%PDF-1.3 1 0 obj << /Type /Catalog /Outlines 2 0 R /Pages 3 0 R >> endobj 2 0 obj << /Type /Outlines /Count 0 >> endobj 3 0 obj << /Type /Pages /Kids [6 0 R ] /Count 1 /Resources << /ProcSet 4 0 R /Font << /F1 8 0 R /F2 9 0 R /F3 10 0 R /F4 11 0 R >> /XObject << /I1 16 0 R >> >> /MediaBox [0.000 0.000 612.000 792.000] >> endobj 4 0 obj [/PDF /Text /ImageC ] endobj 5 0 obj << /Creator (DOMPDF) /CreationDate (D:20250716061846+00'00') /ModDate (D:20250716061846+00'00') /Title (Report 07-2025) >> endobj 6 0 obj << /Type /Page /Parent 3 0 R /Annots [ 12 0 R 14 0 R ] /Contents 7 0 R >> endobj 7 0 obj << /Length 9179 >> stream 0.702 0.800 0.816 rg 34.016 34.016 543.969 723.969 re f 1.000 1.000 1.000 rg 45.266 174.779 521.469 571.955 re f 0.773 0.773 0.773 RG 0.75 w 0 J [ ] 0 d 45.641 175.154 520.719 571.205 re S 0.773 0.773 0.773 rg 61.016 190.529 m 550.984 190.529 l 550.984 191.279 l 61.016 191.279 l f 0.200 0.200 0.200 rg BT 61.016 693.716 Td /F1 14.4 Tf [(CYBERSECURITY AWARENESS MONTH: CREATING STRONG )] TJ ET BT 61.016 676.134 Td /F1 14.4 Tf [(PASSWORDS)] TJ ET 0.400 0.400 0.400 rg BT 61.016 647.326 Td /F2 9.0 Tf [(Posted on )] TJ ET BT 104.045 647.326 Td /F3 9.0 Tf [(May 10,2021)] TJ ET BT 156.578 647.326 Td /F2 9.0 Tf [( by )] TJ ET BT 171.086 647.326 Td /F3 9.0 Tf [(David Wiles)] TJ ET 0.373 0.169 0.255 rg BT 61.016 619.837 Td 1.096 Tw /F4 9.0 Tf [(Before)] TJ ET 0.373 0.169 0.255 RG 0.18 w 0 J [ ] 0 d 61.016 618.686 m 87.530 618.686 l S 0.153 0.153 0.153 rg BT 87.530 619.837 Td 1.096 Tw /F4 9.0 Tf [(we pointed out that most people underestimate the importance of having a secure password, and still make the )] TJ ET BT 61.016 608.848 Td 0.000 Tw /F4 9.0 Tf [(mistake of using simple words and numbers as a password.)] TJ ET BT 61.016 588.859 Td 0.566 Tw /F4 9.0 Tf [(Keep in mind that your email and social network accounts contain very personal information about you. You must have a )] TJ ET BT 61.016 577.870 Td 0.000 Tw /F4 9.0 Tf [(strong password to keep your personal life personal, and not become a victim of identity theft.)] TJ ET 0.153 0.153 0.153 RG 85.866 560.697 m 85.866 561.110 85.696 561.520 85.404 561.811 c 85.113 562.103 84.703 562.272 84.291 562.272 c 83.878 562.272 83.469 562.103 83.177 561.811 c 82.885 561.520 82.716 561.110 82.716 560.697 c 82.716 560.285 82.885 559.875 83.177 559.584 c 83.469 559.292 83.878 559.122 84.291 559.122 c 84.703 559.122 85.113 559.292 85.404 559.584 c 85.696 559.875 85.866 560.285 85.866 560.697 c f BT 91.016 557.881 Td 1.403 Tw /F4 9.0 Tf [(Using email or your profile on Facebook, Whatsapp or Google, hackers can and do, extract a huge amount of )] TJ ET BT 91.016 546.892 Td 0.000 Tw /F4 9.0 Tf [(personal data of your personal "online" life.)] TJ ET 85.866 538.719 m 85.866 539.132 85.696 539.542 85.404 539.833 c 85.113 540.125 84.703 540.294 84.291 540.294 c 83.878 540.294 83.469 540.125 83.177 539.833 c 82.885 539.542 82.716 539.132 82.716 538.719 c 82.716 538.307 82.885 537.897 83.177 537.606 c 83.469 537.314 83.878 537.144 84.291 537.144 c 84.703 537.144 85.113 537.314 85.404 537.606 c 85.696 537.897 85.866 538.307 85.866 538.719 c f BT 91.016 535.903 Td 0.513 Tw /F4 9.0 Tf [(If you use the