Black Star Radio

Hi. Today we’re going to talk about spear phishing. Now I’m not talking about diving underwater and trying to catch fish with a spear. I’m talking about spear phishing spelt with a P-H, so P-H-I-S-H-I-N-G. Spear-phishing spelt that way is an email-based scam targeted towards a specific individual or organization. Microsoft report that spear-phishing attacks have doubled in the last year. Now having said that, I should point out that most spear-phishing attacks are aimed at larger businesses and larger organizations because they are really, really targeted and they take a lot of time to get working. But they’re still important to know about.

An example, a basic example of a spear-phishing attack, would be, say, for instance, a job that has been advertised in a large company. The HR person gets an email with all the correct details from a prospective job client. HR opens the resume, which then infects their computer. That’s sort of an example of that.

I bring this up because spear phishing is the highly targeted version of phishing, which is the more common type of attack. These are the ones that you’re likely to get attacked by. An example would be PayPal sends you an email asking you to verify account details by clicking a link, which then can install malware on your computer. The link might say, “Login into this site,” which is a fake site. Then they’ve got your login and your password.

There’s a couple of things you can do about that because a lot of those are quite sneakily done. One is to install two-factor authentication. Microsoft says that two-factor authentication stops 99.9% of automated attacks on your system. That’s number one big one.

Also, a password manager. Say, for instance, fake PayPal has sent you an email requesting you verify your account. You click on the link, you login into a site which looks exactly like PayPal. You don’t notice this: it’s actually spelled P-A-Y-P-A-1.com. So it looks very close to PayPal, and they spoof the site up to look exactly like PayPal. If you go to log in to this fake PayPal account, your password manager, which normally would offer to put your login and your password in, it won’t come up because it doesn’t recognize that as your legitimate site for that instance. There’s sometimes when it is the right one, but at least you can have a look and you can get suspicious.

The other thing is, because a lot of these are automated, there may be slight spelling or grammar mistakes, or just clumsy English. You know if something comes from PayPal or big banks or anyone like that, any big organization, they’re going to send you a well crafted, well written English email. They’ve got paid professionals to make sure the emails come out and look professional. If it’s not the usual level of professionality that you expect from that company, the next thing to do is just roll your mouse over where the link is and you’ll see down the bottom left corner of your browser, it’ll tell you the real link. If you roll over something that says, “Click here to verify your account,” and it’s purportedly from PayPal, then if you look down at that bottom actual URL, the actual web address, it might say abracadabra.com or whatever. Then you know, no, just don’t go there. Just delete the email.

Also, you can enter a fake password first when you login into the site that you’ve been sent by this email. If it’s fake, it will accept your password, if real it will give you an error.

The final thing to do is, if you suspect an email, say a fake one from PayPal. Well, PayPal is not a very good example because they don’t answer their phones, but from a bank or somewhere like that, just ring the bank or ring the organization and ask them. They’ll be really pleased that you’ve rung them because they want to know what phishing emails are about. They’ll almost always tell you if your email is a scam or not. That’s the best thing to do. Even with PayPal, send them an email, unless they’ve changed their policies and they do talk to you now, but they never used to. All right, thank you very much and goodbye.

Black Star Radio talk Aug 23rd 2019 (transcript)

I think most of us have heard of the term VPN and often we don’t really know what it is, or we’ve got a bit of a wrong idea about what it can do. What it actually stands for is, Virtual Private Network and what it does is, it encrypts your data going from your computer to a website.

So say you were filling in a form on a website, which would probably have your name, your address, maybe date of birth, and a few other quite interesting bits of information. Once it gets to the website, as long as the website is a secure website with HTTPS on it, or the little lock you see in your browser window, that means that the data inside the website is encrypted and pretty safe.

But the data that you send to the website, the time that it goes from your computer to that website, often that’s not encrypted, especially in an open wifi system where you’re in a hotel say, or in a cafe, or something like that. Then theoretically someone can grab your data as it’s going to that website, and steal it, and then use it for nefarious purposes. So it’s quite a handy thing to have.

Anonymity – No

Some people think using a VPN makes you anonymous and it doesn’t really. It hides some things that you’re doing, but it doesn’t actually totally make you anonymous. So if you’re looking for anonymity, don’t use a VPN. The best way to think about it is just an extra layer of security. So in our modern world, we have layers of security with what we do in our modern digital world. And a good analogy is, it’s like having curtains on a house. It stops people seeing what’s inside your house, the contents of the house, even though the house is in full view on the street. So that’s a really good analogy and a good way to think about it.

Now another reason to do it is, Australian law now says that ISPs have to collect all sorts of data, what they call the metadata. So what that is, they don’t collect your individual places where you go, but they do collect your name, your address, your date of birth, your email address, your billing details, and a lot of other information with your account, the time and date, and duration of any of your communications, the type, whether it’s phone, text, social media, email, or whatever, and the destination of where you’re going, and your IP address. And that’s available to the government if they need it.

