Marriott Data Breach: 500 Million Accounts Compromised

,

If you have stayed at one of Marriott’s Starwood hotels in the past few years, chances are you have been affected by a massive data breach that potentially exposed your personal data along with about 500 million other people. Your name, phone numbers, email addresses, passport number, date of birth, and potentially credit card numbers and expiration dates are at risk.

Marriott said in the coming weeks they will start reaching out to affected guests and has set up a website with information about the breach.

For those of you concerned about whether your information was stolen, here are a few steps you can take to protect yourself:

Change your passwords

We hear all the time about stupid things people do when it comes to creating passwords; the most commonly used passwords in the United States for the past several years include “123456”, “password” and some variation like “password1234”. People are easily tricked into giving away their passwords to the likes of Jimmy Kimmel or Ellen to our amusement. Before Sony was breached, they infamously kept their passwords in a file called “Passwords”!

The bottom line is it is nearly impossible to effectively create and remember all the passwords we need to function in our daily lives. It seems there are two ways people handle this. They continue to use the same (usually poor) passwords over and over or they do what I highly recommend and use some sort of password manager program. 

Enable two-step logins

Two-step logins are when two separate passcodes are required to log in to one of your online accounts. One of the most common and popular forms is called text verification, and I’m sure you’ve already experienced it. That’s where you log in to your online account with your regular username and password and then a secondary passcode is sent to your phone by text or even better, through an App like Google Authenticator. Without that second passcode, no one gets into the account.

Set up account alerts 

To monitor accounts quickly and conveniently, sign up for automatic account alerts when any transaction occurs on your account. If you spend even a dollar at a store, you receive an email or text notifying you of the purchase. If you receive an email for an amount you didn’t spend – bingo – you’re probably a victim of fraud.

MOST IMPORTANTLY, FREEZE YOUR CREDIT.

Some websites and cybersecurity experts will tell you to simply place a fraud alert on your three credit profiles. I am telling you that this isn’t strong enough to protect your credit. Freezing your credit puts a password on your credit profile, so that criminals can’t apply for credit in your name (unless they steal your password too). Here are the credit freeze websites and phone numbers for each bureau.

Equifax Credit Freeze
P.O. Box 105788 Atlanta, Georgia 30348
Toll-Free: 1.800.685.1111

TransUnion Credit Freeze
Fraud Victim Assistance Department P.O. Box 6790 Fullerton, CA 92834
Toll-Free: 1.888.909.8872

Experian Credit Freeze
P.O. Box 9554 Allen, TX 75013
Toll-Free: 1.888.397.3742

Equifax is being overwhelmed by requests, so be patient and keep trying. Even if it doesn’t happen today, you need to Freeze Your Credit!

6 Ways Your Facebook Privacy Is Compromised | Sileo Group

One billion people worldwide use Facebook to share the details of their lives with their friends and may be unaware their Facebook Privacy could be compromised. Trouble is, they also might be unintentionally divulging matters they consider private to co-workers, clients and employers.

Worse yet, they may be sharing their privacy with marketing companies and even scammers, competitors and identity thieves. Luckily, with some Facebook privacy tips, you can help protect your account online.

Here are six ways Facebook could be compromising your private information and how to protect yourself:

 

1.  The new Timeline format brings old lapses in judgment back to light. Timeline, introduced in late 2011, makes it easy for people to search back through your old Facebook posts, something that was very difficult to do in the past. That could expose private matters and embarrassing photos that you’ve long since forgotten posting.

What to do: Review every entry on your Facebook timeline. To hide those you do not wish to be public, hold the cursor over the post, click the pencil icon that appears in the upper right corner, select “Edit or remove” then “Hide from timeline.” Being able to “revise” your history gives you a second chance to eliminate over-sharing or posts made in poor taste.

2.  Facebook third-party app providers can harvest personal details about you—even those you specifically told Facebook you wished to be private. Third-party apps are software applications available through Facebook but actually created by other companies. These include games and quizzes popular on Facebook like FarmVille and Words with Friends, plus applications like Skype, TripAdvisor and Yelp. Most Facebook apps are free—the companies that produce them make their money by harvesting personal details about users from their Facebook pages, then selling that information to advertisers. In other words, you are paying for the right to use Facebook using the currency of your personal information.