same password for multiple online accounts, you run the risk, if this password is hacked, of all your )] TJ ET BT 91.016 524.914 Td 0.000 Tw /F4 9.0 Tf [(online accounts being compromised.)] TJ ET 85.866 516.741 m 85.866 517.154 85.696 517.564 85.404 517.855 c 85.113 518.147 84.703 518.316 84.291 518.316 c 83.878 518.316 83.469 518.147 83.177 517.855 c 82.885 517.564 82.716 517.154 82.716 516.741 c 82.716 516.329 82.885 515.919 83.177 515.628 c 83.469 515.336 83.878 515.166 84.291 515.166 c 84.703 515.166 85.113 515.336 85.404 515.628 c 85.696 515.919 85.866 516.329 85.866 516.741 c f BT 91.016 513.925 Td 0.739 Tw /F4 9.0 Tf [(Using a personal name for an online account, the name of the city that you live in, the names of your children or )] TJ ET BT 91.016 502.936 Td 0.000 Tw /F4 9.0 Tf [(your date of birth, give hackers vital clues for attempting to access your personal data.)] TJ ET 85.866 494.763 m 85.866 495.176 85.696 495.586 85.404 495.877 c 85.113 496.169 84.703 496.338 84.291 496.338 c 83.878 496.338 83.469 496.169 83.177 495.877 c 82.885 495.586 82.716 495.176 82.716 494.763 c 82.716 494.351 82.885 493.941 83.177 493.650 c 83.469 493.358 83.878 493.188 84.291 493.188 c 84.703 493.188 85.113 493.358 85.404 493.650 c 85.696 493.941 85.866 494.351 85.866 494.763 c f BT 91.016 491.947 Td 1.239 Tw /F4 9.0 Tf [(For an average expert hacker, it is always easy to find passwords that are made up of words from the English )] TJ ET BT 91.016 480.958 Td 0.000 Tw /F4 9.0 Tf [(vocabulary or other languages, using a basic technique called "brute force" or "dictionary" attacks.)] TJ ET BT 61.016 457.999 Td /F1 9.0 Tf [(What makes a password safe?)] TJ ET BT 78.360 438.026 Td /F4 9.0 Tf [(1.)] TJ ET BT 91.016 438.010 Td /F4 9.0 Tf [(A password at least 8 characters long.)] TJ ET BT 78.360 427.037 Td /F4 9.0 Tf [(2.)] TJ ET BT 91.016 427.021 Td /F4 9.0 Tf [(The password does not contain information that is easy to find online, such as the date of birth, the telephone )] TJ ET BT 91.016 416.032 Td /F4 9.0 Tf [(number, your spouses name, the name of a pet, or a childs name.)] TJ ET BT 78.360 405.059 Td /F4 9.0 Tf [(3.)] TJ ET BT 91.016 405.043 Td /F4 9.0 Tf [(The password does not contain words found in the dictionary.)] TJ ET BT 78.360 394.070 Td /F4 9.0 Tf [(4.)] TJ ET BT 91.016 394.054 Td /F4 9.0 Tf [(The password contains special characters like @ # $% ^ &, and numbers.)] TJ ET BT 78.360 383.081 Td /F4 9.0 Tf [(5.)] TJ ET BT 91.016 383.065 Td /F4 9.0 Tf [(The password uses a combination of uppercase and lowercase letters.)] TJ ET BT 61.016 360.106 Td /F1 9.0 Tf [(A trick that the experts use to create secure passwords:)] TJ ET BT 61.016 340.117 Td /F4 9.0 Tf [(Think of a phrase and use the first letters of the words in the phrase.)] TJ ET 85.866 322.944 m 85.866 323.357 85.696 323.767 85.404 324.058 c 85.113 324.350 84.703 324.519 84.291 324.519 c 83.878 324.519 83.469 324.350 83.177 324.058 c 82.885 323.767 82.716 323.357 82.716 322.944 c 82.716 322.532 82.885 322.122 83.177 321.831 c 83.469 321.539 83.878 321.369 84.291 321.369 c 84.703 321.369 85.113 321.539 85.404 321.831 c 85.696 322.122 85.866 322.532 85.866 322.944 c f BT 91.016 320.128 