Five Top Data Threats Consumers Should Watch Out For In 2019

It's not clear that security threats are coming from genuinely new directions in 2019, but it is clear that some of the existing threats are becoming more damaging. Here's a look at 5 powerful and persistent threats, not in order of presumed priority.

Cybersecurity resource site     https://www.stopthinkconnect.org/

- The IoT provides easy access to many smart homes. When did you last buy an appliance, or perhaps even something as simple as a door lock, that wasn't connected to the internet? Most are, and manufacturer security is notoriously weak. Begin by changing the manufacturer-supplied password and continue by reading the instructions to ensure that protection like automatic software updates is in place. It's likely that threats will become ever more sophisticated.

- Mobile threats multiply with emphasis on fake apps. Traditional threats like advertising that delivers malware and phishing attacks--born on the desktop and migrating to mobile--continue to affect millions of consumers. Even more worrisome, because they are so hard to detect, are fake apps. They can be found anywhere, even on the app stores. The malicious apps are removed when identified, but new ones take their places. One security firm suggests three ways to identify fake apps:

1. Look for the developer name. If it is not the same as the brand, there's something wrong.
2. Read the reviews and see if they appear legit.
3. Be suspicious of unreasonable promises--or unreasonable requests like writing a review before you download the app.

It would be good to read the entire post.

- Phishing is now spear phishing. Here's one example, mortgage wire fraud:

home buyers are tricked into wiring closing fees to a rogue party by an email arriving from a trusted mortgage agent. “The hacker breaks into the mortgage lender’s (or title agent’s) computer and takes note of all the upcoming pending deals and their closing dates,” he says. “Then the day before the mortgage agent would normally send out an email telling the client where to send the closing money, the phisher uses the mortgage agent’s computer to beat them to the punch. The unsuspecting client wires the money, which is rarely recovered, and ends up losing the house (unless they can come up with another substantial closing payment, which most can’t do).” 

Spear phishing can be very close to home and very personal. At least 3 employees at Wichita State University responded to a phishing email by supplying their university ID number and lost their entire paychecks, which were diverted and never reached their banks. Individuals should never respond to this kind of request for information and employers have a huge responsibility to educate and remind their employees of the danger.

- Artificial Intelligence leading to smarter attacks on a larger scale. What AI can accomplish remains a mystery to many web users because it's highly technical in nature. Look at it this way. AI can help cybercriminals deceive users directly or to trick the technology itself.  I wrote about fake news during CyberMonth and the warnings there are relevant (1, 2 and more).

https://www.bbc.com/news/av/technology-40598465/fake-obama-created-using-ai-tool-to-make-phoney-speeches

Here an example of a totally fake Obama message that could have been aimed at web users. It was produced by researchers and they explain the basics of how they did it. It's easy enough to understand, but harder to actually do. However, the technology is readily available to web users who care enough to find it and learn to use it.

Harder to understand are techniques used to hijack web sites. Here's a brief article about the use of fake fonts to disguise landing pages created for phishing schemes. It's not necessary to understand how it is done to understand there are ways of deceiving users that are hard to identify. The article doesn't say so, but the fake pages should have URLs that are not exactly the same as that of the actual brand. Users need to beware, but they also need to be able to trust brands, and that's getting increasingly hard to do. When in doubt, especially about a followed link, close it and go directly to the brand website. And make a practice of notifying brands when you see something that appears suspicious. How the brand responds is one way of knowing whether to trust it or not.

- Following the implementation of the EU's GDPR in 2018 laws protecting privacy will continue to emerge.  The General Data Protection Regulation is a sweeping reform of European privacy laws, which were already stronger than those in the US. I explained how and why the law applies to US web users in a 2017 post. Users currently see the effects in things like cookie warnings and explicit requests to contact users when they visit a site. See if your state has recently passed a law regarding data privacy on this consumer-oriented site. There are also legal sites that cover the issue.

The focus in the US is on the states because the federal government has moved in the other direction. The repeal of the Net Neutrality law made it possible for ISPs to collect and sell data about the activities of their users. Who knows more about us? Watch for a followup post on this issue soon.

These are five broad categories that cover many types of threats. Customers need to have high expectations of the brands they use in terms of how well the brand protects their data. It really helps for brands to know that their customers are paying attention and even taking actions on the basis of how much they trust the brand.

'Paying attention' is the relevant phrase. Every individual user needs to be alert to attempts to breach their privacy and steal their identity. My new year's resolution is to do all I can to be helpful!

Stay Safe in 2019!