Many apps collect only fairly innocuous information—things like age, hometown and gender that are probably not secret. But others dig deep into Facebook data, even accessing information specifically designated as private.

Example: A recent study found that several Facebook quiz game apps collected religious affiliations, political leanings and sexual orientations. Many Facebook apps also dig up personal info from our friends’ Facebook pages—even if those friends don’t use the apps. There’s no guarantee that the app providers will sufficiently safeguard our personal information and there are numerous instances where they have done just the opposite.

What to do: Read user agreements and privacy policies carefully to understand what information you are agreeing to share before signing up for any app. The free Internet tool Privacyscore is one way to evaluate the privacy policies of the apps you currently use (www.facebook.com/privacyscore), but remember that it is provided by the very company that is collecting all of your data. You also can tighten privacy settings. In “Facebook Privacy Settings,” scroll down to “Ads, Apps and Websites,” then click “Edit Settings.” Find “Apps You Use” and click “Edit Settings” again to see your privacy options. And be sure to delete any apps you don’t use. While you are in the privacy settings, take a spin around to find out other data you are sharing that might compromise your privacy.

3.  Facebook “like” buttons are spying on you—even when you don’t click them. Each time you click a “like” button on a Web site, you broadcast your interest in a subject not just to your Facebook friends but also to Facebook and its advertising partners.

Example: Repeatedly “like” articles in a publication with a specific political viewpoint, and Facebook advertisers might figure out how you vote.

Not clicking “like” buttons won’t free you from this invasion of privacy. If you’re a Facebook user and you visit a Webpage that has a “like” button, Facebook will record that you visited even if you don’t click “like.” Facebook claims to keep Web browsing habits private, but once information is collected, there’s no guarantee that it won’t get out.

Example: If an insurance company purchases this data, it might discover that someone applying for health coverage has visited Web pages about an expensive-to-treat medical disorder. The insurer might then find an excuse to deny this person coverage, or to raise their rates substantially.

What to do: One way to prevent Facebook from knowing where you go online is to set your Web browser to block all cookies. Each browser has a different procedure for doing this, and it will mean that you will have to re-enter your user ID and password each time you visit certain Web sites.

Another option is to browse the web in “InPrivate Browsing” mode (Internet Explorer), “Incognito” mode (Google Chrome) or “Private Browsing” mode (Firefox and Safari), which seems to be a less intrusive way to raise your privacy levels.

Less conveniently, you could log out of Facebook and select “delete all cookies” from your browser’s privacy settings before visiting Web sites you don’t want Facebook to know about. There are also free plug-ins available to prevent Facebook from tracking you around the Internet, such as Facebook Blocker (webgraph.com/resources/facebookblocker).

4.  Social readers” tell your Facebook friends too much about your reading habits. Some sites, including the Washington Post and England’s The Guardian, offer “Social Reader” Facebook tools. If you sign up for one, it will tell your Facebook friends what articles you read on the site, sparking interesting discussions.

The problem: excessive sharing. The tools don’t share articles with your Facebook friends only when you click a “like” button, they share everything you read on the site. Your Facebook friends likely will feel buried under a flood of shared articles, and you might be embarrassed by what the social reader tells your friends about your reading habits.

What to do: If you’ve signed up for a social reader app, delete it. In Facebook privacy settings, choose “Apps you use,” click “Edit Settings,” locate the social reader app, then click the “X” and follow the directions to delete.

5.  Photo and video tags let others see you in unflattering and unprofessional situations. If you work for a straight-laced employer, work with conservative clients or are in the job market, you may already realize that it’s unwise to post pictures of yourself in unprofessional and possibly embarrassing situations.

But you may fail to consider that pictures other people post of you can also hurt you.

A Facebook feature called photo tags has dramatically increased this risk. The tags make it easy for Facebook users to identify by name the people in photos they post—Facebook even helps make the IDs—then link these photos to the Facebook pages of all Facebook users pictured.

What to do: Untag yourself from unflattering photos by using the “remove” option on these posts. Arrange to review all future photos you’re tagged in before they appear on your Facebook Timeline by selecting “Timeline and Tagging” in Facebook’s Privacy Settings menu, clicking “Edit settings,” then enabling “Review posts friends tag you in before they appear on your timeline”. Better yet, ask your friends and family not to post pictures of you without your permission. Be sure to extend the same courtesy to them by asking whether or not they mind you tagging them in a photo.

