LinkedIn and QuickTime Vulnerable
Feeling vulnerable today?
You will after reading this blog post recently shared during a radio interview on The Union Edge: Labor’s Talk Radio show.
LinkedIn Breach Announced
LinkedIn recently announced that they had been made aware of a data hack that happened back in 2012. Stolen information included email addresses, passwords, and member ID numbers. LinkedIn became aware that the stolen account information was being sold online. So LinkedIn emailed all of their members.
What does this mean to me?
Big deal, it was 2012. BUT some people use the same passwords for most of their online accounts AND never change their passwords from year to year… so if you were using the same password that you had on your LinkedIn account elsewhere then you may have more to do than just updating your LinkedIn password.
What to Do
- Don’t use the same password across online accounts.
- Update your passwords on account at least once every 6 months.
I know keeping track of different passwords is difficult and updating it at intervals is even more work. Make your life easy and get yourself a password keeper such as LastPass or KeePass.
Better delete QuickTime!
The Department of Homeland Security issued an alert after Apple announced they will no longer be providing security updates for the QuickTime video player.
“Cyber security experts at the Zero Day Initiative and Trend Micro said they had identified two vulnerabilities in QuickTime for Windows, that could allow hackers to take control of affected computers. The bugs would allow hackers to attack PCs if users visit a compromised web page or open a tainted file.” via DailyMail.com.
QuickTime for Mac OSX is still being supported and updated, so Mac users need not remove QuickTime from their computers. But Windows users should definitely remove the product from their PCs as there are no security updates to fix the current and future security vulnerabilities of the program. The only way to protect against an attack via QuickTime is to remove QuickTime completely from your PC.
How Un-Install QuickTime
You have a couple of ways to properly remove QuickTime from your PC.
Control Panel
1. Go to your computer’s control panel
2. Choose Programs and Features
3. Scroll to QuickTime, click on it once
4. Choose “Uninstall” from the toolbar and follow prompts.
Start Button
1. Click on your Windows Start Button
2. Choose All Programs
3. Locate the QuickTime folder and click on it once
4. Choose Uninstall and follow prompts.
Left out in the cold
Many applications on Windows computers and websites require Quicktime, so now what? It’s time to seek an alternative such as VLC Media Player or XBMC. Both are free alternatives, there are others out there that work too.
Bring back the warm fuzzy
So after installing a Password storage program and a new alternative to QuickTime today, go for the extra credit and run a virus and malware scan on your computer and make a backup. You’ll thank us later or maybe send us a gift card for a coffee.
Visit our blog at AppletreeMediaWorks.com for more information.
More than a Billion Passwords Stolen by Russian Gang
Ready to change your passwords again?
If you didn’t bother changing your password when you heard about “Heartbleed” leaking out passwords, you might want to consider changing your online passwords today. In the largest known collection of stolen internet credentials, a Russian tech gang has reportedly acquired an estimated 1.2 billion username and password combinations, along with over 500 email addresses.
A security firm based out of Milwaukee, Wisconsin conducted an 18 month study of the security breach. It has not announced specific sites that were hit, citing non-disclosure agreements and concerns for websites that still may still be vulnerable. An independent security expert confirmed the claims as authentic.
The hackers used unsuspecting zombie computers with viruses to allow a single operator to control a large group of virus infected computers to test for SQL vulnerabilities on servers.
When vulnerability was discovered on a website or server, hackers then executed SQL injections to send malicious commands to the website. In this way they were able to collect databases full of user names and passwords. Small and large websites have been affected worldwide by this hack.
So far, the stolen data has only been sold in small quantities on the black market, and used to access social media to send out spam messages. Hold Security had originally offered to check security breaches for a fee of $120 but seem to be revising their efforts after some criticism.
So what’s a person to do when it seems like keeping data secret is a losing battle?
- Change your passwords, and make sure they are strong, secure passwords with capital letters, lower case letters, numbers, and special characters.
- Businesses should run a check with the webmaster to see if their websites are vulnerable to SQL attack.
- Don’t use the same username/password combination for all the sites you access, particularly important ones like banking.
- Don’t panic, and have a plan in place in case you are a victim of data theft.
