{"id":252,"date":"2016-09-19T07:35:21","date_gmt":"2016-09-19T07:35:21","guid":{"rendered":"http:\/\/konukoii.com\/blog\/?p=252"},"modified":"2016-09-19T07:48:08","modified_gmt":"2016-09-19T07:48:08","slug":"11-oddly-specific-yet-useful-security-tips","status":"publish","type":"post","link":"https:\/\/konukoii.com\/blog\/2016\/09\/19\/11-oddly-specific-yet-useful-security-tips\/","title":{"rendered":"11 oddly specific (yet useful) security tips"},"content":{"rendered":"Reading Time: <\/span> 8<\/span> minutes<\/span><\/span>

The idea for this post sparked from a recent conversation I had where a non-computer savy friend of mine asked me, \"What can I\u00a0do to be more secure from hackers?\" After giving him a few general purpose tips, such as use a VPN or have an AV installed, he said \"Ok, but I want to know more about the wierd and oddly specific attacks someone could do against me.\"\u00a0So after a while of talking here are some of the oddly specific, yet actually useful tips that could come in handy when trying to be more technologically secure.<\/p>\n

1.\u00a0Get rid of your RFID-enable credit cards<\/strong><\/span><\/h4>\n

\"Source:<\/p>\n

If you are one of the lucky people that have been given an RFID-enabled credit card, you should highly consider giving that back (or if you are feeling adventurus you could puncture a the RFID chip<\/a>) \u00a0. First of all, it's completely unnecessary since swiping a card doesn't take THAT much more time to do. Second of all, they are easily clonable. With roughly $200-$300 worth of equipment you could easily sniff and clone<\/a> one of these cards. If you want to know a bit more in detail about RFID technology feel free to check out my previous post about it.<\/a><\/p>\n

<\/h4>\n

2. Turn WPS off<\/span><\/strong>\"wfa_wps_mark_vert\"<\/h4>\n

For some bizarre reason, routers today come with something called WPS enabled by default. This is something meant to make connecting to them easier, but the truth is that I have yet to meet someone who has ever used WPS to connect to their router. The funny part is that having this enabled makes it substantially easier for a hacker to break into your Wi-Fi<\/a>. Turning WPS will vary slightly depending on your router, but the overall process consists in:<\/p>\n

    \n
  1. Go to your routers address (usually 192.168.0.1 or\u00a0192.168.1.1)<\/li>\n
  2. Log in with your credentials.<\/li>\n
  3. Somewhere in there (usually Wireless tab) will have an option to turn WPS on\/off<\/li>\n<\/ol>\n

    Note: If in step 2 you used the routers default credentials<\/a>,\u00a0you should definitely change those too.<\/p>\n

    3. Avoid \"Master\" branded locks<\/strong><\/span>\"mlcom_product_105\"<\/h4>\n

    If you have something physical that you want to keep safe, you should probably not use Master<\/a>\u00a0locks. At DEFCON, when I asked the lockpick experts of TOOOLS<\/a> to teach me how to lockpick, the first thing they told me was to practice with Master<\/a>\u00a0branded locks, because they suck<\/em>. Turns out that without any previous lock picking knowledge, it took about 30 minutes to crack it open. After I got the hang of it, they would pop open in at most 3-5 minutes. So if you really want to keep something secure try shelling out a couple of dollars more for a\u00a0better\u00a0lock<\/a>.<\/p>\n

    4.\u00a0Check if you've been pwned<\/strong><\/span><\/h4>\n

    Now-a-days, even if you are super safe and use super awesome passwords with uppercase letters, numbers, symbols, haikus and one aromatic fragrance, some company will most likely slip up and your password will be revealed. It's just a fact of life; someone somewhere will hack some database and sell your carefully chosen password to some sketchy hackers somewhere. The best way to deal with this is to check if your credentials have been compromised with\u00a0haveibeenpwned.com<\/a>. You can check if your credentials have been leaked, and you can even subscribe to them so that they keep an eye out and notify you in the future.<\/p>\n