Td /F4 9.0 Tf [(For example: )] TJ ET BT 146.033 320.128 Td /F2 9.0 Tf [("In South Africa, a barbecue is called a Braai!")] TJ ET 85.866 311.955 m 85.866 312.368 85.696 312.778 85.404 313.069 c 85.113 313.361 84.703 313.530 84.291 313.530 c 83.878 313.530 83.469 313.361 83.177 313.069 c 82.885 312.778 82.716 312.368 82.716 311.955 c 82.716 311.543 82.885 311.133 83.177 310.842 c 83.469 310.550 83.878 310.380 84.291 310.380 c 84.703 310.380 85.113 310.550 85.404 310.842 c 85.696 311.133 85.866 311.543 85.866 311.955 c f BT 91.016 309.139 Td /F4 9.0 Tf [(Take the first letters of each word and the password that is created is )] TJ ET BT 368.144 309.139 Td /F3 9.0 Tf [(ISAabicaB!)] TJ ET 85.866 300.966 m 85.866 301.379 85.696 301.789 85.404 302.080 c 85.113 302.372 84.703 302.541 84.291 302.541 c 83.878 302.541 83.469 302.372 83.177 302.080 c 82.885 301.789 82.716 301.379 82.716 300.966 c 82.716 300.554 82.885 300.144 83.177 299.853 c 83.469 299.561 83.878 299.391 84.291 299.391 c 84.703 299.391 85.113 299.561 85.404 299.853 c 85.696 300.144 85.866 300.554 85.866 300.966 c f BT 91.016 298.150 Td /F4 9.0 Tf [(This will be very difficult to guess, but easy to remember.)] TJ ET 85.866 289.977 m 85.866 290.390 85.696 290.800 85.404 291.091 c 85.113 291.383 84.703 291.552 84.291 291.552 c 83.878 291.552 83.469 291.383 83.177 291.091 c 82.885 290.800 82.716 290.390 82.716 289.977 c 82.716 289.565 82.885 289.155 83.177 288.864 c 83.469 288.572 83.878 288.402 84.291 288.402 c 84.703 288.402 85.113 288.572 85.404 288.864 c 85.696 289.155 85.866 289.565 85.866 289.977 c f BT 91.016 287.161 Td /F4 9.0 Tf [(At this point, you can decide to make your the Google password is )] TJ ET BT 357.146 287.161 Td /F3 9.0 Tf [(ISAabicaB!-G)] TJ ET BT 414.656 287.161 Td /F4 9.0 Tf [(, and Facebook )] TJ ET BT 481.697 287.161 Td /F3 9.0 Tf [(ISAabicaB!-F)] TJ ET BT 91.016 276.172 Td /F4 9.0 Tf [(and your university account )] TJ ET BT 205.568 276.172 Td /F3 9.0 Tf [(ISAabicaB!-U)] TJ ET BT 262.574 276.172 Td /F4 9.0 Tf [(S and so on.)] TJ ET 85.866 267.999 m 85.866 268.412 85.696 268.822 85.404 269.113 c 85.113 269.405 84.703 269.574 84.291 269.574 c 83.878 269.574 83.469 269.405 83.177 269.113 c 82.885 268.822 82.716 268.412 82.716 267.999 c 82.716 267.587 82.885 267.177 83.177 266.886 c 83.469 266.594 83.878 266.424 84.291 266.424 c 84.703 266.424 85.113 266.594 85.404 266.886 c 85.696 267.177 85.866 267.587 85.866 267.999 c f BT 91.016 265.183 Td /F4 9.0 Tf [(There is already a capital letter and a special character )] TJ ET BT 312.110 265.183 Td /F3 9.0 Tf [(\(!\))] TJ ET BT 321.101 265.183 Td /F4 9.0 Tf [(, so you just need to add a number to finish off a good )] TJ ET BT 91.016 254.194 Td /F4 9.0 Tf [(password like )] TJ ET BT 148.031 254.194 Td /F3 9.0 Tf [(9-ISAabicaB!