The Global War over Data Privacy

Data privacy issues are global because the internet itself is global. Actually, it's becoming less so as China builds its own version and the EU implements privacy laws that build a wall around its own citizens. At some time in the fairly near future, it may effectively become three separate versions of the internet. There's more in the Freedom on the Net 2018 report and it's fascinating reading. There's a section on China that is particularly interesting.

The report says straightforwardly that we are losing the battle for data privacy and presents this graphic to illustrate its point. The data breaches it pictures, many of them familiar to us, keep growing in size. Just today Marriott announced that the records of 500 million of its customers all over the world had been breached.

One that may not be familiar is a lesson in what is going on in one democratic nation. Aadhaar is the national identity card of India that contains demographic and biometric data on over 1 billion Indian citizens. It provides identification and access to financial and government services. It has a history of data breaches of various sizes and severity, and it seems that virtually all data has been accessed at one time or another. The Aadhaar system collects a significant amount of biometric data about each subject, something not universally done in the US. Could that be in our future?

If you are interested in the issues surrounding the internet in China, here is an interesting article on Google's controversial development project in China. It comes from a site called Global Voices that publishes articles by writers from many different countries. I recommend the site and their newsletter for interesting reading on many subjects.

Stay Safe!

Related Updates
Developments in Russia 

Toys That 'Do No Harm' - Holiday Gifts 2018

When my children were growing up we accessed a report on dangerous toys that had mechanical or usage issues that could cause unexpected harm. Now the scene has shifted. The question is, "Do the toys listen in on family conversations or otherwise invade privacy?"

It's an important question and maybe even harder to evaluate than the mechanical issues I was hopeless at. Mozilla is the non-profit developer of the open-source browser Firefox, which many of use in preference to a commercial browser. Their second annual report on connected toys that do not have serious privacy issues is a welcome addition to the 2018 holiday season.

Here's a link to the report. Note that users can include their own ratings to further increase the quality of the recommendations.

Most of us will include some connected electronics products on our gifts lists, so this should be required reading for all!

Stay Safe this holiday season!

The Future of Fake News

We have seen the future of fake news and it's Artificial Intelligence. MIT Technology Review did a series on AI and disinformation and here's a quote from their newsletter:

The big change: AI now makes it possible for anyone with a decent computer and a few hours to spare to do what only used to be possible at a big-budget movie studio: create believable, but totally fake video footage. Further machine-learning advances will make even more complex deception possible--and make fakery harder to spot.
Deep fakes and politics: Convincing AI enabled face swaps—called deepfakes—that threaten to further blur the line between truth and fiction in politics. “Deepfakes have the potential to derail political discourse,” says Charles Seife, a professor at NYU. “Technology is altering our perception of reality at an alarming rate.”
Easy to fake: Tools for creating these false videos are becoming increasing easy to use. Our own Will Knight easily stitched Ted Cruz's face onto Paul Rudd. As he writes, perhaps the greatest risk is that the technology will further undermine truth and objectivity. It’s not that the truth won’t still be out there—it’s that we might not know it when we see it. 
            
Here are a couple of videos that illustrate the issues.



The first one allows any klutz to superimpose cool dance moves onto his or her frame. That's fun! And the authors explain how they did it.


This presents an unsettling view of the future. Is there anything that can be done? Or more specifically, can technology rescue us from the danger it has created?

There is a possibility that technology can come to the rescue. Wired describes a Darpa program called MediFor—Media Forensics. Remember, the Defense Advanced Research Programs Agency (DARPA) gave us the initial structure of the internet. The program is a national security effort, so that suggests it is well funded. 

The DARPA effort includes many complex technologies like facial recognition, but the Wired article is easily comprehensible to the layperson. I urge you to read it in its entirety--it has good news as well as bad.

That's a fitting note on which to end my #CyberAware posts. But I'll be following up on many of these topics in the very near future.

I hope you've enjoyed this month of posts and

Stay Safe!

Related Content:
Deep fake of Mark Zuckerberg 

Tools For Identifying Fake News

It's important to remember that the internet/social media did not invent fake news. It's been around forever. However, it is equally true that the internet distributes fake news at an incredible speed and social media is the main, but not the only, culprit. Hence, yesterday's post about how to identify fake news in social media.

If you found that a bit disappointing--the advice is not terribly different from that for identifying fake news in any context--you are exactly right. It's reasonable to ask whether there are any tools that could be helpful.

Before a brief listing of tools, a word about fake news itself. Most of us have read ad nauseum about foreign interference. A lot of it is alarmist and lacking in factual data. I've found two thoughtful reports if you want to review them to be sure what you're looking for. A recent report that is detailed and factual comes from Ars Technica. I took the graphic from there; it was the least repugnant one in that set; you are welcome to look further. The other is a brief post from Axios about uses of social media by various governments.

