Embedded Files
GENERAL KNOWLEDGE /
1. PERSONALLY IDENTIFIABLE INFORMATION (PII)
Personally Identifiable Information (PII): all data which are connected to the person and carry private information, through such data the person is identifiable.
If PII is hold by not authorized people:
exposing privacy, tracking, stalking
bullying, mental attacking
scamming, stealing, robbery
will be possible.
One form of the third:
stealing identity
Through such act it is possible to
get access to bank accounts
buying expensive things
having any unlawful activities covered by the held identity
Identification types:
direct: immediate leverage to identify the person
indirect: through other means it can lead to identification
Natural identification data (three of these together identify the person directly):
name
birthday
birth place
name of mother/father (depending on the given country's administrative system)
PII are (D - direct, I - indirect):
natural identification data (D)
ID card, passport, VISA, driving licence data (D)
social security number (SSN), tax ID number, insurance data (D)
biometrics (fingerprint, facial data) (D)
bank account access, bank card (credit/debit) data (D)
age, race (I)
medical data (I)
contact data (email, phone, postal address, location, timestamp) (I)
IP address, Mac address (D/I)
Data breach: PII is stolen from a company keeping (a huge set of) PII.
In a given country, rules can be or already are in place to regulate how PII can be collected, stored and handled in order to prevent PII data breaches and misuse:
US: Health Insurance Portability and Accountability Act (HIPAA), Children's Online Privacy Protection Act (COPPA)
EU: General Data Protection Regulation (GDPR)
The owner of PII should be the person, and should check what they share with companies, on social sites or with third parties. Also, prevention of leaks is important.
2. TRACKING
2.1. WEB COOKIES
Websites often use cookies to track user actions on their site and across other sites (user history) to improve their services.
HTTP cookie: a small amount of text in a file that helps a website track information about a user across multiple pages of the website and personalize the user's experience on the website.
A cookie is attached to the user. Directly sharing it gives the chance to the receiver party to act in behalf of the original user.
FIGURE OF HTTP COOKIE PROCESS:
Cookie-types:
first-party cookie: the visited server sends it back, associated with the original server domain and path the request was aimed for.
third-party cookie: if the response contains sources from other servers too (e.g. images), the original server will send cookies from the other servers as well.
Most third-party cookies are used for advertising and connect the user to services which are present in other websites or sources (e.g. user visits a food on a cooking website, and upon jumping a social site, will receive food or connected advertisements or posts.
Most browsers let the user delete third-party cookies or ask for privacy (the browser will not let third-party cookies to be stored at all, or maybe just the ones may be connected to the actual session).
2.2. SENSITIVE DATA IN DATABASES
Search engines like Google or Bing, may store the search phrase, the timestamp, the IP address, the browser/OS data, and maybe the first clicked URL from the search list in a database per received queries. Based on a series of search phrases, it is possible to build a profile about the user's habits, interests, matters, also if an PII data is sent within the phrase once, the PII will be stored in the database infinitely. The search history can also include a cookie with user ID in case the user used the service logged-in.
Such data can be used for personalization of the search results, sorting the results or hiding some results if the provider thinks they are unimportant. Also, the providers usually show advertisements among the search results, personalized if possible.
There are alternative search engine providers which does not collect data except for spelling corrections.
2.3. BROWSING HISTORY, VPN, TOR
Browsing history can be collected by websites, browsers, ISPs, and the government.
A website can track activities (visited websites, time spending there etc.) with 3rd party cookies as long as each site loads the cookie from the same domain. Most browsers offer disabling tracking in their settings, default can be allowing and disallowing as well. Browser history can be cleaned as well, either upon closing the application automatically or manually. Usually, there is a private or incognito mode in browsers which means the browser will not keep browsing history at all in that session.
The Internet Service Provider (ISP) can track all HTTP requests via the entry rooters of a subnet (these rooters are connected directly to the internet provider's service). This information can be used for finding illegal activities.
The government also can have access to the rooter in case the rooter has pre-installed such tracking function before reaching the end-user, asked by the government which controls the local market. The government can use tracking for filtering out malicious or dangerous activities. Such function might limit the privatcy and the freedom of speech.
An option against such tracking is VPN (Virtual Private Network): the computer sends a packet of encrypted data with a destination of the VPN server to the ISP. The VPN server decrypts the data, finds out where the user actually wants to send the packet, and then forwards the packet to that destination. The VPN server knows the user's browsing history, but the ISP does not. Plus, other routers after the VPN will only see that the packet came from the VPN IP address, not from the user's IP address. Using VPN decreases browsing speed.
Other option is Tor: open source program for anonymizing internet traffic; the computer sends an encrypted packet through a large number of volunteer relays. The data is packaged such that each relay only knows where it came from and where it's going, and no relay knows both the sender IP address and the destination IP address. It severely slows down the browsing experience.
Final option is lobbying at the government to reduce governmental and ISP tracking, also to limit tracking of the websites.
2.4. GEOLOCATION
Geolocation: approximate latitude and longitude describing the geographic location of the user's device.
GPS: getting location by satellite system, named after the GPS system of the US. A smartphone can typically record a geolocation that is accurate to within 4.9 m (16 feet) in open sky. GPS doesn't work as well indoors or near buildings due to the interference caused by roofs, walls, and other objects, but it is still the most precise source of geolocation data.
Wi-Fi: works well in dense, urban areas filled with Wi-Fi networks. The device measures signal strength of seen hotspots. In case the Wifi positions are known, the device can have location data by trilateration.