-US)] TJ ET BT 221.543 254.194 Td /F2 9.0 Tf [(\(9 could be the month you created the password in - for example\))] TJ ET BT 61.016 234.205 Td /F4 9.0 Tf [(You will have already made your password a lot more difficult to hack, and it can be a lot of fun to create.)] TJ ET 0.400 0.400 0.400 rg BT 61.016 215.716 Td /F2 9.0 Tf [(Posted in:News,Phishing,Security,Tips | Tagged:Cyberaware,Cybersecurity,Password,Passwords,Phishing | With 0 )] TJ ET BT 61.016 204.727 Td /F2 9.0 Tf [(comments)] TJ ET q 225.000 0 0 135.000 61.016 493.628 cm /I1 Do Q endstream endobj 8 0 obj << /Type /Font /Subtype /Type1 /Name /F1 /BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding >> endobj 9 0 obj << /Type /Font /Subtype /Type1 /Name /F2 /BaseFont /Helvetica-Oblique /Encoding /WinAnsiEncoding >> endobj 10 0 obj << /Type /Font /Subtype /Type1 /Name /F3 /BaseFont /Helvetica-BoldOblique /Encoding /WinAnsiEncoding >> endobj 11 0 obj << /Type /Font /Subtype /Type1 /Name /F4 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj 12 0 obj << /Type /Annot /Subtype /Link /A 13 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 493.6285 286.0157 628.6285 ] >> endobj 13 0 obj << /Type /Action /S /URI /URI (http://blogs.sun.ac.za/it/en/2018/10/cyber-aware-month-common-passwords/) >> endobj 14 0 obj << /Type /Annot /Subtype /Link /A 15 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 619.0048 87.5297 628.1623 ] >> endobj 15 0 obj << /Type /Action /S /URI /URI (http://blogs.sun.ac.za/it/en/2018/10/cyber-aware-month-common-passwords/) >> endobj 16 0 obj << /Type /XObject /Subtype /Image /Width 300 /Height 180 /ColorSpace /DeviceRGB /Filter /DCTDecode /BitsPerComponent 8 /Length 4011>> stream JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82 C    !'"#%%%),($+!$%$C   $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$," }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ?(< ( ( ( ( ( (Q@((((((((((((((((((((((((((((((((((((((((((+!e:!6Y.9ۻλqT#%s?#klf@D.|m{9HrKՂ(QEQEQEQEQEQEQEQEQEQEQEs$okK 4zbb$1Gő Jq֍'Vj һn_xn 9|AFpב7_ ɣlUQkO]~ZG]at"FZ9<6qުQšC-j-̌e0O(9}~INOt ⺚_Mc2h]/ kön]\=bQ]$rnPiOҿ?Y\#Ͽ5 7Q dѿ6?*?JHD=@+# Q`HM|/C&Tk4o AOҿ??JH0{$y&F:oii7ݎ+vo5'_ U=[,<=4r e-TIQ`HàG5jZMͣ_ϧ9yf3]5y 2j(AEPEPEPEPEPEP0(QEQEQEQEWM?O]6vQȮҹ_ZڃjW]ʎ]ƏBG .ZڭԶȞSm,NN3YڷZ*ڿ3g܏C?s7H9jO[Vz*xr?BG .G!#o?o?:?[Ww3GH9h$5'GQy={j} 33]Ƥռ ӧ{`HJWb}Gum̞B>Vc>>׊5qWgY6[QXQEQEQE ( (Q@Š(AEPEPEPwB]B M"wZ]O8'l2 \vNg]CQ]'<҃ck c@~kPJYUsyvhAԩ4V`< yx[`w5}ax#.j 9}F/.[P{H)өP9`fΕn伔Op?C]jmvv[͕$NY9 ;'~{qF A#wZ+mxvVo͸qdqQєQEHQEQEQE ((QE (Q@Q@Q@Q@r!?KW+#KZRQ: iVdQQ@ QVn%5;"0 ݆g>_x}7vZ\,QWX>da})W( yyv 4 VvPQ%g 9f* 1$IMlCGQǐsG~/i}!ټDQM3:UXz/{ll2THG\tp54ނPIjZO}G1 [U;VC xp+Pu[)o㸶CHWS^Ik ىyZ%^OsqT,{R=N((((((((((((QExׄ p P} ʺ'@Kmq=?~ W^zj)j W=j dg*8ďxW_CQ\~?F?G eE}cmX{$s¿Ug!`jiO dmv-n?׬_C@^ԝ'ϳK}U5=2^=_Pv&I:tzzܥ2Ăf^7湛U]{I^KoYT@Ĩm8 +(tܛwV +A3^^/Eh?ok4"WEW`QEQEQEQEQEQEQEQEQEQEQE (Q@Q@W,QOV(;OH.Lּ3]\ưNI Qs)8R8=j-oQ~ 㴴WJjb߶O;G-oQ~ 㴴Sթ=+_|\DҼ#5)Ŋ8U+#`Mf7FBmb d㓎98+d2aEW!EPEPEPEPEPEPEPEPEPEPEP0(QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE (QEQEQEQEQEQEQEQEQEQEQEQE?`4lQTPll(=M6SFh ލފ(==袀 ލފ(==MPz6SElE`4Q@h=MPz6SElE`4Q@FElފ(==MP{Ѱz( endstream endobj xref 0 17 0000000000 65535 f 0000000008 00000 n 0000000073 00000 n 0000000119 00000 n 0000000332 00000 n 0000000369 00000 n 0000000507 00000 n 0000000596 00000 n 0000009827 00000 n 0000009939 00000 n 0000010054 00000 n 0000010174 00000 n 0000010282 00000 n 0000010409 00000 n 0000010533 00000 n 0000010659 00000 n 0000010783 00000 n trailer << /Size 17 /Root 1 0 R /Info 5 0 R >> startxref 14962 %%EOF Security « Informasietegnologie
Language:
SEARCH
  • Recent Posts