6.  Our Facebook friends—and those friends’ friends—offer clues to our own interests and activities. Even if you’re careful not to provide sensitive information about yourself on Facebook, those details could be exposed by the company you keep.

Example: A 2009 MIT study found it was possible to determine with great accuracy whether a man was gay based on factors including the percentage of his Facebook friends who were openly gay—even if this man did not disclose his sexual orientation himself.

Sexual orientation isn’t the only potential privacy issue. If several of your Facebook friends list a potentially risky or unhealthy activity, such as motorcycling, cigar smoking or bar hopping among their interests—or include posts or pictures of themselves pursuing this interest—an insurer, college admissions officer, employer or potential employer might conclude that you likely enjoy this pursuit yourself.

What to do: Take a close look at the interests and activities mentioned by your Facebook friends on their pages. If more than a few of them discuss a dangerous hobby, glory in unprofessional behavior, or are open about matters of sexual orientation or political or religious belief that you consider private, it might be wise to either remove most or all of these people from your friends list, or at least make your friends list private. Click the “Friends” unit under the cover photo on your Facebook page, click “Edit,” then select “Only Me” from the drop-down menu.

Most of all, remember that Facebook and other social networking sites are social by nature, which means that they are designed to share information with others. The responsibility to protect your personal and private information doesn’t just fall on the social networks; it is also up to you.  Following these Facebook privacy tips can help you succeed in keeping your most personal information safe. 

John Sileo is an an award-winning author and keynote speaker on identity theft, internet privacy, fraud training & technology defense. John specializes in making security entertaining, so that it works. John is CEO of The Sileo Group, whose clients include the Pentagon, Visa, Homeland Security & Pfizer. John’s body of work includes appearances on 60 Minutes, Rachael Ray, Anderson Cooper & Fox Business. Contact him directly on 800.258.8076.

Make Your Kid’s Internet of Things Toy Story a Safe and Happy One

What do IOT Toys have to do with your kids?

Remember when the most dangerous thing a parent had to worry about when giving their child a Christmas present was that he would shoot an eye out? Well okay, that was pretty serious, but the most popular items on the list for Santa today can be just as dangerous in different ways.

I’m talking, of course, about Internet of Things Toys (IoT Toys) or Smart Toys. Some of the most popular IoT toys this year include Hatchimals, Teddy Ruxpin (all updated and digital now!), Droids (think BB-8 from Star Wars) and Hello Barbie. Smart toys are expected to account for 18% of both the toy and video game markets by 2018.

Aside from the cool factor and just being flat out fun, these IoT toys can offer even the youngest of kidseducational benefits from literacy and numeracy skills to digital literacies and coding skills. They will also learn collaborative play and expand their creative and rational thinking.

However, in an increasingly scary trend, these toys also put kids at risk in ways they will never think of and many of their parents won’t either. That is because these toys pose threats to children’s data protection as their connectivity through the internet means kids and their actions and even locations can be tracked, recorded and exploited.

In order to use these toys, kids have to register with the cloud and put their personal information out there. Hackers are increasingly targeting such companies; CloudPets, Hello Barbie and VTech are just a few who have experienced serious breaches. Some of the information gained in such breaches includes voice recordings, users’ system information, Wi-Fi network names, internal MAC addresses, account IDs, and even MP3 files. Cybercriminals also were able to access parent accounts including names, email addresses, secret questions and answers for passwords, IP addresses, mailing addresses and download histories.

As bad as these breaches are, they aren’t even close to the worst part about the IoT toy dangers. The creepiest part is that hackers can access the toys and make them do things or say things that may harm kids. One product even allowed unauthorized Bluetooth access from any smartphone or tablet within 50 meters, thus potentially allowing strangers in the immediate surroundings to talk to children. They also make the child very trackable.

So, what to do? Go back to giving the Red Rider BB gun? Of course not—we want our kids to have the latest and greatest toys and to enjoy the benefits of today’s technology. We just have to make it our responsibility to keep them safe, just as Ralphie’s parents tried to do.

