Cyber Smart

Five Habits to Protect Your Family, Money, and Identity from Cyber Criminals

Bart R. McDonough

• Éditeur: Wiley
• Année: 2018
• ISBN:
  9781119559641
• Édition: 1
• Sujet: Computer Science
• Sous-sujet: Cyber Security

An easy-to-read guide to protecting your digital life and your family online

The rise of new technologies in our lives, which has taken us from powerful mobile phones to fitness trackers and smart appliances in under a decade, has also raised the need for everyone who uses these to protect themselves from cyber scams and hackers. Every new device and online service you use that improves your life also opens new doors for attackers looking to discover your passwords, banking accounts, personal photos, and anything else you want to keep secret.

In Cyber Smart, author Bart McDonough uses his extensive cybersecurity experience speaking at conferences for the FBI, major financial institutions, and other clients to answer the most common question he hears: "How can I protect myself at home, on a personal level, away from the office?" McDonough knows cybersecurity and online privacy are daunting to the average person so Cyber Smart simplifies online good hygiene with five simple "Brilliance in the Basics" habits anyone can learn. With those habits and his careful debunking of common cybersecurity myths you'll be able to protect yourself and your family from:

• Identify theft
• Compromising your children
• Lost money
• Lost access to email and social media accounts

Digital security is one of the most important, and least understood, aspects of our daily lives. But it doesn't have to be. Thanks to its clear instruction, friendly tone, and practical strategies, Cyber Smart will help you rest more easily, knowing you and your family are protected from digital attack.

II
Specific Recommendations

• Chapter 10: Protecting Your Identity
• Chapter 11: Protecting Your Children
• Chapter 12: Protecting Your Money
• Chapter 13: Protecting Your Email
• Chapter 14: Protecting Your Files
• Chapter 15: Protecting Your Social Media
• Chapter 16: Protecting Your Website Access and Passwords
• Chapter 17: Protecting Your Computer
• Chapter 18: Protecting Your Mobile Devices
• Chapter 19: Protecting Your Home Wi-Fi
• Chapter 20: Protecting Your IoT Devices
• Chapter 21: Protecting Your Information When Traveling

10
Protecting Your Identity

Leading up to the 2016 U.S. presidential election, 12 Russian nationals plotted an identity theft scheme to influence the country's vote by promoting presidential candidate Donald Trump. Russian identity thieves purchased six stolen U.S. citizens’ identities on the Dark Web to carry out their political conspiracy.

With the help of a Californian who sold fraudulent bank account numbers to people on the Web, the Russian nationals obtained verified PayPal accounts using their stolen personas. The thieves used these PayPal accounts to fund their conspiracy to attempt to influence the U.S. election.

According to the 2018 federal indictment made by U.S. Special Counsel Robert Mueller, the identified Russian nationals were charged with attempts “… to defraud the United States by impairing, obstructing, and defeating the lawful functions of the government through fraud and deceit for the purpose of interfering with the U.S. political and electoral processes, including the presidential election of 2016.” Specifically, the Russian nationals’ political interference operations consisted of “… supporting the presidential campaign of then-candidate Donald J. Trump (“Trump Campaign”) and disparaging Hillary Clinton.”¹

Dubbed the Internet Research Agency (IRA), the Russian “cyber influence” group used social media as a cultural weapon to attract Trump supporters through false propaganda and ads against the opponents. The IRA accepted $25–$50 payments from individuals who wanted to post content on the social media pages they orchestrated.²

Masquerading as various U.S.-based grassroots organizations, the IRA used the stolen identities of Americans to reach out to political organizations and obtain support and promotion for Pro-Trump rally organization in “purple” states like Florida.¹ Some of the nationals even obtained false government documents to travel to the United States to gain intel to further their tactics to tamper with the nation's political system.

Starting in 2014, the IRA employed hundreds of people within their Russian headquarters, all with the goal to “spread distrust towards the candidates and the political system in general.” With hundreds of Facebook, Twitter, and Instagram accounts—some with more than 100,000 followers—the IRA promoted Trump, opposed Hillary Clinton, and attempted to dissuade minority groups from voting at all.¹

The situation of the Russian nationals involved in stealing U.S. identities by purchasing them on the Dark Web is just one example of what can happen when Social Security numbers (SSNs) are exposed from a data breach, such as Equifax. Besides a data breach, there are other ways your personal information can end up in the wrong hands.

