Guide to Cyberguard

Guide to Cyberguard For non-tech people

INTRODUCTION Welcome to CYBERGUARD YOURSELF world The Internet was not built for security! Let’s face it – the hackers attack approximately every 39 seconds. However, do not worry!

We will guide you to the safe side! In this Guide you will learn how easy it is to incorporate good online safety habits in your daily life.

The goal is to raise awareness of Cyber threats and educate young people on how to protect their data online.

“Guide to Cyberguard” is a part of “Cyberguard Yourself” Global Shapers Skopje Hub’s project, developed by Simona Josifovska, with the help of other ambitious shapers!

CONTENT CYBERGUARD YOURSELF FROM PHISHING ATTACKS SPOTTING PHISHING MESSAGES COULD BE EASY, EVEN THOUGH 94% OF MALWARE WAS DELIVERED VIA EMAIL. IN THIS GUIDE, YOU WILL LEARN WHAT IS PHISHING, HOW TO SPOT A SCAM MESSAGE, AND HOW TO APPLY THE KNOWLEDGE.

CYBERGUARD YOURSELF FROM MALVERTISING AND ADWARE ONE IN EVERY 100 AD IMPRESSIONS ONLINE HAVE MALICIOUS AND DISRUPTIVE INTENT. BUT, DO NOT WORRY. IN THIS GUIDE YOU WILL LEARN HOW TO AVOID CLICKING ON MALICIOUS ADS. YOU WILL GET BASIC INFORMATION ABOUT MALVERTISING AND ADWARE, AND YOU WILL GAIN KNOWLEDGE TO PROTECT YOURSELF FROM THEM.

CYBERGUARD YOUR CREDENTIALS THERE IS A COLLECTION OF BILLIONS OF CREDENTIALS GATHERED FROM DATA BREACHES AND LEAKED PASSWORD LISTS. IN THIS GUIDE YOU WILL LEARN HOW TO CHECK IF YOUR CREDENTIALS ARE STOLEN AND WHAT TO DO IF THEY ARE. YOU WILL LEARN HOW TO CREATE COMPLEX PASSWORDS IN SIMPLE WAY AND WILL GET KNOWLEGDE OF STORING PASSWORDS.

CYBERGUARD YOURSELF FROM PHISHING ATTACKS Story 1: My friend recently received this email from Netflix. The email requests information, claiming that his account is on hold because Netflix is having trouble. It asked him to click on a link to update his account.

What do you think, is there something odd with this email?

Let’s learn and find out

UPDATE ACCOUNT NOW

WHY PHISHING IS IMPORTANT? Almost every person received, at least once, a phishing message. Maybe some of you have ignored it, but I am sure that there are a lot of people that disclosed personal information, just because they were asked in a “legitimate� way.

Phishing attacks are ranked in the top 5 Cybersecurity Threats for 2020 These attacks get more sophisticated, so it is important to know how to spot convincing fake messages.

WHAT IS PHISHING? Phishing is used for stealing sensitive information from the people. Phishing is a type of social engineering attack used to steal information, such as usernames, passwords, credit card numbers, for malicious purposes.

Spear phishing is a form of phishing, but the message looks more real. Spear phishing is a unique form of phishing in which the message is made to look as if it came from someone you know and trust, as opposed to an informal third party.

HOW TO SPOT A PHISHING MESSAGE? 1.1 Check who is sending the message/email. Do you know the sender?

Always verify the email address to confirm the real sender. Sometimes, just because in the display name it says that the email is coming from an organization/person you know, doesn't mean that it truly is.

HOW TO SPOT A PHISHING MESSAGE? Check for spelling errors in the email address. Maybe your friend’s email address is

Microsoft: online.support@nricrosotf.com

friend@friendsforever.com, but you have received an email from firend@freindforevar.com.

I hope you noticed the difference, if not, read again and compare the addresses.

DHL: deilvertuday@deliver.today.com

Your Bank: Accounting.bank@yorubenk.biz

HOW TO SPOT A PHISHING MESSAGE? RECOMMENDATION ! If you receive a suspicious message on the social media platform (Facebook, Instagram) check the profile of the sender. Make an investigation, check recent activities, friends ‌., is the account real? ! However, take into consideration that maybe the sender’s account was hacked, so if something is weird contact that organization/person.

This Photo by Unknown Author is licensed under CC BY-SA-NC

HOW TO SPOT A PHISHING MESSAGE? 1.2 Read the message carefully. Is it something odd?

Your friends won’t ask you personal questions on an email! Usually, the legitimate organizations, or the people you are in contact with, will not ask for personal or sensitive information in an email.

Salutation in an email reveals important information. If someone is sending you an email and asking for personal info, will not use generic salutations, such as “Dear account holder”, “Hi friend”,….