    5. Set Automatic Updates<\/strong><\/span><\/h4>\n

    Sorry if this is an obvious one, but let's be honest, we've all done that thing where we tell Windows, OSX, Android, iOS, or whatever OS you have, to stop bugging us and don't update. We'll turns out that's a terrible idea. You should most definitely, keep your things updated. Here's why: Unless you are a very high profile person, the hackers that are attacking you are probably not that dedicated, they will most likely piggyback off published scripts and known vulnerabilities. They can do this by just looking through exploit databases such Rapid7's DB<\/a>. However, if you have everything patched and updated, you'll make their work a bit harder, thus they might just get bored and move on to someone else. For example, it is well known that old versions of adobe acrobat have vulnerabilities where one can craft a malicious pdf that will inject code into your computer. If you have your adobe acrobat updated to the latest version, you have to worry about one less thing!<\/p>\n

    6. Update Firmware on Logitech mouse\/keyboards<\/strong><\/span><\/h4>\n

    Following a bit behind #5. If you have any Logitech wireless mouse\/keyboards you should most definitely update their firmware. Recently, a vulnerability called Mousejack<\/a> was discovered where people can inject keystrokes or eavesdrop what you are typing. I recently bought a couple of used keyboards\/mice and have been playing around with it and was surprised at how easy it was to hack it. If you are using the latest Windows 10, you shouldn't encounter any problem, however OSX and Linux are (surprisingly) still vulnerable, so your best bet is to update your keyboard\/mice firmware<\/a>. I'll probably post more hacky details about this later \ud83d\ude42<\/p>\n

    7.\u00a0Trash Emails<\/strong><\/span><\/h4>\n

    A lot of people have trash emails to subscribe to shady websites, however I found these types of emails particularly useful when you want to use computers other than your own. There was a small cyber-cafe at my previous apartment housing which contained some of the most ill secured computers I have ever seen. Since I could print freely in there I realized I needed a one way trash email, one that I could send my schoolwork to print and wouldn't mind getting hacked. If you do it with gmail.com, you might even want to set up a google drive folder with read-only privileges for it.<\/p>\n

    Optionally, if all you really want is a trash email for sketchy subscriptions you should probably be using 10minmail.com<\/a>. This is literally a mail service where you are given an email address that will only live for 10 minutes.<\/p>\n

    8.\u00a0Avoid Phishing<\/strong><\/span><\/h4>\n

    Phishing comes in all shapes and sizes. Phishing is a type of attack were a malicious attacker will send you an email that seems to be coming from a legitimate source requesting some type of personal information (or contains infected links or files). There are a couple of ways to spot these emails:<\/p>\n

      \n
    1. Hover over links before clicking.<\/strong> You always want to make sure that the link is actually going where it is supposed to go to. For example: They could try a switch and bait such as\u00a0www.google.com<\/a>\u00a0or if you see a link like facebook.konukoii.com<\/a>\u00a0you should now that you are actually connecting to konukoii.com as opposed to facebook.com (You might think this is obvious, but it's easy to miss if it is something like facebook.mailservice.com or some other unsuspicious domain name).<\/li>\n
    2. Check who really sent the email.<\/strong> A fantastic way to determine the legitimacy of an email is to check who sent it. Some modern mail servers such as gmail allow you to see the exact email from who sent it (example below). While other's like Outlook don't do this by default, instead you have to select your email and click on the option to view source.<\/li>\n
    3. Check the source if you are really suspicious.\u00a0<\/strong>Usually by following the previous points you will have a good idea of whether or not an email is legitimate, but if you want to go into more detail, there is usually an option in email clients to \"Check the Source\" or \"View original\". This will give you all the information including the mailservers sent from.<\/li>\n<\/ol>\n

      9.\u00a0Lock your BIOS or Keylog your own machine<\/strong><\/span>\"BIOS\"<\/h4>\n

      This point is particularly aimed at paranoid users who are concerned over someone getting physical access to your computer. When your computer boots up, there is a small component called the BIOS which is in charge of telling the computer where to boot from (aside from many other things). If someone wanted to be really sneaky they could turn your computer on and run linux from their pendrive, then access your harddrive and perhaps steal some of your files. The only true way to stop this attack would be to go into your BIOS (usually by pressing F1 before Windows boots) and then eliminating the option of booting from USB. Furthermore to avoid someone changing these settings you have to password protect your BIOS. This will change depending on your computer, so it's best to search online how to access your BIOS; Once there, the rest should be pretty self explanatory.<\/p>\n

