Tag Archive for Password management

Creating Strong Passwords is Good For You

Creating Strong Passwords is Good For YouYou can buy a small padlock for less than a dollar—but you shouldn’t count on it to protect anything of value. A thief could pick a cheap lock without much effort, or break it. Yet, many people use weak passwords. They use them to “lock up” their most valuable assets, such as money and secrets. Fortunately, everyone can learn how to make and manage stronger passwords. It’s an easy way to strengthen security both at work and at home.

What makes passwords ‘Strong’?

What makes passwords ‘Strong’?We all hate the dreaded “you must change your password” email from IT. It must be at least 12 characters long. It must include numbers, symbols, and upper- and lowercase letters. You think of a word you can remember, capitalize the first letter, add a digit, and end with an exclamation point. The result: Strawberry1!

Unfortunately, hackers have advanced tools. They can easily defeat passwords based on dictionary words. These are words like “strawberry” and common patterns. An example is capitalizing the first letter.

Increasing the complexity, randomness, and length of a password makes it stronger. These changes make it more resistant to hackers’ tools. You can see in the table below from MyITRisk.com. An attacker could guess an eight-character password in 8 seconds. But, a 12-character password would take four years to guess.

Password space charactersLength required charactersDefeted in.
26 (a-z)8.0077 Seconds
52 (a-z, A-Z)82 Seconds
62 (a-z, A-Z, 0-9)88 Seconds
26 (a-z)1259 Minutes
52 (a-z, A-Z)12168 Days
62 (a-z, A-Z, 0-9)124 Years
26 (a-z)1651 Years
52 (a-z, A-Z)1691 Years
62 (a-z, A-Z, 0-9)1655,988.220 Years
MyITRisk.com

 

It is also important to pay attention to password complexity. Also you should also pay attention to password unpredictability. You want to avoid common substitutions (e.g., ‘a’ to ‘@’, ‘s’ to ‘$’).

Why Uniqueness Matters

Why Uniqueness MattersPeople reuse passwords for many accounts. This risky behavior opens the door for attackers. Even a single password, even a strong one, can lead to access to valuable accounts. Password reuse can lead to a domino effect of account breaches.

Reusing passwords, even strong ones, can leave accounts exposed to attacks.

Here’s a real-life example

Ten years ago, Daisy joined an online gardening forum. She also created an online payment account and used the same password. She soon forgot about the gardening forum. But, someone accessed her payments account years later and stole a lot of money.

Daisy didn’t know someone had hacked the gardening forum. The hackers leaked users’ logins online. An attacker likely tried reusing Daisy’s leaked password on popular sites. Eventually, the attacker got lucky.

Guarding your passwords

  1. Don’t write them down. Many write passwords on post-it notes and leave them in plain sight. Even if you hide your password, someone could still find it. Similarly, don’t store your login information in a file on your computer, even if you encrypt that file.
  2. Don’t share passwords – You can’t be sure someone else will keep your credentials safe. While at work, you may have to take responsibility for anything that occurs when someone is logged in as you.
  3. Don’t save login details in your browser. Some browsers store this info in unsafe ways. Another person could access your accounts if they get your device.

Tips for keeping passwords secure

Consider sharing these password tips with family and friends.

  1. Never reuse passwords – Create a unique, strong password for each account or device. This way, a single hacked account doesn’t endanger other accounts.
  2. Create long, complex passwords. Don’t use passwords based on dictionary words, pets’ names, or personal information. Attackers can guess them.
  3. Use a password manager. These tools can store and manage your passwords. They can also generate strong new passwords. Some can also notify you when a password might be compromised.

rb-

A strong password is the main barrier keeping most of your online accounts from being hacked. Without up to date practices, you might be using passwords that cyber-frauds can easily guess within minutes.

The average user creates passwords to fight data theft. The user could switch up the characters in your passwords and “Tr1Ck” your way into security. However. in today’s environment you need to create passwords that can fight modern password theft methods. Today, cyber-criminals use sophisticated technology to get your passwords. Users must consider the hackers software that is designed to account for user behavior as it guesses your passwords.

