A friend of mine opened her Hotmail account this week to find a bunch of bounce back messages that indicated her full address book had been spammed and all her contacts had been deleted.
What an embarrassment and a hassle.
She was quite sure that no one could have access; no one knew her password. So how did it happen then? Had someone used some sophisticated software to break the code to get in? Probably.
I asked her a few questions and the likely cause quickly revealed itself. She posts her email address on Facebook. Her date of birth is also posted on Facebook. She’d been on Twitter on her recent birthday discussing the celebrations. Her password was her date of birth. So you can see how the hacker got the information required to get into Hotmail.
It could have been worse when you think that people often use the same password on multiple sites, such as their bank, credit cards and shopping sites. Thankfully my friend did not use her date of birth on any other account. But her innocent participation in two of the most popular social networks left her, and her contacts, at risk.
It could happen to anybody really, and the ramifications to both an individual and the employing organisation can be profound. However, here are some simple steps you can take to protect yourself, your systems and your business.
Here are some tips on keeping your passwords safe:
-Pick a password that is meaningless. Not your address, your mother’s maiden name nor the name of your dog. A hacker can find this information almost effortlessly, especially if you’re on Facebook, MySpace or Twitter.
-Use a combination of uppercase and lowercase letters, symbols and numbers. This complicates things for hackers.
-Choose long passwords. The longer, the better, because it’s more difficult to crack.
-Don’t use the same password forever. One good idea is to make a routine of changing it the first day of each month.
-Never use the same password on multiple accounts. Use a different password for each online account.
-Never write your passwords down and never give them out to anyone.
On the surface these last two points, combined, might make the task seem somewhat unmanageable when you consider that today it’s not uncommon to have 20-30 or more website accounts.
But you don’t have to commit to memory dozens of constantly-changing passwords. There are some very clever software products out there, many of them free, to help you generate random passwords and remember them.
I like Roboform. Developed by Siber Systems Inc. it’s available for many web browsers, but mainly supports Internet Explorer, Firefox and Netscape and there are versions for many hand held devices too. It does not yet support Apple Macintosh nor Linux system, but there are lots of products out there which do.
Thinking back, I wrote my first ever article on avoiding hack attacks way back in 1992, when I was producing a staff newsletter for a large corporation. The advice has changed little since then. You just need to use good common sense and avoid succumbing to human nature.
But if your Hotmail or other email account is compromised, the very first thing you should do is change your password to something stronger.
Then you should immediately run both virus and spyware scans to make sure the hacker hasn’t left anything nasty or malicious behind. Check that your auto responder and email signature have not been tampered with and no spam messages have been added. Then don’t forget to let your email providers support team know about the problem.
If yours is not an isolated incident, they might need to take steps at their end to plug a security hole. And, no matter how tempted you are to find out who has victimised you and your contacts, don’t click through to the site the spammer is flogging.
You already know it’s not legitimate; there is no need to risk further viruses or give spammers a good payday.
No Comments »
Filed under: Tech Talk, public relations