For more information on keeping your data secure, visit our blog posts on Heartbleed, and Preventing your Email from Getting Hacked. Or you can contact us here at Appletree MediaWorks for more information.
How Do You Prevent Your Email From Getting Hacked?
Duplicating Usernames and Passwords is Risky
Database vulnerability
The truth is many online databases do not encrypt your username and password at all. So one dishonest employee can have thousands of passwords in one quick database export. If one online shop gets compromised, then all of the places you use that username and password are now vulnerable. Use a different password for every website login you create and use a specialized program to store those big beautiful passwords.
Brute force attacks
Many attacks are brute force attacks in which a computer program is used to try lots of combinations of passwords rapidly. The simpler your password, the easy to ‘guess’ by the program. Again, if your password is figured out and you use the same on multiple websites, your risk is increased exponentially. Use different passwords to prevent getting your email hacked.
- Use different login credentials and complex passwords on every website you use. We featured an article on our blog featuring more information and tips about passwords.
- Just say no to browsers storing passwords! When Internet Explorer or Mozilla asks to store a password for you, ALWAYS say NO.
- To remember all your new passwords, use a service like 1Password or KeePass to create and store login information. KeePass is free!
Keep Your Software Updated
Out of date software is risky, especially web browsers and other web-based programs including browser plugins. Usually updates are released for software in response to a security hole or technology expansion. Many programs update automatically, but set your phone or calendar to remind you to check on these things every few weeks.
- Keep Windows and your antivirus software up to date.
- Run updates for your programs when they ask. If a program is asking to access your computer that you don’t recognize, choose No for now and check out Google to see what is suggested for that update name.
Pay Attention to Login Sessions
Some sites will tell you the last time you logged in successfully. Change your passwords if things seem fishy. Some programs such as Facebook and Gmail monitor your logins, other programs will let you setup verification by text messages.
- Use verification by text message, if a program asks if you’re using a public computer to login, say yes if you are.
- Do not create obvious security questions in which people can find the answers by searching Facebook or other sites.
Think Before You Click
If you receive an ambiguous or unexpected email, even from a relative or close friend telling you to click a link. Don’t do it. Contact the person over the phone and ask what the email message. Same goes for attachments. If the email does not look like something your contact would send you, QUESTION it!! Email spoofing is common too, for example there have been very real looking emails floating around that appear to be from the IRS, but the attachment is a virus.
- Ignore and delete strange emails even if they’re from friends, family, and banks. Don’t click the link or open the attachment – it’s a surefire way to get a virus.
- If you find out your account has been hacked and an email was sent from your account, first change your password. 2nd follow up with those that received your hacked email message. Tell them your email was hacked and that they should DELETE the email they received from you.
Watch Where You Login From
Be careful if you are logging in from a public computer or a network that is not secure. Do not stay logged in, when you are done with the website be sure to log out. Connecting to public WiFi can open the door to hackers.
- Be sure your computer has a strong firewall. The annoying extra click to allow something to access or update your computer is better than a hacking mess from keeping the door open.
How do you prevent your email from getting hacked? As identity theft and account hacking becomes more rampant, there is no foolproof way, but you can minimize risks by using our suggestions. It is best to set up your accounts so that if one gets compromised not all of them do. Have a plan set up on what to do if an email gets hacked or a credit card gets stolen, and know that it is extremely common, if problematic.
If You Do Get Hacked
- Change your password if you can still get in to your account.
- Follow the directions in the help center of the website you’re trying – most sites have guides on what to do.
- Scan your computer for viruses and malware, then schedule future scans to happen weekly.
- Let people know you got hacked and not to click on links, and pass along info on what to do if they did.
- Report the incident to the website. You may get access to identity protection services through the hacked site.
Extra Credit
Protecting your credit card information online goes hand in hand with your email getting hacked. We suggest using a payment service such as Paypal to store your credit card number rather than typing your credit card number directly into a website. Websites and stores are not supposed to store credit card numbers in their databases….but there are no internet police enforcing this.
Follow Appletree MediaWorks on Facebook or subscribe to our website blog RSS feed to keep up on topics like this.