  • Categories

  • Archives

Security

Cybersecurity Awareness Month: Social Engineering – The weakest link

Thursday, October 25th, 2018

When we use the term “hacker” in our day-to-day conversation, we tend to associate it with an attacker who uses their technical expertise to break into protected computer systems and compromise sensitive data. We hear about this breed of hacker in the news and we invest millions of rands in new technologies to improve our network defences.

However, there is another type of attacker who use their tactics to bypass even the most expensive and effective cybersecurity technology. They use a variety of media, including phone calls and social media, and trick people into offering them access to sensitive information. These are the social engineers, hackers who exploit the one weakness found in every institution, also universities: human psychology

Social engineering is a term that covers a broad spectrum of malicious activity. It is a means of attack that leans on human interaction and involves manipulating people. All the methods listed in our previous article use social engineering.

The object of a social engineer is to convince people to bypass or suppress their natural reserve or suspicion in order to get access to technology systems or data. For example, someone who calls the secretary of a department pretending to be from the IT Department asking questions and getting them to reveal sensitive information such as login names, e-mail addresses, WiFi passwords, etc. They are in essence con-artists.

Whether it is through a phone call or an email, social engineering attacks are always very effective because they rely on the weakest link of security – human beings.

The best historical record of social engineering is the story of the Trojan War from Homer’s Illiad. After a ten-year siege on the Trojans, the Greeks pretended to accept their defeat. They left behind an enormous wooden horse as an offer of peace, and the Trojans opened their city gates to bring in the horse as a victory trophy. However, the Greeks soldiers were hiding inside the wooden horse, crept out at night, opened the city gates and allowed the Greek army to enter and destroy the city of Troy.

How to protect yourself:

  • First and foremost, be suspicious of anyone who contacts you via email or telephone and appears to know a lot about you. They may be very friendly and attempt to gain your trust, but if you’ve never dealt with this person before, ask yourself how they know so much about you and why they are contacting you.
  • If you are contacted by telephone, don’t blindly provide information. If you’re suspicious (that little voice in the back of your mind that says “something is not right here”), hang up.
  • Offer to call the person back. Ask them for a direct phone number. If they can’t provide one, discontinue the call.
  • If they do provide a number, do some research. Can you find a website for the company? Do a Google search on the phone number – does it come back linked to the company name you were given?

As a matter of habit, never give personal or sensitive information, for example, your login name, ID number, password and bank account number, over the phone or email. If the person is persistent, explain that you are concerned about security and will not provide this information over the phone. If they don’t accept your explanation, they should not be trusted.

Not only are your inboxes and phone lines being targeted, but so are your social media sites. Take a long, hard look at your social media presence. How much do you reveal about yourself to the world? Do you provide information about your position with a company? Do you share your habits – where you shop, gym or like to eat or socialize? Even the most mundane information you share could make you a target for a social engineering attack. Any social engineer will do their homework on you ahead of time. Whether it’s selfies or cat videos, most us like to tweet, tag, link, comment, like, and post online. Platforms like Facebook and Instagram are full of information social engineers can use.  

How many personal details are displayed on your department or Facebook page? Some departmental web pages even display personal cell phone numbers.

Over the past week, there has also been an increase in extortion phishing. Extortion phishing is the practice of obtaining money through force or threats via email. The victim receives an email suggesting they have been recorded through their webcam whilst watching adult websites. The criminals demand a ransom in Bitcoin or some untraceable cryptocurrency and threaten to circulate the recording to their contacts unless payment is made. Often scammers state that they know your password, installed malware on the computer and demand payment.

The new extortion phish threat plays on our own innate sense of guilt. More worrying, however, is that the passwords they have are often correct or close to correct because they have been leaked through data breaches. Usually, these passwords are old and haven’t been used for months or years. In some cases, they’ve remained unchanged or have only changed by a single letter or number. For example, how many times would I have to guess the correct password if the old password is “christopher” and the new password is “Christopher123”.

Your password and email address are potentially out there for all to see. One way to check if your username and password have been leaked in a data breach is to use a site like Firefox Monitor. You can enter in your e-mail address and the site will tell you if your information, e.g. email address and password have been compromised.

Social engineering attacks range from unsophisticated attacks, for example simply lying to get information, to very elaborate attacks, for example specifically designed websites. They have one thing in common – exploiting the weakest link, human beings. 

For this reason, these attacks will continue to increase, so being aware and cautious is the best defence.

Next time we will focus a little more on the type of attacks the university has suffered over the past year or so, and how to spot them.

Keep safe out there;

Cybersecurity Awareness Month: Identity Thieves Modus Operandi – Part 2

Friday, October 19th, 2018

In our previous article, we mentioned that identity theft isn’t always “high-tech”. It can happen to anyone, even if they don’t have a computer, use social media or own a cell phone. However, in this article, we’ll focus on “high-tech” methods of identity theft.