Here are some recommendations for parents to consider when purchasing IoT toys:

1. Research app permissions before purchasing smart toys and disable access to the permissions that can compromise your privacy.
2. Consider the wireless profile of devices. Is the Wi-Fi-connection an access point or client?
3. Double-Check the Parental Controls
4. CHANGE THE PASSWORD!!!!
5. Teach your kids not to give sensitive information to toy providers (and monitor the set up!)
6. Disable location services.
7. Mute any microphones and block any webcams
8. For integration with Alexis, Siri…, set up a separate account from your buying account.
9. Update the firmware regularly.
10. Disable In-App Purchases. Some smart toys offer up the ability to purchase various in-app items. If you don’t disable purchases, your child may run up quite a high bill. There have been plenty of situations in which children have amassed significant debt on apps using their parents’ credit cards, including one bill worth $5000 spent on Jurassic World and another for $46,000 on Game of War: Fire Age.
11. Watch your kids play and engage with them! Maybe they’ll teach you a thing or two!

Most importantly, know this: if any device you have in your home connects to the internet, whether it’s though Wi-Fi, Bluetooth or another form of connectivity, you can bet your data is being harvested, analyzed and sold.

John Sileo is an an award-winning author and keynote speaker on cyber security, identity theft, internet privacy and fraud training. John specializes in making security entertaining, so that it works. John is CEO of The Sileo Group, whose clients include the Pentagon, Visa, Homeland Security & Pfizer. John’s body of work includes appearances on 60 Minutes, Rachael Ray, Anderson Cooper & Fox Business. Contact him directly on 800.258.8076.

Password Managers Protect the Organization

We hear all the time about stupid things people do when it comes to creating passwords; the most commonly used passwords in the United States for the past several years include “123456”, “password” and some variation like “password1234”. People are easily tricked into giving away their passwords to the likes of Jimmy Kimmel or Ellen to our amusement. Before Sony was breached, they infamously kept their passwords in a file called “Passwords”!

The bottom line is it is nearly impossible to effectively create and remember all the passwords we need to function in our daily lives. It seems there are two ways people handle this. They continue to use the same (usually poor) passwords over and over or they do what I highly recommend and use some sort of password manager program. 

A password manager is a software application that helps a user store and organize passwords. Password managers usually store passwords encrypted, requiring the user to create a master password; a single, ideally very strong password that grants the user access to their entire password database. For a hint on creating that all-important master password, check out our blog on that topic.

At a minimum, a good password manager program should:

Have a strong password generator— a single click gives you a random, extremely strong new password using combinations of digits, special characters and mixed cases letters. No more having to think of (and try to remember!) catchy, unhackable passwords for each account.
• Use a “vault” in which all of your data is stored and is ready to be automatically accessed when needed by simply typing one master password that only you know. Of course, if you forget your master password, you may be out of luck, though some password managers offer password recovery under certain circumstances.
Be easy to use– one click can open your browser, take you to a site, fill in your username and password, and log you in. Many password managers can import a list of passwords from generic CSV or TXT files, a browser’s password cache, and in some cases from other password managers.
• Have the ability to store your credit cards, reward programs, membership cards, bank accounts, passports, wills, investments, private notes and more. Think of it like a 21st-century digital wallet. (But no one can pickpocket you.)
Show all your items with weak, duplicate, and old passwords so you can decide which ones to fortify and update. No more using five variations of your childhood dog’s name. It will look at the strength of each password as well as find duplicate passwords and replace them with strong, unique ones.
• Be fluent in multiple platforms and browsers, including Mac, Windows, iPhone, iPad, Android, and Windows Phone.

Some additional features you may want to consider:
The ability to allow file attachments, so you can safely store related receipts and images, and keep track of your software licenses.
• Can you place your password vault in Dropbox or on a USB thumb drive, so that you may use it from any traditional computer in the world with a modern browser? This has security implications of its own, which you’ll need to consider, of course.
• Some offer a menu of credit cards that actually look like credit cards and can track online purchases.
• An emergency contacts feature that will ensure that your credentials won’t be lost if something happens to you.
• Cost—there are plenty of free versions around, but they usually have limited uses and not as many features. I’d say spend the money to get what really works for you.

Fully 50% of the corporations that I work with and speak to have had data breaches due to poor password habits. Surprising, given how many of those would have been avoided had they simply used password manager software.