HOW TO SPOT A PHISHING MESSAGE? Be careful with urgent messages! Usually, the hackers will give an email a sense of urgency, like “Your account has experienced suspicious activity, please click HERE to change your password, as soon as possible”.

Or “Update your account to get back to watching Netflix”.

HOW TO SPOT A PHISHING MESSAGE? RECOMMENDATION: ! Remember: If you are not sure if the warning in the message is real or fake, call the organization/person to confirm. Never use the contact details provided in the message – visit their official website. ! Remember: Nothing is Urgent. If it is, you will be contacted on another way for sure.

This Photo by Unknown Author is licensed under CC BY-ND

HOW TO SPOT A PHISHING MESSAGE? 1.3 Be aware of links and attachments Links in the messages could be very dangerous. Always think twice before you click on a link or download an attachment.

To check the site where the link directs you (see Figure on the right side), go with the mouse over the link, but do not click!!! In the lower-left corner of the screen, you will notice the address. Read it carefully and check for spelling errors.

HOW TO SPOT A PHISHING MESSAGE? If you are checking the email from your mobile, just cover the link and hold it several seconds.

Then you will get the link – copy URL and paste it into note/document writer to inspect the link.

HOW TO SPOT A PHISHING MESSAGE? Attachments could break your security. When it comes to attachments, the hacker can be very creative. Usually, they will contain malicious files, or a link to get you to log into a fake credentials-stealing website. Be careful with the attachments with extensions such as .exe, .scr, and .zip.

Think logically: Usually you do not receive unexpected attachments. Make a call and check if the organization/person sent you the attachment.

HOW TO SPOT A PHISHING MESSAGE? RECOMMENDATION ! Even if there are a lot of filters and scanners that will stop suspicious messages, hackers are constantly building new tools to bypass the protection, so be aware.

APPLY YOUR KNOWLEDGE Back to Story 1: Could you answer: What was odd in the email from Netflix?

The email address of the sender: the domain is account.netfliix.bid The message: It asks for payment details and greets you with: “Hi Customer” Cover the “UPDATE ACCOUNT NOW” and check if it prompts you to the Netflix site, or somewhere else, go on try (in this Guide we are not using malicious redirections).

UPDATE ACCOUNT NOW

CYBERGUARD YOURSELF FROM MALVERTISING AND ADWARE Story 2: My friend, while reading the morning news on a webpage, got an important alert from Adobe Flash. It said that he had to update the Adobe Flash to a newer version. He wasn’t expecting that, but anyway that was an urgent “security update”, so he decided to click OK.

What do you think, is it something odd with this message?

Let’s learn and find out

WHY ONLINE ADVERTISING IS IMPORTANT? Online advertisements are bombing us everywhere we click. The Internet has become the safest place to invest in advertising. Why? Because consumers spend a lot of time online, so it is like fishing in a lake full of fish.

Hackers are attracted to popular things on the Internet and they will try to exploit every vulnerability.

However, not every ad is malicious. Here, you will get basic training to protect yourself against displaying unwanted ads.

WHAT IS MALVERTISING? Malvertising (Malicious + advertising = malvertising) is the practice of using online advertisements to spread malware, even on “safe� websites. That is just a delivery method for malicious code. Hackers either inject malicious code into legitimate ads, or they create fake ads and distribute them through ad networks.

PROTECT YOURSELF AGAINST MALVERTISING Through malvertising, malware can be downloaded to your system just by looking at an infected website. In that case, you can protect yourself by disabling Adobe Flash Player on the browser level. Why? Adobe Flash Player is used for viewing multimedia contents, execute rich Internet applications, and streaming audio and video. Nowadays has been replaced with HTML5, but it is still in use.

PROTECT YOURSELF AGAINST MALVERTISING It is important to put a line between legitimate and malicious ads. If the proposal in the ad is too good to be

Travel to abi A b u Dh 100$ = s y a d 7 Total

true, it probably is fake, even if it seems that it is coming from a well-known brand. Good malvertising usually offers gift cards, special great offers, which can make people click, because they think they are getting a great deal. So, avoid clicking on beautiful, shiny ads with unbelievable offers.

Click HERE to reserve your place This Photo by Unknown Author is licensed under CC BY-NC-ND

PROTECT YOURSELF AGAINST MALVERTISING RECOMMENDATION ! If you are in doubt, before you enter your credit card number to buy the thing you saw on an ad, visit the official website of the advertiser, search for that particular offer, and if necessary, contact them.

BUY Ticket

WHAT IS ADWARE? Adware (Advertisement + software = adware) is a program installed on your device with the purpose to display unwanted ads and generate revenue for the creator. Initially, adware infections are not malicious, but are very annoying, and tend to display pop-up ads and redirects searches to ad sites. You won’t be aware that you have an Adware, because it sneaks on your device by downloading another program, usually freeware.