The identity thief’s goal is to obtain your personal information, such as your ID Number, bank or credit card account numbers, credit report information or the existence and size of your savings and investment portfolios. Once they have any of these, they can contact your financial institution pretending to be you or someone with authorized access to your account. The thief may, for example, claim that they have forgotten their chequebook and needs information about their account.

Credit or debit card theft – Many people believe credit card fraud and identity theft are the same. In reality, they are different crimes. The main difference between credit card fraud and identity theft is that credit card fraud typically involves a single credit account, but if your identity is stolen, the potential for damaging your credit history can be much greater, because someone can open numerous lines of credit in your name. Credit card fraud typically occurs when someone steals your credit card information and uses it to make unauthorized purchases. This can be done by stealing your purse or wallet or, if the criminal works at a retail store or in a restaurant, he or she may simply copy your credit card information during a transaction.

Pretexting – If you receive a phone call from someone from a reputable research firm asking you to participate in a survey, asking seemingly harmless questions like the name of your cell phone provider, bank, or even your preferred shopping centre, this is probably a pretexting scam. Pretexting is the practice of getting your personal information, such as telephone records, bank or credit card numbers, or any other information, under false pretences. A pretexter pretends they are someone else to obtain your personal information claiming they are from a survey firm and want to they ask you a few questions. Sometimes they will claim to be representatives from other types of organizations – not just survey firms –  but banks, SARS, insurance companies and ISPs.

Skimming – Identity thieves place small machines or skimmers, in the card slots of ATMs to steal credit and debit card numbers and pin codes from unsuspecting victims. This has also been reported to occur at some petrol stations where you can pay at the pump. It is not easy to look at a card reader and see that it has been altered in some way before you insert your debit or credit card, as some of the skimmers are so advanced that they are virtually undetectable. In some cases, a skimmer may remain in place for months at a time, unnoticed by employees of the “host” store and it could take months before victims realize that an identity thief has stolen their card number and PIN. Most victims only find out after the thief starts making illegitimate purchases or withdrawals from their accounts, often to the tune of thousands of rands.

Man-in-the-middle attacks – Smartphones and tablets have become a major point of access to the internet. There are many Wi-Fi networks that people can connect to from almost anywhere, for example, public libraries, airports, shopping malls and government or municipal facilities. Unfortunately, this also opens a “port of entry” for hackers which has led to the increase of “Man-In-The-Middle” attacks. A Man-In-The-Middle attack, also known under the acronym MITM, happens when a communication between two parties is intercepted by an outside entity. The perpetrator either eavesdrops on the communication or impersonates one of the two parties, making it appear as a regular exchange of data. A MITM attack targets users of enterprise email accounts, financial applications, and e-commerce websites in order to steal account details, credentials, bank account or credit card numbers and to monitor password changes.

Phishing – The Internet scam known as “phishing” (the “ph” substitution distinguishes the activity from the real “fishing” but the activity is intrinsically the same) is a spam email message that contains a link to what appears to be from a legitimate business, such as your bank, but it is actually a fake website. The email often states that you must update your account information through a bogus link to a phisher’s website and the user, unknowingly, gives out personal information to the fake website.

Pharming – A relatively new Internet scam is “pharming”. Using a virus or malware, the victim’s Internet browser is hijacked without their knowledge. If the address of a legitimate website is typed into the address bar of a browser the virus redirects the victim’s browser to a fake site.  All identifying information, such as bank passwords and credit card numbers, is collected by the scammers who steal the user’s identity.

Vishing – This is similar to “phishing”. However “vishing” scams attempt to trick targets into divulging personal information such as credit card, bank account and social security numbers using new telephone technology. Typically, “vishing” targets will receive a phone call from what appears to be a legitimate business, such as their bank or credit card issuer, and the victim is informed that their account has been compromised. The “visher” usually requests that the caller enter their account or credit card number or even their social security number to secure their account, thereby compromising the victim’s identity.

SMiShing (SMS phishing) – This form of “phishing” specifically targets smartphones. Smishing uses the scammers’ old favorite—phishing, to send out an email to entice their intended victims to click a link that downloads malicious software or virus on the smartphone. As its name implies, smishing comes from “SMS phishing”. A smishing attack goes after the smartphone via text message and usually occurs when a message is received from an unknown number that offers some sort of incentive. It might be telling you about a free offer, a coupon, that there’s something wrong with your account, or even more likely, it might claim that “your friend” has sent you a “greeting card” or message. Unlike viruses of the “old days” that sought to lock up your computer or disable your files, smishing attacks remain hidden and continue to feed information back to the smisher. Information like contacts list, email address books, and passwords are sent to the scammers.