John Sileo is an an award-winning author and keynote speaker on identity theft, internet privacy, fraud training & technology defense. John specializes in making security entertaining, so that it works. John is CEO of The Sileo Group, whose clients include the Pentagon, Visa, Homeland Security & Pfizer. John’s body of work includes appearances on 60 Minutes, Rachael Ray, Anderson Cooper & Fox Business. Contact him directly on 800.258.8076.

How to Stop Wi-Fi Hotspot Hackers

We’ve all been there before–killing time at the airport, meeting up with a colleague at a local coffee shop, staying at a hotel…–and we want to connect to the Internet.   Nearly everyone offers free Wi-Fi these days, including lots of cyber criminals.  They’ve become so good at mimicking legitimate hotspots that you’d better know what you’re looking for before you connect!  Here are our top six tips to stop those Wi-Fi Hotspot Hackers.

Don’t connect to an Evil Twin.

An Evil Twin is a rogue wireless access point that masquerades as a legitimate Wi-Fi access point.  It’s relatively easy for hackers to set these up and gather personal or corporate information without the end-user’s knowledge. It will most likely have a name similar to the real hotspot. To prevent this from happening:

  • Make sure you’re connecting to a legitimate public Wi-Fi network by asking the café, airport, hotel, library, etc. for the correct hotspot name.
  • If the Wi-Fi hotspot forces you to enter a user name and password, it is considerably safer than those that require no password.
  • When you are finished using a hotspot, log off the Wi-Fi connection and forget the network. Failing to do so allows mobile devices to re-connect to that network when you simply walk by that location.

Tether your laptop or tablet to your phone.

Also known as a personal Wi-Fi hotspot, tethering is the act of using your smartphone’s encrypted cellular connection to the Internet to surf securely from your laptop or tablet.

  • To tether your computing device to your smartphone, simply contact your mobile provider (Verizon, AT&T, Sprint, T-Mobile, etc.) and let them know that you want to be able to connect your computing device to your smartphone.
  • It costs about $15 per month– well worth the protection. Your provider will turn it on and will walk you through setting up both your smartphone and device so that they communicate with the Internet in a well-protected manner.
  • Many tablets, like the iPad, now come with cellular data access built into the device so you never even have to utilize free Wi-Fi (though it’s still safe to use the secure Wi-Fi in your home and office).
  • Or, just use your smartphone!

Make sure you’re surfing with HTTPS.

In your browser’s URL bar, make sure that the address starts with https://. The “S” stands for secure, and encrypts your communication between the computer and the Internet, so that it can’t be easily “sniffed” by hackers.

  • HTTPS connections should show a lock symbol in the URL bar (and sometimes the bar itself turns green when you are on a secure connection).
  • If you don’t have HTTPS access, use your cellular connection to surf.
  • At a minimum, avoid all banking, credit card, email and financial transactions or anything that requires you to give out your personal information.

Patch your software.

  • Keep your browser and operating system up-to-date with security patches, but don’t do it on Wi-Fi; update when you have a secure connection at home or at work.
  • Having the latest software limits the “hacker back doors” that allow criminals into your system.

Turn off file sharing.

  • Both Macs and PCs have file sharing capabilities that when turned on, expose your files to others on your network (including strangers on a free Wi-Fi hotspot).
  • In your system settings, uncheck the box that allows file and printer sharing through your computer.

Turn on your VPN.

  • A Virtual Private Network encrypts (protects with a passcode) the traffic between your device and the VPN server. This effectively takes the man-in-the-middle (a Wi-Fi sniffer) out of your communication to the Internet.
  • VPNs can either be personal (e.g., SecurityKISS) or set up by your company’s IT department.

While all of these tips are valuable tools to keep your data secure, if you are the type of person who rarely even utilizes the Internet away from home, you may not want to take the time to do all of them.  At the very minimum, before you ever enter any information online (financial, passwords, personal information), INVESTIGATE how you’re connected, THINK about who has access to your data and consider whether it can wait until you KNOW you’re on a secure connection.

John Sileo is an an award-winning author and keynote speaker on identity theft, internet privacy, fraud training & technology defense. John specializes in making security entertaining, so that it works. John is CEO of The Sileo Group, whose clients include the Pentagon, Visa, Homeland Security & Pfizer. John’s body of work includes appearances on 60 Minutes, Rachael Ray, Anderson Cooper & Fox Business. Contact him directly on 800.258.8076.