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

6 Things to Never Save on Your Mobile Phone

6 Things to Never Save on Your Mobile PhoneTwo out of every three people are addicted to their mobile phone. The average user touches their smart phone 2,617 times a day. It is no wonder that most people view their cell phone as detailed summary of their personal life. This convenience comes at a price. A recent from report from Kensington found that 70 million smartphones are lost each year, with only 7 percent recovered.

dangerous to your privacy and your walletThere are things you should never store in your cell phone. Readers Digest says that keeping valuable info on your mobile is dangerous to your privacy and your wallet. You open yourself up to an invasion of privacy, identity theft and straight-up theft. Here are some things you should not keep on your phone.

Your passwords

If you keep your passwords on your mobile, you are putting you privacy at risk. Even if you keep them in a note, a document or even in auto-fill on your mobile, you’re putting your data at risk. The article says if you lose your phone, someone might easily see your “cheat sheet.”  Because everyone snoops through mobile phones. Even if you store your passwords on your mobile phone they can end up stored in the cloud, still putting your accounts at risk. Instead consider a password manager such as Keeper, or LastPass. That way all of your passwords can be accessed by you using one strong master password.

Your face and fingerprints

don’t use biometrics to open your phoneIf you really want to keep your cell phone secure, don’t use biometrics to open your phone (or any of its apps or accounts). There are many reasons why biometrics like fingerprints don’t make you more secure. Facial recognition apps are more dangerous that using a password. The author says the simple fact is that a phone that requires a password to unlock it requires more steps to unlock. That makes the mobile phone more secure.

Your private photos and videos

You may have cleaned up your Facebook account, but what about your phone? What photos and videos do you store on your phone? If you have photos you wouldn’t want your spouse, children, or boss to see, then you shouldn’t store those photos on your smartphone according to the article. Media stored on your phone is saved in the cloud outside of your control.

Your naughty photos are one problem. Another is any photos containing private information. While photos of credit cards and ID can help you keep track of “what’s in your wallet,” they can also leave your information vulnerable to hacking. Again the photos are stored on the cloud. As with your naughty photos, Readers Digest suggests you store your pictures ID on a PC that only you have access to in a password-protected album.

Anything on your work phone

Do not save anything personal on an employer-provided mobileDo not save anything personal on an employer-provided mobile. There’s no such thing as a free lunch. The phone you were issued by your employer comes at a steep price: your privacy. You should have no expectation of privacy for anything you do on that phone. For your personal life the article recommends using a separate phone and phone number. One budget-minded option is a burner phone.

Your online bank account

Digital banking in the US is expected to grow from 197 million users in March 2021 to 217 million by 2025. But the convenience online banking affords—the ability to bank anywhere, anytime— comes at a cost: your privacy. Carrying your bank account with you on your phone means that you’re risking losing control of it in the event you lose your phone…or even lose track of an old phone that you no longer use they warn.

To manage the risk, you might consider avoiding doing your online banking on your phone. Instead, do it on a computer that never leaves your home. If you find that you simply must take your online banking with you wherever you go, just be sure to use a strong, unique password to unlock your banking app.

Your home address

Storing your home address in navigation app like Waze or Google Maps makes getting home from anywhere super-easy. But it can also leave you vulnerable. If a thief ends up with your phone, they can simply click on “home,” or “work,” and see what you’ve stored, and pay you a visit.

If you lose your mobile phone that are some steps you need to take according to Consumer Reports. As soon as you get your new mobile phone.

Use strong password protection on your mobile phone

Use strong password protectionThis is your first and strongest line of defense. You need a strong password, because one that’s easy to guess could unlock your phone and allow someone to override the biometric safeguards.

Skip the simple 4-digit PIN and instead create a strong password that contains a string of at least eight characters that include some combination of letters, numbers, and special characters that don’t form recognizable words or phrases, especially those that could be associated with you.

Password protection comes with another safeguard according to Consumer Reports. After several unsuccessful tries to enter a passcode, some phones will lock your device for a short period of time. This slows down attempts to access your phone. There’s also a setting on the latest Android phones that automatically erases all of your personal data after 10 unsuccessful log in attempts. Here’s how to activate it. Go to:

  • Settings | Lock Screen | Secure Lock Settings | and toggle the Auto Factory Reset option to switch it on. (The labels may vary slightly on other Android models.)

Enable location tracking

You must turn on the global positioning settings (GPS) in order to find a missing phone on a map. To enable this setting on an Android phone go to:

  • Settings | Security | Find My Device and toggle Find My Device.