PROTECT YOURSELF AGAINST ADWARE RECOMMENDATION ! To guard yourself against downloading adware on your device, it is important to be cautious of any suspicious programs. Do not download applications from not reputable sources. Just google the application before you download it on your device. If you are downloading the app on your mobile, check the app ratings, and review the permissions that the app requests. For example, if you are downloading an app for music it should not request access to your contacts. That would be weird, right?

WHAT ARE COOKIES? Cookies are small pieces of information websites store on your computer. Why do you need them? - They keep you signed in, remember your site preferences and give you locally relevant content. Normally they do not compromise your security and have a certain life span defined by their creators, so they are expiring after a fixed time.

However, there are evil cookies. Most of them are used to track your activities online and display personalized ads.

GET RID OF COOKIES It is possible to get rid of cookies, but not with eating.

You can delete the cookies that may pose a threat, from your browser. To do so, go into the browser you are using (Chrome, Firefox, Safari, etc.) look for Settings and then look for the “Clear Browsing Data� option. Please note that each browser has a different menu bar and terminology.

Click HERE to see how to delete cookies from a different browser.

WHAT ARE CACHES? Similar to cookies in terms of keeping temporary storage on someone’s machine to improve user experience, caches are collections of data downloaded to help display a webpage. This usually happens when websites with large pictures or videos are opened and it takes time to load the website. The web browser stores the site contents: the images, the videos, etc., so that the next time you will open the same website, it will load faster.

This Photo by Unknown Author is licensed under CC BY-NC-ND

DELETE CACHES So why is deleting caches occasionally good?

Clearing cache in your applications will free up storage and might potentially improve the device’s / application’s performance.

Click HERE to see how to delete caches from a different browser.

APPLY YOUR KNOWLEDGE Back to Story 2: Could you answer what is odd with the update from Adobe Flash?

The urgency: Remember from the previous topic? Nothing is Urgent.

The message: The message is constructed in that way so the user would get scared and update the program as soon as possible. My friend should have visited the official website of Adobe to check if there is an update.

CYBERGUARD YOUR CREDENTIALS Story 3: My friend received an email from an unknown sender with his password on the subject. Even though he knew that emails received in the Spam box are dangerous, he got confused – “How is it possible someone to know his complex password that he is using on one social media and demand money?”

What do you think, what is suspicious with this email?

Let’s learn and find out

WHY ARE PASSWORDS IMPORTANT? Passwords are the first security line against hackers. They are important part of security chain for the protection of devices, accounts and data.

Most of the people fear that their credentials will be accessed without permission. However, they always choose functionality rather than security. Hence, when people are creating passwords, they rely on their memory, because it is easier.

However, creating complex passwords can be simple.

Let’s learn how‌

WHY ARE PASSWORDS IMPORTANT? When creating accounts on the Internet, you have to keep in mind two very important things: 1. How passwords are stored?

2. How passwords are created?

This Photo by Unknown Author is licensed under CC BY-SA

STORING PASSWORDS You may create a strong, complex password, but anyway it can be found online, perhaps will be for sale on the dark market…

So what went wrong?

Every website that allows you to create an account, is having a

1 word s s a p my

******

database to store login information on the website server. So, when you enter your username and password (credentials) to login into your (email/social media/..) account, your credentials are compared to those that are stored in the database, and if there is a match you can log in successfully, if not you will get a message: “You’ve entered incorrect username or password”.

@

kr, e J ( Fa

*********

STORING PASSWORDS The most insecure way of storing passwords is in plain text, like this: username

password

aleksandar87

bmw440

Marija.d

df(Er,4g@st)96

translover

p@SSw0rd1234

Remember: It doesn’t matter how strong your password is if it is stored as a plain text, it is not secure!

So, to increase the security hashing algorithms are used. With them, the previous table will look like this:

STORING PASSWORDS RECOMMENDATIONS Hashing algorithms are not an issue for normal users. So, what should you do? ! When creating an online account make sure that the website is using HTTPS protocol.

Simple explanation: HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure) are communication protocols, for sending and receiving text-based messages on the Web.

STORING PASSWORDS RECOMMENDATIONS HTTPS protocol is used for secure communication. If the website is using HTTPS protocol, that means that the communication between your browser and the website you are connected to will be encrypted, so even if the hacker interrupts the communication, he will not be able to see what are you “talking about�.

How to check that? Simple. If there is a padlock before the name of the website, it is considered to be secure. (see the screenshot on the right).

STORING PASSWORDS RECOMMENDATIONS If there is not a padlock the communication is not secure.

STORING PASSWORDS RECOMMENDATIONS ! Test it!