Roomba Selling, I Mean Sharing our Home Data?

What a difference a word makes. On July 24, Reuters published a story about an interview with Colin Angle, the CEO of iRobot Corp. They are the makers of Roomba, the popular robotic vacuum. In the interview, Angle excitedly talked about all the benefits that could come from using the data Roomba collects (think the dimensions of a room as well as distances between sofas, tables, lamps and other home furnishings) to share with other Smart Technology such as home lighting, thermostats and security cameras. The rest of the article went on to talk about market competition, potential future developments, stock prices, and, oh yeah, a brief nod to security concerns.

When asked about those concerns, Angle said iRobot would not be sharing data without its customers’ permission, but he expressed confidence most would give their consent in order to access the smart home functions.

The problem though is that the writer did not use the word “share”. Instead, he used the word “sell”—as in iRobot would be selling our data to the likes of Amazon, Apple and Google. (You won’t find that in the article now as Reuters printed a retraction a few days later—after privacy advocates went crazy!)

When Angle was questioned by others about this policy, he made it as clear as could be:

“First things first, iRobot will never sell your data. Our mission is to help you keep a cleaner home and, in time, to help the smart home and the devices in it work better. There’s no doubt that a robot can help your home be smarter. It’s the data it collects to do its job, and the trusted relationship between you, your robot and iRobot, that is critical for that to happen. Information that is shared needs to be controlled by the customer and not as a data asset of a corporation to exploit. That is how data is handled by iRobot today. Customers have control over sharing it. I want to make very clear that this is how data will be handled in the future.”

While Reuters might have misinterpreted Angle’s comments when it came to the selling of the data – the supply of the data available to potentially provide to companies is not in question. The debate turns from outrage at a company invading our privacy to the very real need to take a good look at our own practices and what we are (knowingly or not) allowing companies to do with our data. We have to be willing to take control of our data:
– limit what we give away
– change our defaults so as to not “permit” companies to share what is collected
– speak up against and, if needed, boycott the products that don’t meet our privacy demands.

Likewise, this is a call to businesses to take responsibility for using data to their advantage but only if they have transparently let their customers know how it is being used and giving them the control (not just through changing default settings!)

Ready for your closing…and do you still want to use this somewhere?
The ironic thing is that we give away ten times as much about ourselves on FB and don’t think twice about it. Opinions really change when they threaten to get inside our homes, not just our friends.

Equifax Data Breach Protection Tips

,

How to Protect Yourself from the Equifax Data Breach

Equifax, one of the three major consumer credit reporting agencies disclosed that hackers compromised Social Security and driver’s license numbers as well as names, birthdates, addresses and some credit cards on more than 143 million Americans. If you have a credit profile, you were probably affected.

Credit reporting companies collect and sell vast troves of consumer data from your buying habits to your credit worthiness, making this quite possibly the most destructive data security breach in history. By hacking Equifax, the criminals were able to get all of your personally identifying information in a one-stop shop. This is the third major cybersecurity breach at Equifax since 2015, demonstrating that they continue to place profits over consumer protection. Ultimately, their negligence will erode their margins, their credibility and their position as one of the big three.

But that isn’t your concern – your concern is protecting yourself and your family from the abuse of that stolen information that will happen over the next 3 years.

Minimize Your Risk from the Equifax Data Breach

  1. Assume that your identity has been compromised. Don’t take a chance that you are one of the very few adult American’s that aren’t affected. It’s not time to panic, it’s time to act.
  2. If you want to see the spin that Equifax is putting on the story, visit their website. Here’s how the story usually develops: 1. They announce the breach and say that fraud hasn’t been detected 2. A few days later when you aren’t paying attention, they retract that statement because fraud is happening, 3. Sometime after that they admit that more people, more identity and more fraud took place than originally thought. They encourage you to sign up for their free monitoring (which you should do), but it does nothing to actually prevent identity theft, it just might help you catch it when it happens.
  3. I recommend placing a verbal password on all of your bank accounts and credit cards so that criminals can’t use the information they have from the breach to socially engineer their way into your accounts. Call your banks and credit card companies and request a “call-in” password be placed on your account.
  4. Begin monitoring your bank, credit card and credit accounts on a regular basis. Consider watching this video and then setting up account alerts to make this process easier.
  5. Visit AnnualCreditReport.com to get your credit report from the three credit reporting bureaus to see if there are any newly established, fraudulent accounts set up. DON’T JUST CHECK EQUIFAX, AS THE CRIMINALS HAVE ENOUGH OF YOUR DATA TO ABUSE YOUR CREDIT THROUGH ALL THREE BUREAUS.
  6. MOST IMPORTANTLY, FREEZE YOUR CREDIT. The video above walks you through why this is such an important step. Some websites and cybersecurity experts will tell you to simply place a fraud alert on your three credit profiles. I am telling you that this isn’t strong enough to protect your credit. Freezing your credit puts a password on your credit profile, so that criminals can’t apply for credit in your name (unless they steal your password too). Here are the credit freeze websites and phone numbers for each bureau. Equifax is being overwhelmed by requests, so be patient and keep trying. Even if it doesn’t happen today, you need to Freeze Your Credit!

