{%CAPTION%}
It’s Christmas time and, at least for me, I’ve already received a few fraudulent calls and messages with malicious links trying to spoil my holiday season.
I imagine I am not the only one, since these are the favorite dates for cybercriminals to deploy their entire arsenal, and try to catch off guard all those people who expect to receive congratulatory messages from family and friends. Probably, the most unwary or those with a lesser culture of cybersecurity will be easy prey.
Everything can be avoided by learning the basics of Internet safety. In a short time, surfing the net will be as natural and safe as walking through the streets of your city; yes, the streets also have dangers, that’s why our parents taught us as children to know them in order to avoid them.
This is the first article in what I hope will be an extensive series. My goal is to demystify the idea that protecting your digital life and privacy online requires too much effort or technical knowledge.
Believe me, although it may seem complicated, it is not.
In the following articles we will focus on how the bad guys think, what attack vectors they usually use, their motivations, prevention tricks, detection and recovery in case they have not been able to avoid it.
With this knowledge, you will be able to avoid more than 90% of the most common attacks and scams on the Internet. It is not worth living with fear and uncertainty for the rest of your life, because you have technology for a while, so I encourage you to continue reading these articles of just 5 minutes of reading.
Surely you have heard or said some of the following phrases:
- “I don’t care if they spy on me, I have nothing to hide”,
- “I don’t need to worry about my online security, I have no money and I’m not an important person, who would want to attack me?”,
- “I’m too old to start learning technology”,
- “I don’t need it, I already have an antivirus that protects me”,
- or the latter, “that won’t happen to me, I’m not that dumb”.
Many said the same thing until they lost their business to a scam, were fired for cybersecurity negligence, had their bank accounts embezzled, had all their memories - photos and videos - encrypted, threatened to divulge private or intimate information, etc.
Without wishing to alarm, the truth is that all of the above happens to thousands of people around the world on a daily basis. Cybercriminals do not stop, and operate like a professional company with its offices, established working hours, organizational structure, salaries and incentives and, of course, accumulate experience victim by victim to improve their techniques and become more difficult to detect.
But knowledge is our best defense. With a basic digital security culture and a good dose of common sense, you will be able to live without the constant worry of thinking that, sooner or later, you may be the victim of an attack or scam.
The importance of Privacy
When you say, “I have nothing to hide,” you are really saying, “I don’t care about the right to privacy,” or put another way, it amounts to giving up a fundamental right just because you don’t need it at the time.
“Saying you don’t care about the right to privacy because you have nothing to hide is the same as saying you don’t care about the right to free speech because you have nothing to say.” Edward Snowden
History has shown that fundamental rights can become essential when circumstances change. This has happened in the past and continues to happen in countries where human rights are not respected.
In situations of dictatorship, war or regime change, you want the state to have as little information about you as possible. Examples abound: Jews during Nazism, Afghan translators after the Western withdrawal, LGBTQ+ people in oppressive countries, and even individuals who are denied loans, health insurance or jobs by companies on a daily basis, all because it is not difficult to get hold of everything we post on social media or ask the search engine or AI (Artificial Intelligence) tool of the day.
Let’s start with something easy and what happens most often:
Theft of Personal Information
Smishing from official 2FA BBVA channel
Hackers use social engineering techniques, or the “art of deception”, as an attack vector. The most common attacks are phishing or, as shown in the image, “smishing”. smishingwhich consists of sending you an email or SMS pretending to be your bank or a well-known company.
As you can see in the image, these messages always include a malicious link calling you to action and always with a sense of urgency, so that you rush to click without thinking too much.
The example shown in the image I received a few days ago and it is especially delicate. I had to call BBVA to confirm it. The attackers had compromised the official BBVA channel from which they provide the two-factor authentication (2FA) numbers. This is a danger, because anyone could click on the link because they consider the source to be trustworthy. As you can see, even BBVA can be compromised. The funny thing is that as a customer, I never received a message warning me that their 2FA channel was compromised….
In the end, cybercriminals are looking for easy, trigger-happy prey, i.e. people who click at full speed without stopping to think about whether the link could be dangerous, even if it comes from a trusted source.
If you click on one of these links, either of two things could happen to you:
- You access a web page that installs malware( malicioussoftware**) on your device. This can encrypt data, spy on you, use your resources to mine cryptocurrencies or include your device in a botnet.
- That you access a cloned page of your bank and provide your credentials, which will be captured by cybercriminals.
Fortunately, banks have implemented 2FA, which complicates these attacks. However, this strategy is still valid for other online services and platforms.
Identity Theft
We all seem to love uploading our lives in the form of photos and videos to different social networks such as Facebook, Instagram, LinkedIn, etc., so their main attack vector is to steal all the information you post on your social networks. Then they create profiles pretending to be you, and perform actions as disparate as:
- ask your contacts for money,
- buy drugs from your profile,
- download pedophilia,
- extorting money from third parties, etc..,
and all this in your name, which I assure you will not always be easy for you to explain to the police.
By the way, and if you are one of those people who left your account abandoned in the past because you forgot the password, or because your account was stolen and you didn’t care much about reporting it; know that those are the easiest accounts to steal and they are still linked to you.
Thanks to the numerous leaks in various security breaches suffered by millions of companies around the world, cybercriminals, after demanding a ransom in exchange for not making public the stolen private data of its users, if the company does not pay, will then expose all this data in freely accessible repositories on the Internet (user, passwords, cell phone, email, address, ID, thoughts, opinions, …).
Other criminals will find them and continue to do more damage, but this time to users of the hacked platform.
This has happened, for example, to Facebook, and all those users who did not change their passwords or had 2FA enabled probably lost access to their accounts.
Fraud in Internet purchases
The typical attack vector is offers and bargains that are too good to be true. You pay for a product that never arrives or you receive something of very poor quality.
The problem with this type of scam is not only the financial loss, but also the time you lose if you decide to complain. In addition, if the resolution is extended in time, it can influence your mental stability by making you feel helpless.
And I could continue the list and, in fact, I will do so in subsequent articles. We will look at how to stop or mitigate other attacks that come from certain types of malware, harassment and cyberbullying, emotional blackmail, extortion, total loss of privacy, etc.
If these problems worry you, don’t give up. Article after article, we will be looking at how to improve your digital life.
I assure you that it is not that complicated and I will try to explain it in such a way that anyone can understand it, no matter their age or previous knowledge in technology.
Tell me, has anything similar happened to you or is there anything that worries you?… we can talk in the comments and together we can increase our cybersecurity culture.
By the way, if you want to receive alerts in your email to find out about the next publication Subscribe!