28.05.2023 Views

The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

In general, biometrics byy themselves are vulnerable to attacks. Ideallyy

biometrics should be used as just one authenticating factor. Swipe yyour

fingertip or smile for the camera, then enter a PIN or passcode. That should

keep yyour mobile device secure.

What if yyou created a strong password but didn’t write it down? Password

resets are a godsend when yyou absolutelyy can’t access an infrequentlyy used

account. But theyy can also be low-hanging fruit for would-be attackers.

Using the clues we leave in the form of social media profiles all over the

Internet, hackers can gain access to our e-mail—and other services—simplyy

byy resetting our passwords.

One attack that has been in the press involves obtaining the target’s last

four digits of his or her credit card number, and then using that as proof of

identityy when calling in to a service provider to change the authorized e-

mail address. That wayy, the attacker can reset the password on his or her

own without the legitimate owner knowing.

Back in 2008 a student at the Universityy of Tennessee, David Kernell,

decided to see whether he could access then vice presidential candidate

Sarah Palin’s personal Yahoo e-mail account. 12 Kernell could have guessed

various passwords, but access to the account might have been locked after a

few failed tries. Instead he used the password reset function, a process he

later described as “easyy.” 13

I’m sure we’ve all received strange e-mails from friends and associates

containing links to porn sites in foreign countries onlyy to learn later that our

friends’ e-mail accounts had been taken over. These e-mail takeovers often

occur because the passwords guarding the accounts are not strong. Either

someone learned the password—through a data breach—or the attacker

used the password reset function.

When first setting up an account such as an e-mail or even a bank

account, yyou mayy have been asked what are usuallyy labeled as securityy

questions. Tyypicallyy there are three of them. Often there are drop-down

menus listing suggested questions, so yyou can choose which ones yyou want

to answer. Usuallyy theyy are reallyy obvious.

Where were yyou born? Where did yyou go to high school? Or college?

And the old favorite, yyour mother’s maiden name, which apparentlyy has

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!