      You might say, \"Hey! but I still don't feel protected\". Well, a nifty solution could be to keylog your own computer, such that you could know if someone is messing with it and see exactly what they are doing. Check out the \"Capture the Keys<\/a>\" posts I have if you are interested in building your own keylogger.<\/p>\n

      10. Really format your hard-drives<\/strong><\/span><\/h4>\n

      \"Source:<\/p>\n

      When you are getting rid of an old computer, or throwing away a hard drive, it might be in your best interest to \"really\" format your HD.\u00a0Most file systems work by having an index that points to all your files, so when you format a HD, it simply erases that index, while leaving the actual information in the disk. I was suprised to discover that data recovery from a \"formatted\" HD is extremely easy. However, you can really format a HD by using program such as\u00a0DBAN<\/a>. Alternatively, if you are throwing away the hard drive, you can smash the plates inside.<\/p>\n

      11. Don't use random pendrives (You don't know where they've been).<\/strong><\/span><\/h4>\n

      In real life, another attack vector consists in leaving behind \"lost\" pendrives or CDs in the hopes that someone will plug them into their computers. Once connected, they hope that you open an infected file. Or if you are one of the few people that have autorun set up then you probably are screwed as soon as you plug that pendrive in. A good Antivirus and a properly patched system should be enough to protect the average Joe, however if you want to be extra safe, don't go plugging in any random pendrive in your PC.<\/p>\n

      Also, as a bonus comment, there is a special kind of pendrive called a USB Kill<\/a>\u00a0that will permanently damage your computer as soon as you plug it in<\/strong>.<\/p>\n

      Bonus: The typical tips<\/strong><\/span><\/h4>\n

      You should know, or at least heard, of these by now:<\/p>\n

        \n
      1. Use an AntiVirus<\/del>:<\/strong> This shouldn't be a tip, since you are smart enough to know you need an antivirus, regardless of operating system. At the very least they are useful to hold back script kiddies. When in doubt about a particular file, use VirusTotal<\/a>.<\/li>\n
      2. Use a VPN:<\/strong> This protects you from unwanted sniffer looking at your internet traffic while you are connected to a public Wi-Fi. The best one I've found so far is Private Internet Access<\/a><\/li>\n
      3. Use a cloud service to store important files:<\/strong> That way if you get hit by ransomeware or some other nasty virus, you can erase everything and start over without loosing any important files. The service you use depends on what you need it for, but as always there is a bunch of options: Dropbox, Amazon Cloud Store, Google Drive, etc.<\/li>\n
      4. Encrypt your important files:\u00a0<\/strong>You can use many different tools to keep your important files secure.\u00a0You should really be doing this for important banking, financial, etc. documents. Lifehack did a good post<\/a> on some tools for this.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

        The idea for this post sparked from a recent conversation I had where a non-computer…<\/p>\n

        Read the post11 oddly specific (yet useful) security tips<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":267,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,32],"tags":[63,60,59,62,51,64,58,61],"class_list":["post-252","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compsec","category-tutorials","tag-bios","tag-lockpicking","tag-mousejack","tag-phishing","tag-rfid","tag-security","tag-tips","tag-wps","excerpt","zoom","full-without-featured","even","excerpt-0"],"_links":{"self":[{"href":"https:\/\/konukoii.com\/blog\/wp-json\/wp\/v2\/posts\/252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/konukoii.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/konukoii.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/konukoii.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/konukoii.com\/blog\/wp-json\/wp\/v2\/comments?post=252"}],"version-history":[{"count":11,"href":"https:\/\/konukoii.com\/blog\/wp-json\/wp\/v2\/posts\/252\/revisions"}],"predecessor-version":[{"id":271,"href":"https:\/\/konukoii.com\/blog\/wp-json\/wp\/v2\/posts\/252\/revisions\/271"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/konukoii.com\/blog\/wp-json\/wp\/v2\/media\/267"}],"wp:attachment":[{"href":"https:\/\/konukoii.com\/blog\/wp-json\/wp\/v2\/media?parent=252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/konukoii.com\/blog\/wp-json\/wp\/v2\/categories?post=252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/konukoii.com\/blog\/wp-json\/wp\/v2\/tags?post=252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}