Wi-Fi with fingerprinting: reference points (hotspots) are installed with known exact locations and an ID codes called fingerprints (fingerprint map), a fingerprint server knows the map, the device measures the signal strengths and collects the fingerprints, then communicates with the fingerprint server which calculates the exact location of the device. Perfect results indoors with a dense fungerprint map.
Cell tower trilateration: the cell tower can estimate the distance between the tower and a phone by measuring the round-trip delivery time and signal strength. The more cells are seen, the more the location is correct.
IP-based geolocation: whenever a device sends data over the internet, it also sends along an IP address. Geolocation databases map IP addresses to locations. If a device is connected to a network which has geo-registered entry point (e.g. the main rooter of a region or an ISP or a LAN subnet), the approximate location can be determined. Using VPN or Tor makes it unreliable.
Request access: the browser has a built-in geolocation API to which a website can ask permission to access. Same happens in case of mobile app when the OS must give permission to the access.
The IP-based geolocation in independent from permissions, given approximate location to websites etc.
An app can ask geolocation directly from the user via an input field, e.g. a postal/zip code.
Websites also can get location data from metadata of uploaded photos.
Personal geolocation is considered as private data.
3. ATTACKS
3.1. PHISHING
A phishing attack is an attempt to trick a user into divulging their private information.
Typically starts with an email or SMS that claims to be from a legitimate website, like a banking website or online store. It either asks the recipient to reply with personal information or it links to a website that looks remarkably like the original site.
The aimed data can be user login data or personal data.
Signs:
suspicious email address
suspicious URL
asking for sensitive data instead of inviting the user to a physical bank office or valid account page
creates the sense of urgency or loss (scare), sometimes promises winning prices
the website uses http:// instead of https:// for publishing the form for entering sensitive data (now most hackers spend extra time for getting a HTTPS protocol running for having higher success rate)
language errors (hackers started to use AIs to handle these signs)
Misleading technics:
misspellings in original URL or company name (goggle vs. google)
exchanging zero with uppercase O (G00GLE.COM vs. GOOGLE.COM)
similar-looking characters from different alphabets (wikipediα.org/wikipediа.org vs. wikipedia.org: greek alpha/cyrillic a vs. latin a)
subdomains that look like the domain name (paypal.accounts.com or paypal--accounts.com vs. accounts.paypal.com, revolut.mail.com vs. mail.revolut.com; revolut@mail.com)
different top level domain (TLD; paypal.io vs. paypal.com, who.org.at vs. who.org)
different reference behind label of the link ("Visit <a href="physhing_site.some">www.paypal.com</a> to change your password.")
If a hacker page asks for password, even for a new password, the aim can be to use both passwords for entering into multiple websites e.g. known banks, social sites, mail services. This is called "stuffing".
Best protection is to install white-list/black list managers, fresh spam filters, and using the pure logic before instinct.
3.2. SPEAR PHISHING
Instead of sending a similar email to many users, a spear phisher will research a user and send an email specifically targeting them. Often target people within a organization, with the goal of gaining access to the organization's data.
Such emails can be seen as legit but the sender's or reply email address, the links inside the letter body, or attached file name is fake or malicious.
Best protection is to install white-list/black list managers, fresh spam filters, and using the pure logic before instinct.
3.3. ROGUE ACCESS POINTS
Access points (hotspots) connect to the internet via a wired connection but share the internet via Wi-Fi (radio waves) making wireless connections. Typical device is the rooter with antennas.
A rogue access point is an access point installed on a network without the network owner’s permission. If an attacker owns the access point, they can intercept the data (e.g. PII) flowing through the network:
passive interception: reads the sensitive data but does not manipulate it (typical for getting login data to valuable sites, or internet footprint for profiling)
active interception: they read the incoming data, modifies them, and sends them to destination endpoints (e.g. the user wants to transfer money, the hacker rewrites the recipient)
The rogue access points are usually free to access (no password protection) for having the most potential victims. Also, the hotspot name can be a doppleganger of a valid service, or something which creates trust in users.
With a rogue access point, the MITM (man-in-the-middle) attack can started.
The best protection is to prevent connecting to free Wi-Fi spots, or if we have to, not to send sensitive data through such connection, use multi-factor authentication for logging in, or to use VPN therefore the hacker can not decode the data flow to read or modify. Also, notify the owner of the hotspot about suspicion.
3.4. MALWARE
Malware: a malicious software that's unknowingly installed onto a computer.
Types by infection:
trojan horse: a harmful program that masquerades as a legitimate program, and is often downloaded onto computers by unknowing users; once the user runs the program, it can start inflicting its damage
virus: self-replicating, it contains code that copies itself into other files on the system; viruses may hide in the code of a legitimate program
worm: self-replicating, it copies itself into entirely different computers within the network, can travel along networked protocols such as email, file sharing, or instant messaging; many worms don't take any harmful action besides replicate themselves but decrease bandwidth
hybrid: utilizes more types in one
Types by effect:
spyware: steals data and sends it back to the malware creators (e.g. keyloggers: monitor everything a user types, including login data)
adware: pops up advertisements to users, earns money for the malware creators or urges users to download other forms of malware
ransomware: holds a computer hostage by encrypting user data or blocking access to applications, demands the user pay a ransom to the anonymous malware creators
cryptominer: utilizes a computer's resources to mine for cryptocurrency, earns cryptocurrency for the creator without needing to spend money on powering their own computers
Protection:
security patch: an update to the code of an application or the entire operating system, and often fixes a bug that's been exploited by malware
firewall: monitors incoming and outgoing network traffic, determines what traffic to allow, detects automatically suspicious traffic
antivirus software: constantly scanning files and identifying malware, tries to remove identified malware or to heal infected files
Google Sites
Report abuse