Now on to tools The best known is one called Botcheck.me. Just a visit there is interesting because it shows the trending hashtags and most active Twitter accounts for the past 24 hours. It's easy to put your Twitter account name in and find out if you have suspicious patterns suggesting the presence of fake news sites. Mine didn't show any, which is not surprising, because I follow mostly business news sites. There are a few more but most, like Botcheck.me which only works on Twitter, are somewhat specialized.

Facebook also has a tool that let you see whether you've followed or liked any suspicious pages. 

The most used tools are probably the fact-checking sites.These have been around for awhile. I've used them all and find them to be reliable:

• FactCheck.org
• Snopes
• Politifact
• Fact Check by the Washington Post

They all have interesting posts about the stories they research. It's worth following one or two of them just to keep up with what's out there.

Tomorrow is the last #CyberAware day. The month has flown by!

Stay Safe!
Updated 10/25, 11:45 am

How to Identify Fake News in Social Media

Identifying fake news on social media platforms is difficult for the individual user, primarily because it comes from trusted friends. It is also particularly dangerous for the same reason; the trusted source makes it more likely to be believable.

Analytics site Statista has an interesting page that highlights numerous pieces of data about fake news. The data in this first chart should surprise no one. As a single site Facebook is still king of the hill when it comes to fake news, although Twitter is not that far behind.

If you too feel surrounded by fake news, the second chart will be interesting. It shows the U.S. to be considerably behind three other countries in terms of exposure to fake news. There may be reasons why various countries have different levels of exposure to fake news, but they are not evident upon simple inspection.





NBC news explains a bit how bots work to distribute fake news and gives some tips for recognizing a fake news post when you see it. The advice may seem a bit familiar, but it is good. Remember that the source of fake news is something fake. Their recommendations have some good commentary:

• "Question the source. If a story comes from a newspaper, is it from a reputable site? The Denver Guardian, cited often in 2016, never existed and listed an empty car park as its address.
• Look for confirmation. If you don’t see a story across mainstream media, there’s probably a good reason why. “Mainstream media is motivated by getting an audience.” Huxley* says.
• Check the facts with third-party sites like Snopes and Politifact. Admittedly, though, fact checking has its limits. By the time a claim is researched and proven false, it may have already reached millions of accounts.
• Call out fake news you see in your network — but do it privately. “What polarizes people further is calling them out publicly. Then people get defensive because it makes them look stupid or gullible for posting it in the first place.” Huxley says." 

*Sam Huxley. practice chair of risk and business strategy, for the communications firm LEVICK.

 
Those are good suggestions, and we should all be following them. The article has another good idea, though, "Burst your own bubble." We all live in self-created bubbles these days. In following content we enjoy we have surrounded ourselves with content we agree with. Subscribe to some feeds that provide alternative points of view. Your own perspectives will be stronger after some reflection.

There are other sites and a few tools that can help in this challenging endeavor. I'll discuss some of those tomorrow.

Stay safe!

How Can You Tell It's Fake News?

Fake news is not new. Apparently the Ancient Greeks were masters of it. However, the Ancient Greeks didn't have the internet. We all know that fake news flourishes there. Problem is, how do we spot it.

Here's an infographic from the IFLA with 8 good tips. And the infographic itself provides several good lessons.

https://www.ifla.org/publications/node/11174

Lesson 1. It's from the International Federation of Library Institutions and Associations. That's a mouthful, so the acronym is much appreciated. But it's easy to look up (search for) with almost 3 million results. The first ten, at least, look entirely reputable.

Lesson 2. The infographic has the name of the organization as part of the graphic. That's not a solid clue because some fake news organizations like to promote their names and make it easy to find their content also. However, checking on the origin of the publication is important if you have any doubt at all, and making it easy is good.

Lesson 3. I've put the URL for the link in the caption anyway. It's a .org, not some kind of flaky URL. That's super important. That's the key issue, but the name of the organization in the link is also correct and straightforward. No deception here.

Lesson 4.  The website itself is solid, not a thrown-together mishmash. It has a really interesting set of pages on their vision for the future of libraries. More relevant to the current issue, the article has a link to FactCheck.org, which is a well-known fact-checking group.

Lesson 5.  Finally, I'll give the advice I've been giving my students for years. Use the golden rule of journalism. Two sources are necessary. Three is the gold standard. If three reputable publishers agree on the facts, there's a good chance they are true.

If there are opposing arguments, keep on reading. That's one thing we do too little of these days--listening to arguments from opposing sides. 

Hint: it gets more difficult from here on in. Tomorrow I'm going to tackle how to identify fake news on social media feeds.

Stay Safe!

Related Updates
Good example of fake news targeting the Red Cross
How fake news happens