Robert Siciliano, a McAfee security expert, explains how the Boston Police email hack likely used SQL injection, a common web vulnerability. He recommends strong unique passwords, avoiding obvious security-question answers, and keeping software and antivirus updated to protect yourself.
Chapters
Alright, thank you, Cindy. Boston Police learning the hard way that computer hacking is real and can happen to anyone. Just this last week, a group unhappy with recent Occupy Boston arrests hacked into the Boston Police officers' email accounts. Now, just how easy is it to do this, and what can we do to protect ourselves? We're joined this morning from our Beacon Hill studio by Robert Siciliano. He's a McAfee consultant and an identity theft expert. Good to see you this morning, Robert.
Good morning.
Are you surprised that the police could be hacked into?
Anybody can be hacked. Any website that has vulnerabilities on it can be hacked as long as the bad guys have the right technology behind them.
Now you've just taken the words out of my mouth. What are the vulnerabilities out there?
You know, there are numerous. In this particular hack, it's believed that it was what's called a SQL injection, which is a technology that's readily available on many websites and is subject to vulnerabilities again, and once the bad guys use certain tools to scan the nature of that website, the technology behind it, they inject a certain code on there, and when they do that, it makes it easy to gather personal information on those who enlist on that website.
Okay, so let's talk about our personal accounts. It seems to me oftentimes things that are hacked into are great big things like maybe credit card companies or the police department, but is my personal account vulnerable as well?
You know, for the individual, somebody watching today, you know, regular citizens and consumers, the most important thing is to make sure that your usernames and passwords are ones that aren't easily guessed. For example, you want to have passwords that have numbers and letters, uppercase, lowercase characters, so they can't be easily cracked. You want to make sure that you're using a different password for each site. For example, these police officers, if they're using the same password for their email address as they are for their Facebook account and other sites, then it makes them that much more vulnerable to be— to being hacked in other ways.
Sure. You'll remember that recently there were some Hollywood starlets who had some of their accounts hacked into and some of their pictures stolen, that kind of thing. And it turns out they were using like their dogs' names or their maiden names, that kind of thing. So I guess you would say don't use those, don't do that.
Yeah, if you have information on Facebook, let's say, that can be used to reset your password on other accounts, because we use qualifying or knowledge-based questions, if that information can be found online to reset a password, that's a problem.
And Robert, what about tracing these people down? Is it possible?
Well, this particular hacker, they say, was coming from Britain. Uh, the group itself, uh, they are what's called hacktivists, whereas when you merge hackers and activism, you have hacktivists. Uh, and, uh, they are difficult to catch but not impossible, because some of them have been caught.
Now, Boston police were obviously vulnerable. Are there other, you know, very important, let's say, with very secure information that would be vulnerable? I mean, is everybody vulnerable, really?
Well, police across the country are being hacked. Police organizations, associations are being targeted by these hacks. And it's unfortunate that law enforcement is being taken down in this way because, you know, they're there to protect us and they're victims as well. And as individuals, again, as long as you are doing, you know, taking care of your responsibilities, is using secure passwords, you know, we're all vulnerable at some point. As long as you're updating your antivirus, as long as you're making sure that your PCs have secure patches, as long as your wireless connection is a relatively secure one, generally consumers should be in pretty good shape.
All right, Robert Siciliano, thank you very much. It makes you a little nervous, but hopefully we can try to ward them off by changing passwords and being smart. Good to see you this morning.
Thank you.
All right, it is now 7:50. We have to take a break, everyone. Lots more still coming your way here on the Fox 25 Morning News.