Not 100% always correct, but you can make a test to see how your password is stored. How? Simple: Next time when you are trying to login to your account, click – Forgot my password. Then, in most cases, you will be asked to enter your email to receive instructions.

Remember: Never trust a site that is sending your password in a message!

STORING PASSWORDS RECOMMENDATIONS If your password is stored properly, the other side (bank, social media…) will never know what your actual password is!!! In that case, you should receive a link to reset your password! (do not forget to check the sender’s details).

STORING PASSWORDS RECOMMENDATIONS ! Do not use the same password for every account!

You do not know how your passwords are stored, so if you use the same password for every account, you are making a hacker’s life easier, because he will try to use that password to gain access to your other accounts.

Password: Tomthecat1

Password: Tomthecat1

Password: Tomthecat1

Password: Tomthecat1

STORING PASSWORDS RECOMMENDATIONS ! Avoid saving passwords on the websites!

It is easier to save the password, and every time you visit that website, just to click login and ta-dah you are IN. Well, maybe that is a practical solution, but it is far from secure.

The most secure way is to set up the option Auto sing-in OFF in your browser. And to remove all your stored passwords.

This example is how it should be (apply the red colored instruction from the screenshot on the right):

STORING PASSWORDS RECOMMENDATIONS ! Change the password after login from a different device that is not yours!

If you have to check your bank account from another device, that is not yours, please do not forget to change the password later. Why? Because maybe the browser will remember your credentials.

STORING PASSWORDS RECOMMENDATIONS ! Wherever is possible to use multi-factor authentication. If you can log in into account not just with a password, but with something else, you should do it.

Scenario: Imagine that the hacker has your password and tries to log in to your account. The second trap for him will be, for example, to find your fingerprint. Would that be easy, definitely NO. So, enable multi-factor authentication on every device and every account that you are using. Try to use a different device for every authentication step!

CREATE COMPLEX PASSWORDS If your password is safe stored, why should you create a complex password?

Well, the attacker may guess what kind of algorithm the website is using for storing passwords and will be able to crack it.

However if the password is more complex it will take more time and effort to hack it! Maybe years, so the hacker will probably give up!

d Passwor t8�

7 G f ) o Wo,n6D

CREATE COMPLEX PASSWORDS What is considered as a strong password?

The longer the better (min. 12 characters)!

There are several rules to follow but do not worry – creating complex passwords can be easy.

1.

Think of a phrase that you will remember.

2.

Mix the letters and add numbers.

3.

Add special characters.

CREATE COMPLEX PASSWORDS RECOMMENDATIONS

Book of passwords

! Do not forget, you should never write down your passwords! (your partner or some hacker could steal your masterpiece) If you can not remember complex passwords use solutions like KeePass or PassKeep to manage the passwords securely.

! Keep in mind that the hacker will know that you are using @ instead of a, $ instead of s, and 0 instead of o.

Facebo ok Iloveyo : u Twitte r: (ne7F, [op6

: Udemy 0 02 pappy2 dIN: Linke 6,dv3 e9 No^v

CREATE COMPLEX PASSWORDS RECOMMENDATIONS ! How often should you change your password?

Well, it is recommended to change it often (ex. once in 2-3 months) but considering that that is not so functional (imagine remembering 5 new complex passwords every month), Microsoft released a statement that will no longer recommend forcing periodic password changes.

Remember: If someone gains access to your account, first change the password and contact the support. Additionally, consult a cybersecurity specialist.

APPLY YOUR KNOWLEDGE Back to Story 3: Could you answer what is suspicious of the email that my friend received?

Storing passwords: The social media that my friend created an account on, was not storing the passwords properly.

The email: The email is constructed in that way so the user would get scared and pay money to maintain privacy.

In this case you should change the password on the hacked account and follow security procedures.

CHECK IF YOUR CREDENTIALS WERE COMPROMISED Do you wonder if your credentials are publicly available? You can check it! How? Click HERE. Haveibeenpwned is a popular site for checking if your credentials were compromised in data breaches.

You will get this message if your account has been compromised:

If not, you will get this:

Apply the recommendations from previous slides to cyberguard yourself.

CONCLUSION When it comes to cybersecurity, several pages are never enough!

In previous sections, we gave you the baseline for cyberguarding yourself. We guided you through phishing, malvertising, and passwords. It is expected that you gained basic knowledge for creating strong passwords, cleaning the “garbage� from your browsers, and awareness for not trusting in everything that you have received.

To be honest, if you want to use the Internet, at some point, you have to give information, BUT just do it knowingly and consciously!

The cyberattacks grow in sophistication and scale, so you can not follow their steps, instead, just try not to interact with anything malicious.

FOLLOW US The Global Shapers Skopje Hub is comprised of young and ambitious individuals who are committed to empowering community members to be positive agents of change in their society.

Check our webpage and follow us on social media!