Top 5 Tips to NOT Get Hacked Online
by Jeremiah Grossman - Monday, 25 September 2006.
ďOh my God, Iím never doing anything on-line again!,Ē is a common reaction to one of my web application hacking presentations. Recently Iíve been demonstrating how easily the average website or user can be hacked. No doubt scaring audiences has a certain mass appeal and gets people to pay attention to why the right security practices are of vital importance. People frequently ask if I still bank or shop online (of course I do), or how they can protect themselves when they do. For those who are not experts in computer security, here are my top 5 tips to a safer online experience (in addition to having firewalls, anti-virus, and patching diligently).

1) Switch your web browsers to Firefox, Mozilla, Safari, or anything else besides Internet Explorer

This is probably the single most important thing you can do to protect yourself online. Iíve mentioned before that Iím a fan of staying secure by staying out of the line of fire. Internet Explorer is well known for being in the crosshairs of viruses, spyware, and adware. I know I know, Microsoft is releasing the highly anticipated version 7, supposedly a security light-year ahead of everything else. A web browser so revolutionary itís being pushed as a mandatory upgrade! Talk about an attractive target for malicious hackers. In my view itís best to use an alternate product and remain out of the fray. If a website REALLY does need IE and you REALLY need to use the website, make sure the website is legit, then itís reasonably safe to fire up IE.

2) Add more security to your web browser

No matter what browser you choose, the Web is a hostile place and they all need a little help to defend themselves. NoScript (Firefox extension), Netcraft Anti-Phishing Toolbar, E-Bay Toolbar, and Google Toolbar are great products that do just that. These add-ons help identify phishing websites, prevent your computer from being hacked, and passwords from falling into the wrong hands. Most people will only need the first two add-ons, but if you are an E-Bay buyer, using theirs is essential is well.

3) Donít click on links in email, almost ever

Whenever possible try NOT to click on any links in email, especially since links are themselves are dangerous and phishing emails are difficult to spot. An ounce of paranoia is worth a pound of patches. If Iím unsure if an email is real, one thing I do is manually type the domain name into the web browser location bar. This way I know Iím on the real website. If Wells Fargo were to ask to verify my account information by ďclicking hereĒ, instead I type in then proceed to login. If Wells Fargo, or whatever the organization your doing business with, really wanted to verify the account information they would have asked at that point. Some email links are safer to click on than others. Like those sent in response to an action (account registration, password reset, order confirmation, etc) you might have performed on the website within the last several minutes.

4) Defend your Web Mail!

Hundred of millions of people use Web Mail, which in many ways email is more important to keep secure than your bank account. Many people have important online accounts tied to a single Web Mail address. If anyone gained access to your email account, all accounts associated to could be compromised as well. The best thing you can do is use unguessable passwords, change them ever six months or so, and donít use that password anywhere else. Bonus points for deleting emails with any sensitive information.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th