So if you’re upset with that amount of federal government knowledge of what you’re doing, then a VPN can hide a lot of that information. It’s never going to hide everything. It’s still a really good idea to have. And one of the other things it does is, some of the streaming videos sites, for instance, the geo-block you, depending on what country you are in. So with a VPN, you can bypass that if you want to.

Netflix

But there are companies like Netflix who, if they see you’ve got a VPN, they don’t let you in at all. They’ve bypassed you trying to bypass their geo-blocking things. But it’s still quite important these days to actually have one. And particularly if you’re in an open wifi system where there’s no password, then your data is really up for grabs as you go up and down from websites.

One of the things you should be aware of is there’re plenty of free VPNs, but someone once said that if you don’t pay for a product, then you are the product. And I think that’s especially relevant in today’s internet world. So if a VPN company doesn’t make money from charging you for your VPN, it’s got to make money somehow, which is fair enough. It’s got to make money and it’ll make money either from ads, or selling your data. And the whole reason of a VPN is that you don’t want people to see your data. So this is an instance where free is not good, and it’s not really free.

Why it’s worthwhile using a VPN.

a) It’s worthwhile having it.
b) It’s worthwhile just going to Google typing in, ‘VPN Australia’ and then you’ll get plenty of reviews of good VPNs, and what people think of them, which is the more important thing. And all of them have got different prices, and different pros and cons. So you’ll find comparison sites that look through all of them and that’s a really good way to go. And I really still do highly recommend having a VPN for all of those reasons I’ve just talked about.

I use a product called Speedify They describe themselves: “Speedify is a revolutionary channel bonding VPN that combines Wi-Fi and Cellular (and more!) to create a faster, more reliable, and secure connection.”

I use Speedify mainly for combining internet connections but I keep the VPN on because of the reasons I’ve described above.

You should keep ALL your data in the cloud! I repeat, put your data in cloud storage – very important.

Why?

One very good reason is that’s it’s safe there. If you lose laptops and external hard drives, or they get stolen or break down, they can be replaced (bloody annoying but not catastrophic); if you lose all the docs, photos, files ie all your data then that can be catastrophic. Put your data in cloud storage.

Here is a good example of this:

None of the principal cloud storage companies (eg Google, Dropbox, Amazon, iCloud) have ever (to my knowledge) had a major hack. Icloud was reported to have been hacked but that was actually a password hack which is a very different animal. A point here to remember is that Password Managers and 2-Factor Authentication (use password october) are essential!

And the major cloud storage companies encrypt your data so even if the data centres are hacked, then your data has to be un-encrypted before it’s of any use to anyone. Their encryption is the best that is available too.

Most of them keep your data in multiple data centres, so in the event of a breakdown or failure of one data centre, your data is safe in another one.

Basically they have the best engineers and technology in the world, so are far safer than your laptop or external hard drive. Their job is to keep your data safe and they are world-best at doing that.

Having said all of the above, it still is a good idea to have external hard drive local backups.

So, what about emails? I recommend using a cloud-based email provider like Gmail, Mac Mail, or Outlook 360 (not the old Outlook). All of these give you storage space as well (a nice bonus).

There are two other main advantages of cloud storage:

1. you can access your data on all your devices – your laptop, smartphone and tablet.
2. collaboration is easier and less time-consuming

Finally – photos on your smartphone – most people have thousands of photos! Both Android and iPhones have the ability to do auto backups to their respective clouds of all your photos.

This has two major advantages:

1. Frees up space on your phone
2. Keeps your photos safe if you lose your phone, or it fails, or gets stolen.

Set up and use iCloud Photos

Setup and use Google Photos 

Google Photos is currently the better option for a whole lot of reasons (for both iPhone and Android)

Where to store your files in the cloud?

The 2 big boys are Google Drive and Dropbox; there are others, of course, but we’ll just look at these two today.

The best solution is to use both, but you need to know the strengths of each, so you can decide what to store where.

They both store files (documents) in the cloud for you; for backup, collaboration or sharing.

Both let you share selected documents with other people.

Both have free versions available with limited storage.

DROPBOX

• syncs just your changes so uses less data
• easy to keep local versions of your documents (handy if travelling by plane)
• you can fine-tune your sync options eg keep local copies of some of your files, but not all
• searching is not as good as Google Drive
• you have more sharing options than Google Drive

GOOGLE DRIVE

• a bit safer than Dropbox, although both are very secure
• Google Drive does have better encryption
• far better searching: Google Drive search is excellent (see image)
• will search for text and items with images and pdf’s (Dropbox now has this for Professional and Business accounts)
• Google Photos is incredible – it sorts and labels automatically, and you can set up your phone to backup all photos automatically to Google Photos
• by far the best for collaborative editing of documents. It is brilliant! You can allow people to edit, suggest or make comments on your documents.

BEST SOLUTION

The best solution is to use both! You could use Google Drive for collaboration and photos, and Dropbox for backup and when you need local versions of your documents.

You get heaps of space this way and the best of both worlds.

The one big caveat is that you MUST have a system or set of rules for what is stored where – otherwise you’ll spend frustrating time trying to remember which cloud storage each document is on.

Of course, for Microsoft-centric users there is OneDrive; and for mac users – iCloud