Back up your photos and videos

Consider using a carrier-neutral service to back up your mobileConsider using a carrier-neutral service to back up your mobile. Apple’s iCloud or Android’s Google Drive may make it easier to retrieve your memories should your next phone be from a different carrier. Phone carriers, phone makers, and operating systems also offer free over-the-air backup for photos, settings, and more. These options can limit you if you select a new carrier for your next mobile phone.

Write down your phone’s unique ID number

Smartphones have a unique serial number known as an IMEI (International Mobile Equipment Identity) or MEID (Mobile Equipment Identifier). Unlike other information stored on the phone’s removable SIM card, these numbers are etched into its circuits and are difficult to alter. Your carrier already has this number and can use it to put the phone on a missing phone list. Some police departments ask for either of these numbers when you report a stolen phone. With the numbers they’ll be able to return a phone to you if it’s recovered. To find your phone’s unique IMEI or MEID number, use any of the following steps:

  • Dial *#06# from your phone. The number may pop up on your screen.
  • On an Android phone go to: Settings | About Phone. The number should be on that screen.

After the phone is gone, the sooner you act, the better your chances of retrieving your phone and securing your data. Here are key actions to take according to CR.

Seek and (possibly) destroy your mobile phone

erase the data on yourphoneIt is important that the minute you learn your phone is missing, you send it commands you think are appropriate. Time is of the essence because these next steps requires your phone to be on and have some battery life left.

As soon as possible, call or text your phone from another device. That might be all it takes if your phone is just misplaced nearby.

Then log on to your Find My Phone service from a secure device. For an Android phone, go to Google’s Find My Device in a browser. Use the service to make your phone play a sound. You can also lock the screen and display a message for someone who finds your phone. An honest person may come across your device and notify you via the contact info on the screen. If you think the bad guys have your phone, you can erase the data on it using Find My Device.

Report the Loss to Your Service Provider

Inform your mobile carrier that your phone has been lost or stolen. It can suspend service to prevent anyone from using the device on its network. They may also mark the phone as unusable even on a new carrier or with a different SIM card. Note that your device will still be usable over WiFi. You can notify your provider by going to one of its stores, calling, or logging on to its website.

  • AT&T: Call 800-331-0500 or go to AT&T’s Suspend page.
  • T-Mobile: Call 800-937-8997 or go to My T-Mobile, and in the My Line section click on your device name to find the Report Lost or Stolen option.
  • Verizon: Call 800-922-0204 or go to the Suspend or Reconnect Service page in My Verizon and follow the prompts.

Change Your Important Passwords

Once you realize your phone is in danger, go to a secure PC,  log in to every account you had on your phone (banking, shopping, email, etc.) and change your passwords. Start with your email account. Then change the financial and shopping accounts that have your credit card on file, such as Amazon or your bank. Next move on to social networks. If you’ve set up a password manager, this task will be easy.

Report the Loss to the Police and File an Insurance Claim

Notify the police. This not only launches an official recovery attempt but also helps speed up the process of making an insurance claim (if your covered). You might also need a police report to dispute fraudulent credit card charges, and some credit card issuers will reimburse you for a stolen phone.

Wipe your mobile phone anyway

malicious app or spywareIf you recover your phone You never know what malicious app or spyware someone may have installed while the phone was out of your hands. To be on the safe side, reset the phone to factory settings. If you see an option to erase everything, make sure you select it. Before you nuke the phone, check your backups to make sure that you have copies of all the photos and videos that were on your phone.  On an Android phone, go to:

  • Settings | System | Advanced | Reset Options | Erase All Data (factory reset).

 

How you can help Ukraine!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

 

Most Memorable Super Bowl Tech Ads

Most Memorable Super Bowl Tech AdsIt Super Bowl time again. Many people look forward to the big game ads that are created specifically for the semi-offical national holiday. Companies spend a LOT of money to advertise during the big game. Statista found that since 2010, the average rate for a 30-second spot during the Super Bowl broadcast has risen from $2.77 million to $6.50 million, making it by far the most expensive time slot U.S. television has to offer.

30-second spot during the Super Bowl broadcast costs $6.50 million,The payback is huge. According to Statista, viewers tend to pay special attention to Super Bowl ads, as agencies typically try to honor the big game with especially witty and funny ads. In recent years, the dawn of YouTube has added another bonus for Super Bowl advertisers seeing that the most popular ads often reach millions of additional viewers on the platform.