Equifax Credit Freeze
P.O. Box 105788 Atlanta, Georgia 30348
Toll-Free: 1.800.685.1111

TransUnion Credit Freeze
Fraud Victim Assistance Department P.O. Box 6790 Fullerton, CA 92834
Toll-Free: 1.888.909.8872

Experian Credit Freeze
P.O. Box 9554 Allen, TX 75013
Toll-Free: 1.888.397.3742

John Sileo is an an award-winning author and keynote speaker on cybersecurity. John specializes in making security entertaining, so that it works. John is CEO of The Sileo Group, whose clients include the Pentagon, Visa, Homeland Security & Pfizer. John’s body of work includes appearances on 60 Minutes, Rachael Ray, Anderson Cooper & Fox Business. Contact him directly on 800.258.8076.

Trump Russia Investigation Update: Did Campaign HELP Russians Plot Disinformation Strategy?

Honestly, we don’t know yet. There was a time when our voting preferences, our political leanings, our policy choices were our own business. Now they are someone else’s business, quite literally. There are so many stories coming out about Donald Trump’s connections to and collusion with the Russians that it is getting hard to keep these accusations straight. Here’s the latest:

Trump Russia Investigation Update

The key word is help. As in, actively provide information that the Russians may not have been able to discover on their own. “Help” is not a synonym for encourage, appreciate or enjoy.

Without getting too political (because after all, this is a cyber security blog), here are the basics of the Trump-Russia Investigation from a cyber security perspective:

  1. The Trump campaign had possession of a huge amount of information about American voters from Cambridge Analytica, the data mining firm hired to help collect and use social media information to identify and persuade voters to vote (or not vote), through an activity known as political micro-targeting.
  2. Jared Kushner, the president’s son-in-law and now a senior adviser in the White House, was head of digital strategy during the campaign, meaning he was overseeing this effort to micro-target voters.
  3. The Russians unleashed bots, or robotic commands, that swept across the Internet and picked up fake news stories or harshly critical news stories about Hillary Clinton and disseminated them across the United States. By Election Day, these bots had delivered critical and phony news about the Democratic presidential nominee to the Twitter and Facebook accounts of millions of voters.
  4. Some investigators suspect the Russians micro-targeted voters in swing states, even in key precincts where Trump’s digital team and Republican operatives were spotting unexpected weakness in voter support for Hillary Clinton.

So the question is this: Did the Trump campaign, using what we assume to be lawfully-obtained micro-targeted voter intelligence, give access to the Russians so that they could point harmful disinformation campaigns at those vulnerable  jurisdictions?

Many top security analysts doubt Russian operatives could have independently “known where to specifically target … to which high-impact states and districts in those states.” As Virginia Sen. Mark Warner said recently, “I get the fact that the Russian intel services could figure out how to manipulate and use the bots. Whether they could know how to target states and levels of voters that the Democrats weren’t even aware (of) really raises some questions … How did they know to go to that level of detail in those kinds of jurisdictions?”

And that is Senator Mark Warner’s mistake – that the micro-targeting had to be so specific that it only hit potential Trump voters in certain jurisdictions. It did not. The campaigns could have been aimed at every person in that state, let alone the jurisdiction, only touching the opinions of those who were ready to hear the message. A phishing campaign isn’t sent only to those people in an organization most vulnerable to that type of social engineering – it is sent to everyone, and the most vulnerable are the only ones that respond. Similarly, it was good enough for Russia to cast their anti-Hillary message in the general vicinity of the target; there was no need for a bullseye to render the disinformation campaign to be effective. Those who received the message but were slightly outside of the voter profile or geographical jurisdiction simply recognized it for what it was, false news. The rest were unethically influenced.

