In this era of technology, everyone is vulnerable to cybercriminals or hackers and getting your data leak. Though everyone doesn’t experience equal threat but we are all at risk
The average people actually face fewer threats than influential people like a senior politician, activist, or CEO. They are targeted most with hackers to steal secrets from corporate networks, institutions and steal money.
Many people think that they are not susceptible to cyberattacks, but the truth is that even intelligent, self-aware people get caught up in online scams that can have very damaging consequences, financially or socially.
Understanding the threats is important. Everyone has their own threat model that includes things that matter most to them. what’s important to you may not be equally important to someone else. But there’s value to everything you do online, from Facebook and Netflix to online banking and shopping. If one of your accounts is compromised, stolen login information or financial details can be used across the web.
Though Facebook, Twitter, Instagram, and other social networks might not contain your credit card details, there are other types of risks. Hacked social media accounts can be used to post compromising messages that could embarrass or defame somebody, be used for harassment, or build up a picture of who you are and everyone you know.
To know if you have been hacked can be a complicated task. Sometimes you know it when you lose control of your precious accounts, but like anything, it is better to be proactive and stop it from happening in the future.
In this article, we reviewed some signs that can show you if you have hacked and what you can do next.
Your internet searches are redirected
Many hackers make their living by redirecting your browser somewhere you don’t want to go. The hacker gets paid by getting your clicks to appear on someone else’s website. They often don’t know that the clicks to their site are from malicious redirection.
You can often spot this type of malware by typing a few related, very common words (for example, “puppy” or “goldfish”) into Internet search engines and checking to see whether the same websites appear in the results, almost always with no relevance to your terms. Unfortunately, many of today’s redirected Internet searches are well hidden from the user through the use of additional proxies, so the bogus results are never returned to alert the user.
In general, if you have bogus toolbar programs, you’re also being redirected. Technical users who really want to confirm can sniff their own browser or network traffic. The traffic sent and returned will always be distinctly different on a compromised computer vs. an uncompromised computer.
Action to be taken: Follow the same instructions for removing bogus toolbars and programs. If you are using a Windows computer, go to your C:\Windows\System32\drivers\etc\hosts file to see if there are any malicious-looking redirections configured within. The host’s file tells your PC where to go when a particular URL is typed in. It’s hardly used anymore. If the file stamp on the host files is anything recent, then it might be maliciously modified. In most cases, you can simply rename or delete it without causing a problem.
Unwanted and unexpected software installs are a big sign that your computer has been hacked. In the early days of malware, most programs were computer viruses that work by modifying other legitimate programs. Most malware programs these days are Trojans, worms, and they typically install themselves like legitimate programs. This may be because their creators are trying to walk a very thin line when the courts catch up to them. They usually claim to be a legitimate software company.”
The unwanted software is often legally installed by other programs, so read your license agreements. Frequently, I’ll read license agreements that plainly state that they will be installing one or more other programs. Sometimes you can opt-out of these other installed programs; sometimes you can’t.
Action to be taken: There are many programs that can show you all your installed programs and let you selectively disable them. If you are using Windows PC try Autoruns or process explorer. They might not show you every program installed but they will tell you the ones that automatically start themselves when your PC is restarted (Autoruns) or the ones currently running (Process Explorer).
Most malware programs will be found embedded in the much larger list of legitimate running programs. The hard part can be determining what is and what isn’t legitimate. You can enable the “Check VirusTotal.com” options, and the programs, along with Google’s Virustotal.com website, will tell you which ones it thinks are malware. When in doubt, disable the unrecognized program, reboot the PC, and re-enable the program only if some needed functionality is no longer working.
Antimalware, Task Manager, or Registry Editor is disabled
This is a huge sign of malicious compromise. If you notice that your antivirus software is disabled and you didn’t do it, you’re probably exploited especially if you try to start Task Manager or Registry Editor and they won’t start, start and disappear, or start in a reduced state.
Action to be taken: if this happens to you, do a complete restore. if on a Windows computer, try running Microsoft Autoruns or Process Explorer (or similar programs) to root out the malicious program causing the problems. They will usually identify your problem program, which you can then uninstall or delete.
If the malware “fights back” and is not easily uninstall, research the many methods on how to restore the loss then restart your computer in Safe Mode and start the hard work. Precede restoring your software by getting rid of the malware program using the methods listed above.
Confidential data has been leaked
Nothing confirms you’ve been hacked like your organization’s confidential data sitting out on the internet. If you didn’t notice it first, then likely the media and other interested stakeholders will be contacting your organization to confirm or find out what you are doing about it.
Action to be taken: First, find out if it’s true that it is really your confidential data out there. In more than a few cases, hackers have claimed to compromise a company’s data but didn’t have anything confidential. Either they made up the claim and data, only had publicly available data, or they had some other company’s data. So, first confirm.
If it is your organization’s confidential data, it’s time to tell senior management, begin the IR process, and figure out what needs to be communicated to whom by when. In many countries and states, the legal requirement to report compromised customer data can be as short as 72 hours, and many times you won’t even be able to confirm the leak or how it happened in 72 hours. It goes without saying that you need to get legal involved.
Your credentials are in a password dump
Literally billions of valid log-on credentials are on the internet and dark web. They have usually been compromised by phishing, malware, or website database breaches. You will not usually be notified by third parties as is the case with other types of data leaks. You have to proactively lookout for this sort of threat. The sooner you know this sort of thing has happened the better.
You can check for compromised credentials one at a time using various websites (like Have I Been Pwned), check across multiple accounts using various free open source intelligence tools (like The Harvester), free commercial tools (like KnowBe4’s Password Exposure Test), or any of the commercial services that look for your company’s data and credentials all the time for a fee.
Action to be taken: After first confirming whether the dump contains any currently used credentials, reset all your log-on credentials. Start an IR process to see if you can figure out how your organization’s logon credentials ended up outside the company. Also, implement MFA.
Your online password isn’t working
If you are typing in your online password correctly, for sure, and it isn’t working, then you might be hacked. You can try again in 10 to 30 minutes, because I’ve had sites experiencing technical difficulties not accept my valid password for a short period of time. Once you know for sure that your current password is no longer working, it’s likely that hacker has logged in using your password and changed it to keep you out.
What usually happens in this scenario is that the victim responded to an authentic-looking phishing email that purportedly claimed to be from the service. The bad guy uses it to collect the log-on information, logs on, change the password, and uses the service to steal money from the victim or the victim’s acquaintances.
Action to be taken: If the scam is widespread and many of your acquaintances have been contacted, immediately notify all your close contacts about your compromised account. This will minimize the damage being done to others by your mistake. Second, contact the online service to report the compromised account. Most online services now have easy methods or email contact addresses to report compromised accounts. If you report your account as compromised, usually the service will do the rest to help you restore your legitimate access. Also, consider enacting MFA.
If the compromised logon information is used on other websites, immediately change those passwords. Websites rarely send emails asking you to provide your logon information. When in doubt, go to the website directly not the link sent on email and see if the same information is being requested when you log on using the legitimate method. You can also call the service via its phone line or email them to report the received phishing email or to confirm its validity.