Here are my most memorable Super Bowl tech ads in chronological order.

Xerox “Monks” (1976)

In this Xerox spot for Super Bowl X, Brother Dominic has a problem. The head of his order wants 500 copies of a handwritten manuscript. So he does what any smart monk would do — he turns to Xerox (XRX). The miraculous Xerox 9200 duplicating system saves the day. The Xerox 9200 duplicating system feeds and cycles the originals, duplicates, reduces, collates and more, all at “an incredible 2 pages per second.” Hallelujah!

Apple “1984” (1984)

The iconic 1984 Apple (AAPL) Macintosh commercial aired on television only once – during the 3rd quarter of Super Bowl XIX. Based on George Orwell’s novel, Nineteen Eighty-Four the spot told the world the new Apple Macintosh computer would free individuals from the overbearing control of “Big Brother” – presumably, IBM’s Personal computer.

Iomega “Bermuda Triangle” (1998)

This Super Bowl XXXIII spot from Iomega shows the interior of an airplane flying through the Bermuda Triangle, with multiple objects (and people) rapidly disappearing around the spokesperson. Ironically, Iomega Zip drives were often subject to a phenomenon known as the “click of death” — a sound marking the drive’s failure and complete data loss.

Monster “When I Grow Up” (1999)

Monster.com‘s excellent ad for 1999’s Super Bowl XXXIV captured the malaise of Y2k. The ad featured children explaining what they would be when they grew up, including “I want to climb my way up to middle management.” The end of the ad displays the message “What did you want to be?” The message was simple and effective debut – Monster.com helps you get a new job. Sounds like a precursor of 2022’s Great Resignation.”

E*Trade “Monkey” (2000)

This 2000 Super Bowl XXXIV ad from E*Trade was originally written to lampoon the expense of advertising on the big game. It turns out to foreshadow the dot-bomb. On the ad, chimp dances as two men clapped for 30 seconds. The add closes with, “Well, we just wasted 2 million dollars. What are you doing with your money?”

Spooky from a stock market player.

Hulu “Alec in Huluwood” (2009)

In this Super Bowl XLIII ad Alec Baldwin introduced Hulu to the general public. The ad claims that the streaming service was actually an evil alien plot to destroy the world.

Where we would be be in 2022 without video streaming to binge watch our way thru COVID lock downs?

Best Buy “Ozzy Osbourne vs Justin Bieber” (2011)

Back before the Biebs was or was not pulling burrito pranks, he tried to take on the “Prince of Darkness.” In this Super Bowl XLV ad for Best Buy (BBY) from 2011, the Biebs and Ozzy Osbourne try to figure how many Gs there are in 5G.

And hey 11 years later 5G is still in limited use.

TurboTax “Never a Sellout” (2016)

When you’re as big a star as Sir Anthony Hopkins, you don’t ever need to sell anything. Especially if was free. This subtle TurboTax Super Bowl L ad was a hit in 2016.

Dashlane “Password Paradise” (2020)

The password manager went big time in 2020 with a Super Bowl LIV ad. As followers of the Bach Seat know passwords suck and Dashline made it clear how important it is to know your passwords.

rb-

That was my most memorable Super Bowl tech ads in chronological order. Did I miss any memorable Super Bowl tech ads?

Stay safe out there!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

GoDaddy WordPress Sites Hacked?

GoDaddy WordPress Sites Hacked?GoDaddy (GDDY), the world’s largest domain name registrar, disclosed that it had been hacked. According to reports on Monday (11/22/2021), an unknown attacker gained unauthorized access to the system used to provision the company’s Managed WordPress sites. This breach impacts up to 1.2 million GoDaddy WordPress customers. This number does not include the number of customers of websites affected by this breach.

GoDaddy logoThe company posted, We are sincerely sorry for this incident and the concern it causes for our customers,” “We, GoDaddy leadership and employees, take our responsibility to protect our customers’ data very seriously and never want to let them down.

GoDaddy resellers also compromised

On Tuesday (11/23/2021), GoDaddy confirmed that some of their resellers were also compromised in the attack. If you purchased your WordPress domains from

Assume your WordPress site has been compromised.