But we don’t know yet if there is a connection between the micro-targeting big data purchased by the campaign and the Russian botnet disinformation attack.  We do know, however, that Russia attempted to influence the outcome of the election – and that is what we as cyber security experts, must focus on. 

Either way – collusion or not – the implications against our privacy (let alone the political ramifications of foreign entities influencing our election process) are huge. Remember, the Trump campaign had obtained this huge volume of information on every voter, maybe as much as 500 points of data from what kind of food do they eat to what are their attitudes about health care reform or climate change. And yes, I’m sure the Democrats had much of the same information and probably didn’t “play fair” either. The point is that we have gotten so far beyond just accepting that our personal information is readily available and easily manipulated that no one is even bringing up that part of the story.

We, America, have been lulled into allowing everyone else – corporations, our government, even foreign nations – to have more access to our data footprint than even we do. 

John Sileo is an an award-winning author and keynote speaker on cyber security. John specializes in making security entertaining, so that it works. John is CEO of The Sileo Group, whose clients include the Pentagon, Visa, Homeland Security & Pfizer. John’s body of work includes appearances on 60 Minutes, Rachael Ray, Anderson Cooper & Fox Business. Contact him directly on 800.258.8076.

Is Russian Hacking of U.S. Nuclear Power Plants a Reality?

New Evidence Points to Russian Hacking of U.S. Power Grid

Russian hacking of the United States’ power grid isn’t just probable, it is already happening.

Hackers recently breached at least a dozen U.S. power plants, including the Wolf Creek nuclear facility in Kansas. It appears they were searching for vulnerabilities in the electrical grid, likely to be exploited at a later, more critical time. In a related case, hackers also recently infiltrated an unidentified company that makes control systems for equipment used in the power industry. Although none of the security teams analyzing the breaches have linked the work to a particular hacking team or country, the chief suspect is Russia. Why are they the primary suspect? Because Russian hackers have previously taken down parts of the electrical grid in Ukraine across several attacks and seem to be testing more and more advanced methods.

An analysis of one of the tools used by the hackers had the stolen credentials of a plant employee, a senior engineer – likely from a spear-phishing campaign. There have been similar campaigns from the same hackers against targets in Ireland and Turkey as well as “watering hole” attacks meant to infect victims with malware based on their predictable and routine visits to certain websites.

Spend a minute imagining the destruction of a foreign nation or terrorist bringing down a portion of the U.S. electrical grid during the freezing cold of winter, near the control tower for an airport or just prior to launching a military invasion (see what happened in Ukraine).

Here’s the most important thing you need to understand – what has been launched so far are NOT ATTACKS, but preliminary tests. The Russians (or whoever is behind these “penetration tests”) want to know our vulnerabilities before they need to exploit them. They are merely testing the waters, so the absence of a serious event is definitely NOT proof that their efforts are not working. In fact, that is the mistake that many businesses make about cyber security – they wait until AFTER a successful attack on their data to become believers in the need for prevention.

In this case, as in many, the hacker’s first beta strikes are aimed at non-critical business networks – that’s how they come to learn the “language” of that particular power provider. Once they know the patterns, prejudices and back doors of these systems, they begin applying what they’ve learned to mission-critical operational systems. THAT’S HOW THEY TURN OFF THE LIGHTS, ONE TINY STEP AT A TIME.

And that is also the window in which we must solve our weaknesses. The metaphorical shot has been fired across the bow – we KNOW that someone is hacking into our nuclear power grid. But the bomb hasn’t yet landed in one of our neighborhoods. What are you doing to prevent “lights out” in your business? Organizations that have a Best Practice Cyber Security Plan already know how to avoid the dark. 

 

John Sileo is an an award-winning author and keynote speaker on security awareness training and cyber security. John specializes in making security entertaining, so that it works. John is CEO of The Sileo Group, whose clients include the Pentagon, Visa, Homeland Security & Pfizer. His body of work includes appearances on 60 Minutes, Rachael Ray, Anderson Cooper & Fox Business. Contact him directly on 800.258.8076.