Adam Penenberg of PandoDaily decided to find out how easy it would be to hack him, and invited professional penetration testers — who typically target banks, hospitals, and corporations — to find security holes. It turned out that the hack, while ultimately successful, was quite difficult. But not impossible.
The professionals were from the SpiderLabs Trustwave and attempted to penetrate Penenberg's system. Below, the journalist describes what he learned:
Don’t pick up strange USB drives and plug them into your computer. One of the hackers’ friends walked by the yoga studio where Penenberg’s wife was doing and left a purple USB stick containing a Trojan horse in the hopes that she would pick it up and plug it into her computer. The attempt failed, but the hackers’ friend came back asking to plug in another USB to print out a resume. This time the Trojan managed to get into the system. However, the Apple computer was so old that the malware couldn’t run.
Don’t name your Wi-Fi in a way that reveals that it’s yours. If your Wi-Fi name is your house address and apartment number, or your full name, change it immediately. My favorites are “FBI Surveillance Van” or “Whatever else you want” other than a name that states your details. If you declare them, it's like provoking everyone to "here I am, hit me." The SpiderLabs team circled around Penenberg's apartment building trying to locate his apartment. It didn't work.
Don't download strange file attachments from strangers (or from people you know if their email looks suspicious.) The SpiderLabs team hit Penenberg twice with emails that appeared to come from journalism students. The emails looked perfectly legitimate and included their resumes as attachments. Penenberg recognized the scam, and didn't download it. His wife didn't get it, though. She downloaded the .Jar file first and then a .Zip file, which is how she got the malware onto her computer.
Don't keep tax records, password lists, or other sensitive files that you don't want hackers to get on your computer. These are files that should be kept on a password-protected computer that is not connected to the Internet. Once the hackers gained access to Penenberg's wife's computer, they were able to get the password for her home router, her bank account passwords, and the passwords for several of Penenberg's online services, including Amazon. In other words, they had hit the jackpot.
Clear your cookies every time you close your browser, especially if you've asked hackers to hack your system. Penenbergs used two-factor authentication for his bank account. So every time he logged in, the bank would ask for confirmation of his identity (if the login was from a computer that had never been logged in before) via a code sent to his mobile phone. The SpiderLabs team was able to bypass the process by stealing the bank's cookies from the hacked computer. When they transferred them to the attacker’s computer, the bank recognized it as a “trusted” computer and didn’t ask for phone confirmation. So the hackers took control of all his assets. “They could, if they wanted to, wipe us out financially.”
This is tough, but…. try not to use a system for your passwords, it’s something that makes it easy for someone to figure out everyone else. Penenberg had such a system and once the hackers saw some of his passwords, they were able to guess his Apple, Facebook and Twitter passwords. The hackers locked his iPhone and Apple laptop. The SpiderLabs team also ordered 100 plastic spiders from Amazon and had them shipped to Penenberg’s home.
Forbes PS “The main lesson from this article seems to be: don’t marry or date a journalist. His wife was the biggest victim. “I didn’t know hackers were targeting my family until they were already there. Promise me you’ll never do that again,” he told Penenberg when he found out.