According to the SEC report filed by the Scottsdale, AZ-based firm, the attacker gained access via a compromised password on September 6, 2021. The attacker was discovered on November 17, 2021, when the attacker’s access was revoked. The attacker had more than two months to establish persistence, so anyone currently using GoDaddy’s Managed WordPress product should assume compromise until they can confirm that is not the case.

What happened at GoDaddy?

credentials in cleartextSeveral sites are reporting that GoDaddy stored sFTP (Secure FTP) credentials so that the plaintext versions of the passwords could be retrieved, rather than storing salted hashes of these passwords or providing public key authentication, which is industry best practice. This decision allowed an attacker direct access to password credentials without cracking them. According to their SEC filing: “For active customers, sFTP and database usernames and passwords were exposed.”

What did the attacker have access to?

The SEC filing indicates that the attacker had access to:

  • User email addresses,
  • Customer numbers,
  • Original WordPress Admin password that was set at the time of provisioning,
  • SSL private key and
  • sFTP and database usernames and passwords.

What could an attacker do with this info?

The attackers had unrestricted access to these systems for over two months. During that time, they could have:

  • Secure FTPThey have taken over these sites by uploading malware or adding a malicious administrative user. This allows them to maintain persistence and retain control of the sites even after the passwords are changed.
  • The attacker would have had access to sensitive information, including website customer PII (personally identifiable information) stored on the impacted sites’ databases.
  • Sometimes, an attacker could set up a man-in-the-middle (MITM) attack that intercepts encrypted traffic between a site visitor and an affected site.
  • The exposed email addresses and customer numbers cause increased phishing risks.

How to resecure your GoDaddy host WordPress site

GoDaddy should be notifying impacted customers. In the meantime, experts recommend that all Managed WordPress users assume that they have been breached and perform the following actions:

  1. If you run an e-commerce site or store PII (personally identifiable information) and GoDaddy verifies that you have been breached, you may be required to notify your customers of the breach.
  2. Change passwordsChange all of your WordPress passwords.
  3. Force a password reset for your WordPress users or customers.
  4. Change any reused passwords and advise your users or customers to do so. 
  5. Enable 2-factor authentication wherever possible. 
  6. Check your site for unauthorized administrator accounts.
  7. Scan your site for malware using a security scanner.
  8. Check your site’s filesystem, including wp-content/plugins and wp-content/mu-plugins, for any unexpected plugins or plugins that do not appear in the plugins menu.
  9. Be on the lookout for suspicious emails.

rb-

These GoDaddy data breaches are likely to have far-reaching consequences. GoDaddy’s Managed WordPress offering makes up a significant portion of the WordPress ecosystem, affecting site owners and their customers. The SEC filing says that “up to 1.2 million active and inactive Managed WordPress customers” were affected. Customers of those sites are most likely also affected, which makes the number of affected people much larger.


Stay safe out there!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Password Bracketology

Password BracketologyThe University of Michigan Basketball Wolverines, the Hockey team, and the Debate team all have made it into the NCAA Final Four. Along the way, the Wolverines busted a few brackets. In keeping with the March bracket madness, Keeper Security ran an analysis they’ve called “Password Madness”. In Password Madness, they developed their own bracketology of bad passwords. During Password Madness, the publisher of password manager software ran an analysis on 1.4 billion clear-text passwords 4iQ found on the dark web for sports team mascots used as passwords.

University of MichiganFollowers of Bach Seat already know that passwords suck and there is a long list of passwords like “password” and “123456” that should be banned from use. According to a statement from Keeper Security, of all the passwords looked at, those containing “Tiger” and its variations (such as “T1ger”, “T1g3r”, etc.) appeared 187 percent more often than passwords containing variations of “Eagle,” the second-most common password set found, and nearly 850 percent more than the least common password, which was “Bluejay” and its variations.

The not so élite eight passwords on their list are:

  • PasswordCowboy
  • Eagle
  • Hurricane
  • Irish
  • Pirate
  • Spartan
  • Tiger
  • Trojan

This is bad, as I have pointed out, many people re-use the same password on nearly every online account. This behavior opens up hundreds of thousands of credentials to speedy hacking. Keeper Security recommends rather than using their favorite sports team as a password hoops fans, instead concentrate on using unique, high-strength, passwords for each login. Strong passwords contain at least eight random characters of upper and lower-case letters, numbers, and symbols.

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.