NSA shares seven steps iPhone and Android users MUST take to protect from secret smartphone hacks
How does rebooting a smartphone regularly help in protecting against cyberattacks, and what percentage of smartphone users rarely or never reboot their phones?
Rebooting a smartphone regularly helps in protecting against cyberattacks by preventing zero-click exploits and spear-phishing. If users don't reboot the system, a hacker can manipulate open URLs to run a code that installs malware onto the device. Turning the phone off resets all open web pages and apps and logs out of bank accounts to prevent cybercriminals from accessing sensitive information. This has the same effect on spear-phishing attacks because it removes a hacker's ability to send targeted fraudulent emails since they won't be able to access your personal information.
A 2015 Pew Research study found that nearly half of all smartphone owners rarely or never turned their cell phone off, while 82 percent said they never or rarely rebooted their phone.
What social engineering tactics do hackers use to deceive users into compromising their personal information, according to the article?
According to the article, hackers use several social engineering tactics to deceive users into compromising their personal information. Some of these tactics include:
-
Phishing: Attackers send fraudulent emails or messages that appear to be from reputable sources, tricking individuals into revealing sensitive information like passwords and credit card numbers.
-
Whaling: A targeted phishing scam that focuses on high-profile individuals such as CEOs and CFOs.
-
Baiting: Scammers make false promises to users in order to lure them into revealing personal information or installing malware on their system5. This can be in the form of tempting ads or online promotions5.
-
Diversion theft: This involves tricking the user into sending sensitive information to the wrong recipient.
-
Business Email Compromise (BEC): The attacker poses as a trustworthy executive who is authorized to deal with financial matters within the organization. They create a fake email account and send a request for money transfers or changes in banking details.
-
Smishing / SMS-phishing: A social engineering attack conducted specifically through SMS messages. The attacker attempts to lure the user into clicking on a link which directs them to a malicious site.
-
Quid pro quo: The attacker requests sensitive information from the victim in exchange for a desirable service. For example, posing as an IT support technician and calling a computer user to address a common IT issue.
-
Pretexting: This involves composing plausible scenarios that convince victims to share valuable and sensitive data. Pretexters may impersonate someone in a position of authority or a person of interest.
-
Honeytrap: A social engineering technique that specifically targets individuals looking for love on online dating websites or social media. The criminal creates a fake online profile and, over time, tricks the victim into giving them money or sensitive information.
-
Tailgating/Piggybacking: A physical breach where an attacker gains access to a physical facility by asking the person entering ahead of them to hold the door or grant them access. The attacker may impersonate a delivery driver or other plausible identity to increase their chances.
These tactics rely on the psychological manipulation of human behavior to disclose sensitive data, share credentials, or compromise digital security.
What specific vulnerabilities do cybercriminals exploit to access personal data on smartphones as mentioned by the NSA?
The NSA has mentioned several specific vulnerabilities that cybercriminals exploit to access personal data on smartphones. These include:
-
Outdated software and apps: Hackers find secret ways to break into phones by looking for loopholes in the existing software. With each update, companies remove any potential flaws that hackers might have used to break into your phone.
-
Unofficial app stores: Hackers often create fake versions of legitimate apps that give them full access to your device once downloaded. They can then install malware on your device and share your data with third parties.
-
Public WiFi networks: Hackers can set up WiFi networks that appear similar to the one you want to use, and once you're connected, they can steal your identity and pull data from anything you might type online.
-
Unencrypted communication apps: Without encryption, hackers can access your personal information more easily. Encrypted voice, text, and data apps can block hackers from accessing your personal information by converting your communication into a code.
-
Opening unknown email attachments and links: Hackers can access your personal information by keylogging or using a Trojan malware. Keylogging works like a stalker following your every move, allowing them to access information in real-time as you type or surf the web and other apps. Trojan is an invisible malware used to extract important data, including credit card account details and your social security information if it's saved on your phone.
-
Zero-click exploits: These are one of the most dangerous types of attacks because the user doesn't need to click on a malicious link or download a compromised file for their data to be targeted.
-
Uncovered microphones and cameras: Hackers can turn the mobile camera on and off and save media from your camera roll if they gain access to your phone. They can also listen to your conversations through apps or an external cyberattack.
To protect your smartphone from these vulnerabilities, the NSA recommends updating your software and apps, only installing apps from official stores, turning off WiFi and Bluetooth when not in use, using encrypted communication apps, not clicking on unknown links or attachments, rebooting your device weekly, and using a mic-drowning case and covering the camera.