Methods of Identity Theft

There are several techniques bad actors use to get their hands on the sensitive information that makes up your identity. These techniques vary in complexity and scope, but the goal remains the same. Bad actors want your personally identifiable information (PII) to open bank accounts and credit cards, obtain loans, submit healthcare claims, and even evade the police (which could risk your going to jail for someone else's arrest warrants). Remember, PII includes the information that can be used to identify you (for example, SSNs, driver's license number, billing address, date of birth, and so forth).

The following are some common methods fraudsters utilize to steal your identity.

Ways Identity Thieves Steal Your Identity

• Data Breach Breaches, such as Equifax in 2017, which exposed more than 140 million SSNs, hundreds of thousands of credit card numbers, and other PII, create a challenge since an individual's identity is already leaked prior to the company and consumers knowing about it.³ Equifax's breach cost consumers $1.4 billion, with an average cost of $23 per person, after 20 percent of Americans placed a security freeze on their credit files.⁴

  ---

  KATIE SAYS, “NO, THANK YOU.”

  One such individual who was affected by the Equifax breach was Katie Van Fleet, of Seattle, who started receiving “thank you” letters for opening credit lines at 15 retail stores, such as Barneys of New York and Home Depot. Katie was perplexed because she never applied for these accounts.

  With the theft of her identity attributed to the Equifax breach, Van Fleet filed a class-action lawsuit based on negligence against the major credit bureau. “I didn't think this would ever happen to me … it's been very frustrating,” Van Fleet told her local news. Even though she placed fraud alerts on her credit report, she kept receiving those “thank you” letters. What ended up saving her from further identity theft was placing a security freeze on her credit report.⁵

  ---

  Experian, one of the four main credit bureaus, also experienced an undisclosed breach in 2013 where 200 million consumer records were exposed by a Vietnamese man named Hieu Minh Ngo, who ran an identity theft service online posing as a U.S. licensed private investigator. Ngo paid thousands of dollars to Experian each month to gain access to hundreds of millions of credit files. Ngo then resold these records to more than 1,300 bad actors who subscribed to his identity theft service. Bad actors filed more than 13,000 falsified tax returns using the purchased identity info, which allowed them to collect $65 million in fraudulent tax return funds. Ngo was actually caught by the U.S. Secret Service and was sentenced to 13 years in prison.⁶
• Dark Web Like the story of the Russians who purchased identities of Americans to influence the 2016 presidential election, thieves purchase identities on the Dark Web. PII gets on the dark corner of the Internet through data breaches and social engineering tactics, such as phishing. As you learned in Chapter 3, the identity of a person with a perfect credit score of 850 goes for around $150. And medical information goes for ten times the amount of credit card numbers on the Dark Web because credit card numbers can be changed, but your health history never changes.⁷
• Social Engineering This is the most common tactic for obtaining sensitive information by tricking someone into divulging SSNs, bank account numbers, and other personal details. The range of attack methods are diverse and can include scenarios such as a phishing email from your “bank” to update your information to keep your account active or the “FBI” calling you to warn you of an arrest warrant unless you pay “unpaid taxes.” Identity thieves are creative. Remember, this is their job, and they want to do their best to make the most money possible.
• Dumpster Diving Yes, your garbage is wanted by thieves. How many times have you thrown out expired credit cards, credit line offers, bills, and other sensitive paperwork instead of shredding them? Bad actors are banking (literally) on getting any tidbits of PII they can to open accounts and rack up debt on your behalf. Austin-based security researcher and professional dumpster diver Matt Malone found $1.8 million in original and copied checks inside a discarded filing cabinet placed in an Austin remodeling company dumpster during the tax season of 2018. In addition to checks, the company also disposed of their employee W-2s, as well as customer driver's license numbers and other sensitive information. By bringing awareness to what he finds in the trash, Malone hopes more individuals and businesses will take care of what they throw away. “People wonder how identity theft happens,” Malone told CBS Austin, “It starts in the trash can.”⁸ The story of...