Spear-phishing – Our last method is spear phishing. With this method, the scammer is targeting you specifically instead of just sending out random “shot in the dark” emails that someone might fall for. Spear-phishing is very successful, especially within environments like the university, because scammers pay attention to your internet activity and send you requests that look like the real thing, claiming to be from entities within your own environment. Scammers can pull off spear phishing attempts based on the information you share about yourself, as well as other bad habits such as using the same password for multiple websites. As soon as you post updates to social media, especially about accounts, people you interact with, purchases you’ve made, etc. you’re handing over vital information a scammer can use to target you.

How to protect yourself from identity theft:

  • Don’t give out your personal information on the phone, email or snail mail unless you’ve initiated the contact or unless you are sure it’s safe. And don’t feel guilty about saying No.
  • Never use your pet’s name, children’s name or a nickname as a password.
  • Ask your financial companies about their policies for preventing identity theft.
  • Be VERY careful about answering surveys — and certainly don’t give out any personal information to anyone who calls on the phone or asks via email. If you do answer survey questions, use common sense and don’t give out any information that could be sold or used by identity thieves. In other words “control” the information that you give out.
  • Tell your colleagues, family and friends about the dangers of identity theft. Awareness and sensitisation empower even the most “non-technical” person.

In the next article, we will be providing a bit of information about social engineeringKeep safe out there.

Cybersecurity Awareness Month: Identity thieves’ modus operandi – Part 1

Friday, October 12th, 2018

Identity Theft takes place whenever a criminal gets hold of a piece of your information and uses that information for their own personal gain.

While a lost or stolen wallet, purse or cell phone may simply mean the loss of your cash and credit cards, it may also be the beginning of an identity theft case. The return of the item does not guarantee cards were not copied or that your personal information was not used to commit identity theft.

In the previous article we pointed out 5 low-tech areas in your world where identity theft could take place.

  • Old-fashioned letters (including junk-mail)
  • The trash can
  • Flash disks
  • Your driver’s license or ID Document
  • Household paperwork.

Identity theft isn’t always “high-tech”. It can happen to anyone, even if they don’t have a computer or cell phone or don’t use social media.

Dumpster diving – literally digging through your trash – remains a popular method for stealing large amounts of your personal information. South Africans receive over 1.2 million tons of junk mail every year and much of this mail, such as pre-approved credit cards, credit card bills, and bank statements, includes your personal information. Dumpster-diving identity thieves root through your trash because they know the documents you discard as garbage contain personal identity information they can use in a variety of illegal manners, such as employment-related, loan, bank, benefits and tax fraud.

Mail theft – Mail theft is the number 1 white collar crime in the USA today. Mail theft is defined as anyone taking mail, be it a letter or a package, for any purpose. This includes stealing from post office workers, private mailboxes, collection boxes and even from mail trucks. One of the main motivators in mail theft is to steal a person’s identity and gain access to private information, including bank accounts and credit cards.

Social engineering – Social engineering is the art of manipulating people to give up confidential information. The types of information these criminals are seeking can vary, but when individuals are targeted, the criminals are usually trying to trick you into giving them your passwords or bank information. Criminals use social engineering tactics because it is usually easier to exploit your natural inclination to trust than it is to find ways to hack your software. For example, it is much easier to fool someone into giving you their password than it is for you to try hacking their password. That is why phishing is so successful, often victims willingly give their personal information to the scammers, as they feel they can trust the person asking for the information.

Shoulder surfing – Shoulder surfing occurs when someone watches over your shoulder as you key it into a device such as an ATM or tablet, to steal valuable information, such as your password, ATM PIN, or credit card number. When the shoulder surfer uses your information for his financial gain, it becomes identity theft.

Theft of personal items – When a personal item like a handbag, a wallet or purse, a cell phone, or a laptop is stolen, all the information can potentially be used for identity theft. The value of the stolen items is often not much, and replacement is an inconvenience to many of us. However, your personal information can never be recovered, and is intrinsically more valuable than the stolen item.

What can you do to minimize “low-tech” identity theft?

  • Never give out personal or financial information over the phone or in an email.
  • Password-protect your cell phone.
  • Shred credit card receipts, junk mail and other such documents with sensitive personal or financial information.
  • Be aware of your surroundings at all time.
  • Tilt the screen of your cell phone screen away from the person next to you and don’t work in crowded airplanes, trains, airports, cafes, hotel lobbies and other public spaces.
  • Work with your back to a wall, preventing others from standing behind you and looking over your shoulder.

Next time we will look at the modus operandi of high-tech identity thieves.

 

Cybersecurity Awareness Month: Where do scammers get your information?

Friday, October 12th, 2018

In the last article, we provided you with a few tips on how to create strong passwords in order to make the hacker’s job harder at accessing your personal data. Using weak passwords is one way hackers and scammers get your information?”.

But where do scammers get your information?

The graphic below depicts the world where most of us find ourselves, and where scammers might obtain important snippets of our personal data that, in many cases, is there for the taking:

This is your world

Your personal information is in places beyond your control.

