contain passwords

Take a look at your own Email How many messages contain your passwords? Some web sites send the user name and password you select to your email when you register Or your own use of the “password reset” feature Do you use those same passwords elsewhere? When did you last change your passwords? An attacker getting access to your email can often gain access to very sensitive accounts Consider online banking, credit cards, etc.

Suggestions for good passwords Use a password that is not a defined word Use both upper and lower case Use an acronym of a phrase you can remember Base the phrase on the web site in some way Substitute at least one number and one symbol for particular characters in your phrase

Creating A strong password Use the phrase “I look at my Facebook page every day” as a password for Facebook Turn this into an acronym by taking the first character of each word… IlamFped Change the “a” for the word “at” to the @ sign Change the “l” for the word “look” to the digit 1 This gives you a very strong password… I1@mFped,,, that’s also easy to remember

Another strong password example Use the phrase “The first stock I ever bought was Microsoft” as a financial account password Turn this into an acronym by taking the first character of each word… tfsIebwM Change the “f” for the word “first” to a 1 Change the “s” for the word “stock” to a $ This gives you another very strong password… t1$IebwM… to use for financial accounts

Some web sites need little security You don’t necessarily need a different password for every single web site you use Many web sites contain no vital data Discussion boards Online newspapers or magazines Online gaming Breaking into your account on these sites will not accomplish anything Using the same password for these sites is fine

other web sites are highly sensitive The strongest possible passwords are vital for: Email accounts These contain a great deal of personal data Any sort of banking or financial service A successful break-in could be very costly Any site where you use a credit card number Social networking - a hacker can possibly: Damage your reputation And even get you fired Protect yourself and protect your personal data!