Your Email Password is a Target

Interested in hacking into the Email account of Charlie Sheen, Rob Lowe, Sean Penn or Carson Daly?  You’ll want to know they attended Santa Monica High School. Want access to the CEO of a large retail corporation?  Keep reading.

 
Simple question used by Yahoo to verify your identity.
Truth is we’re all screwed but having good password habits will keep out the amateurs. It may save you from emailing people on your contact list to say, “I’ve been hacked, if you received email from me don’t click on the link.”
My security expert friends will advise you to use…

1) Strong Passwords
2) Unique passwords for each of your password protected websites
3) Two-step verification

Important Advice to Share From BillP
My most important tip to family and friends is “Use fake information when asked for answers to security questions.”

Example of making up your own unique answers to security questions.

I had plenty of time this summer to research malware and identify the first step in the infection process.  The most common way to get hacked is someone using the small amount of public information needed too reset your email password. Once they have one of your email addresses it’s not hard to receive a new password on other services.

I recommend creating easy to remember jokes to use when asked for answers to security questions.  Some examples may be “What high school did you attend?” Pick something like Jefferson High School (Happy Days) or Rydell High(Grease). I won’t tell you what it is but people often laugh out loud when they see what I use for my mothers maiden name. Yes, some company’s still use it.

Target’s Easy Target

Using real data is dangerous. In less than 15 minutes I was able to find information about “former” Target CEO Gregg Steinhafel. His mother’s maiden name was Schreindl. He graduated from Homestead High School.
His first job was at Steinhafel's Furniture and he attends Wayzata Community Church. Born in Milwaukee, Steinhafel graduated from Carroll University in 1977 and earned an MBA from Northwestern University two years later. I could say more but for the safety of his wife and three children I’ll stop here.

If Target had requested a BlueHat Hacker Report, they would have been warned.

When a high school kid gained access to Sarah Palin’s email he wasn’t a computer genius. He just looked up the answers to the security questions used by Yahoo. Even though that was way back in 2008 this method has continued to grow as the number one way to steal personal data.

I’ve also noticed a set of quizzes common on Facebook specifically designed to collect personal data used in security questions.  I am currently investigating the background of the companies who spread these quizzes. Most created their domain within the last 30 days. I will share any information in the future.

Some Security Advice May Be Outdated
Complicated passwords:
Some may recommend a complicated password like “hfY4df$dhEW_!cvrh3H7D&d.” It’s safer than 123456 but isn’t very easy to remember. A complicated password may be useful to beat programs which try every possible combination but most systems will lock you out after a handful of incorrect attempts.

Unique passwords:
Using different passwords on different services is good advice but unless you’re using a program that remembers your passwords it’s too easy to forget unique passwords. If you’re like me you’ll just end up resetting your password using security questions.

Two-Step Verification

The two step verification process is a step in the right direction For banking or any service where real harm could be done it’s worth the extra step. If someone gains access to your cell phone or one of your email accounts the benefit is lost. Unfortunately, you’re trusting that the company is not going to take advantage of having more of your personal data like your cell phone number or alternate email address.

Some Advice Will Never Change

As far as recent failures by Home Depot, Lowes and other large companies the advice hasn’t changed much in 20 years. When your bill comes, check all your charges and make sure they’re legitimate. Most likely you can access your credit card online and see charges as they come in. If you haven’t already, register an account connected to your credit card and review charges regularly.

Reviewing your bills doesn’t just apply to credit or bank cards. Keep an eye on any charges like your cable or phone bill. Legitimate companies have been known to add bogus charges. Verizon wireless added a monthly charge for ring tones on Cindi’s phone. They claimed she agreed to the monthly charge by not responding to a text message. They removed the charge when I explained her cell phone at the time didn’t support test messaging.

Congrats Microsoft Most Valuable Professionals

Today, Microsoft provided the award of MVP (Most Valuable Professional) to number of bright and outstanding individuals who devote their time to help others. I’ve always had a lot of respect for Microsoft MVP’s and today I’ve been given the honor to join them.

Microsoft notified me this morning that I’ve been selected as a Microsoft MVP.

The Microsoft MVP Award Program recognizes and thanks outstanding members of technical communities for their community participation and willingness to help others. The MVP Award is given to exceptional technical community leaders who foster the free and objective exchange of knowledge by actively sharing their real-world expertise with technology users. The MVP Award celebrates the most active community members from around the world who provide invaluable online and offline expertise that enriches the community experience and makes a difference in technical communities that feature Microsoft products.

While I had been approached by Microsoft to see if I was interested, the award was still a little bit of a surprise.  It’s no secret that I haven’t spent much time promoting Windows Vista and I have been slightly critical of the auto update process.  I’m impressed and humbled that the folks at Microsoft honored me with this title.  I promise to continue speaking out when I can offer some constructive criticism but I’m still thrilled to be included in a group of exceptional professions.

I would especially like to thank those MVP’s who nominated me and helped Microsoft think I was worthy. It’s been a decade since I worked out at the Redmond campus so I look forward to next years MVP Global Summit and meeting my fellow MVP’s.

 

What's "Inside Amazon" About You?

While I order a lot of products from Amazon I’ve forgotten how much they still specialize in books and the extra features available. Last night I decided to play with the Search Inside feature and just out of curiousity wondered if WinPatrol was mentioned in any computer books. I knew there were one or two but was pleasantly surprised at how many recommendations were published praising Scotty the Windows Watch Dog.

Some references include:

Lock the Boogie Man Out of Your Computer

Rule the Web: How to Do Anything and Everything on the Internet---Better, Faster, Easier

By far the most interesting mention was actually in a book created for Norton users. While I’m not a big fan of Norton Security Suites the company has had a few good innovations over the years.

Norton All-In-One Desk Reference For Dummies

So just go to Amazon books and type in any term you’d like to search for and they’ll give you a list of books that include your topic. I’m sure many of you have searched your name in Google but have you searched it in Amazon?

I found a few references to “Pytlovany” including an infamous comment about my days with AOL where I am quoted as saying “A lot of people learned to type with one hand”. (Stealing Time p30)