The cell phone has become an indispensable communications tool in the 21st century. According to the Pew Research Centre, South Africa is placed 24th on the world list with a smartphone usage of 37% of the total population. However, according to a recent global survey by McAfee and One Poll, 36% of those smartphone users have no form or password, pin or fingerprint protection on their devices. This means that if their phone falls into the wrong hands, they risk opening up all sorts of personal information such as bank details and online logins to whoever finds or steals the smartphone.

How much of your personal information have you placed out there on the internet?

  • Over 30% of South African Internet users share at least 3 pieces of personal information posted on their social media profiles that can make stealing their identity easy.
  • 60% of South African Internet users have revealed they had no idea what their privacy settings are and who could see their personal information on those sites.

Old-style junk mail, invoices, receipts and ordinary letters can still provide scammers with a wealth of information. Dumpster-diving can reveal documents with your ID Number, old bank statements with your account details, old credit cards, unwanted junk e-mail, payslips and tax forms. Even old prescriptions & medical aid claims can provide scammer with a wealth of information from your personal information.

The modern equivalent of a filing cabinet, a flash disk poses a huge risk to the security of your personal data. Flash disks are small and cheap and can often be forgotten plugged into computers, fall out of pockets and be stolen, providing scammers with all the data stored on that device.

Your bank, your employers and SARS all store and work with your personal information. You have placed a tremendous amount of trust in these organizations to keep your personal data safe. How many people at your bank, for instance, have access to your personal data, who can they potentially give that data to?

Your driver’s license has a lot of information on it, including fingerprints, date of birth and ID number. The new style “smart” licenses will hold even more information, and if the license gets into the wrong hands it can be used for identity theft. For instance, in order to open up a cell phone contract, you would need an ID document or driver’s license, bank account details and proof of address, almost all of which can be obtained by dumpster-diving or someone rifling through your paperwork.

Finally, your computer (at work or at home) or your laptop holds a huge amount of your personal information. If stolen, the hard-drives can easily be trawled for personal information. If there is no password or a weak password on the laptop it makes stealing this information much easier.

This is your world:

  • Since 2007, more money has been made from trafficking financial data acquired by identity theft, than money made from drug trafficking.
  • 8.8 million South Africans were victims of identity theft in 2015.
  • 1 in 3 South Africans do not have a password on their cellphones or computer.
  • 70% of South Africans change their passwords after being compromised. (So 30% of South Africans don’t do anything even after they have been compromised)
  • 1 in 3 South Africans admits sharing passwords with other people.

There are 4 areas where we all neglect the security of our personal information:

  1. IndifferenceLack of Feeling
  2. IgnoranceLack of Knowledge
  3. InabilityLack of Training or Education
  4. InactionLack of Respect

What can you do to improve your personal data security and to prevent identity theft?

When someone comes and knocks on your front door, do you just open the door and let them in? No, you check who it is and then you decide if you want to open your door to them or not. The power of access is in your hands because you control the door.

The same principle applies to your personal data. Be careful and vigilant and be the gatekeeper of your personal data! Control what data is given out and who receives it. You have the control!

Next time we will look at the modus operandi of identity thieves. 

 

Cybersecurity Awareness Month: Common passwords

Wednesday, October 3rd, 2018

The past two years have been particularly devastating for data security worldwide, with a number of well-publicised hacks, data breaches and extortion attempts.

Annually SplashData publishes a list of the most common passwords. The list is created using data from more than five million passwords that were leaked by hackers in 2018 and with a quick glance at the list, one thing is clear – we do not learn from our mistakes.

People continue to use easy-to-guess passwords to protect their information. For example, “123456” and “password” retain their top two spots on the list—for the fifth consecutive year and variations of these two “worst passwords” make up six of the remaining passwords on the list.

SplashData estimates almost 10% of people have used at least one of the 25 worst passwords on this year’s list, and nearly 3% of people have used the worst password – 123456.

Here is the list of the top 10 passwords of 2018:

  1. 123456
  2. password
  3. 12345678
  4. qwerty
  5. 12345
  6. 123456789
  7. letmein
  8. 1234567
  9. football
  10. iloveyou

Another typical example is 1q2w3e4r5t.  Although it seems very cryptic, one look at a computer keyboard and it’s easy to guess.

Not so clever passsword

It is a sobering fact that most people still underestimate the importance of having a secure password, and still make mistake to use simple words or numbers as a password.

“Passwords are the only control you have to secure your data with most systems these days. If your password is easily guessed by someone, then the person essentially becomes you. Use the same password across services and devices, and they can take over your digital identity.” Shaun Murphy, CEO of SNDR.

In the next post of our Cyber Aware Month series, we look at how to create a strong password you can remember.

 

 

© 2013-2025 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.