Top 5 Tips to NOT Get Hacked Online

Update: WashingtonPost blogger Brian Krebs agrees with me on #1. "My advice: If you or someone you care about is in the habit of cruising the Web with IE, now would be a very good time to get acquainted with another browser that doesn't use IE's rendering engine, such as Firefox or Opera." Porn websites are exploiting IE 6 0-day vulnerabilities.

“Oh my God, I’m never doing anything on-line again!,” is a common reaction to one of my web application hacking presentations. Recently I’ve been demonstrating how easily the average website or user can be hacked. No doubt scaring audiences has a certain mass appeal and gets people to pay attention to why the right security practices are of vital importance. People frequently ask if I still bank or shop online (of course I do), or how they can protect themselves when they do. For those who are not experts in computer security, here are my top 5 tips to a safer online experience (in addition to having firewalls, anti-virus, and patching diligently).

1) Switch your web browsers to Firefox, Mozilla, Safari, or anything else besides Internet Explorer
This is probably the single most important thing you can do to protect yourself online. I’ve mentioned before that I’m a fan of staying secure by staying out of the line of fire. Internet Explorer is well known for being in the crosshairs of viruses, spyware, and adware. I know I know, Microsoft is releasing the highly anticipated version 7, supposedly a security light-year ahead of everything else. A web browser so revolutionary it’s being pushed as a mandatory upgrade! Talk about an attractive target for malicious hackers. In my view it’s best to use an alternate product and remain out of the fray. If a website REALLY does need IE and you REALLY need to use the website, make sure the website is legit, then it’s reasonably safe to fire up IE.

2) Add more security to your web browser
No matter what browser you choose, the Web is a hostile place and they all need a little help to defend themselves. NoScript (Firefox extension), Netcraft Anti-Phishing Toolbar, E-Bay Toolbar, and Google Toolbar are great products that do just that. These add-ons help identify phishing websites, prevent your computer from being hacked, and passwords from falling into the wrong hands. Most people will only need the first two add-ons, but if you are an E-Bay buyer, using theirs is essential is well.

3) Don’t click on links in email, almost ever
Whenever possible try NOT to click on any links in email, especially since links are themselves are dangerous and phishing emails are difficult to spot. An ounce of paranoia is worth a pound of patches. If I’m unsure if an email is real, one thing I do is manually type the domain name into the web browser location bar. This way I know I’m on the real website. If Wells Fargo were to ask to verify my account information by “clicking here”, instead I type in wellsfargo.com then proceed to login. If Wells Fargo, or whatever the organization your doing business with, really wanted to verify the account information they would have asked at that point. Some email links are safer to click on than others. Like those sent in response to an action (account registration, password reset, order confirmation, etc) you might have performed on the website within the last several minutes.

4) Defend your Web Mail!
Hundred of millions of people use Web Mail, which in many ways email is more important to keep secure than your bank account. Many people have important online accounts tied to a single Web Mail address. If anyone gained access to your email account, all accounts associated to could be compromised as well. The best thing you can do is use unguessable passwords, change them ever six months or so, and don’t use that password anywhere else. Bonus points for deleting emails with any sensitive information.

5) Use a single credit card for online purchases
In light of recent events, chances are the CC #’s we use online are going to be stolen at some point. For that reason it’s best to try and limit any potential damage. Using a single credit card with just enough of a limit to conduct your online transactions makes it easier to monitor statements for any strange charges. Plus, any fraud is isolated to that one card. Also, refrain from using a debit card online since they don’t carry the consumer legal protections as credit cards.

Normally this is the part where the experts start talking about SSL and tells you to check for the lock symbol. In my experience just about every legit website accepting credit cards is now SSL-enabled. So the better advice is to make sure your actually on the legit website you think you are on. Otherwise SSL isn’t going to matter much anyway.