presentation on online scams in cybercrime and i've got about an hour we're starting right on time which is great i really want to spend at least half the amount half the time here talking about stuff you can do to protect yourself rather than talking about the problems but i do want to talk about the problems and then how you're going to how you're going to fix them so i'm really going to be i may need to rush through some of the some of the early slides so i make sure that i leave enough by quarter till be focused on prevention and tools that are available for you out there and those types of things and if you have questions you can hear me really if you have end and if it's not germane to the conversation or we're going down some cyber rabbit hole i'll let you know and refocus ok are going to start talking about going to give a quick overview of the types of cyber crime i'll talk about who i am we're going to talk about as i said threats and scams what's out there the bad stuff that's happening and then protecting yourself and i really want the emphasis to be on protecting yourself because this is something ok who am i this is the least important part of the entire talk but just if you don't know me already my name is paul roberts i am a belmont resident for eleven years i have three kids who are now fifteen fourteen and  or a committee sorry that that advises the board of selectmen on technology stuff i write a blog called blogging belmont and i'm on the board at the foundation for belmont education where i talk i'm working on their technology programs as well professionally i've been in the technology industry for twenty four years basically since i got out of graduate school mostly doing technology related communications training technical writing marketing and then for the last fourteen years i've actually been a technology journalist and reporter and writing about cyber crime so i've been covering the cyber crime beat since the early to thousands seen it changed tremendously during that time and i write about it all the time every single day so i'm up on stuff my blog is security ledger dot com i started it four years ago to focus on cybersecurity in particular cybersecurity and the internet of things which four years ago not many people were writing about now it's a very big topic i'm a contributing writer reporter for the christian science monitor they have a site called pass code that focuses on cybersecurity and computers let's just say computers on a daily basis could be email could be shopping could be looking up information like regular computer users ok ok how many of you are using social have or have used social networking sites don't have to be a regular user but have you social networking sites facebook twitter instagram so i saw a few hands face facebook online the rest you're banking the same purpose person and or paid bills online ok i always have to factor in one who is not raising their hand not because they don't do these things but just because they're shy and how many of you guys have a smartphone so by smartphone something that looks like this could be yes yes and how many of you guys have a flip phone doesn't look like this ok it's just  is you're basically all technology users you're all using your computer pretty much on a daily basis maybe not quite daily and using it i'm guessing for finding information doing e mail maybe reading the news or something if you are viewers like if you this were teenagers right everybody's hands would be up for everything except maybe the well probably everything  ok so types of cyber criminal groups that are out there texas cyber crime is keeping on time so financially motivated cyber criminals right crime has been around since basically the beginning of human civilization and crime cyber crime is just a new flavor of crime it's no different ok and when you're asking me why can't we file solve this problem or why can't we make it go away how good a job we've done  making other types of crime go away not very good ok not very good unless you're in like singapore and you can just you know have an iron fist but we don't do a very good job of solving getting rid of other types of crime and cyber crime is just another type of crime it's it's tied here and it's more complex in some ways but it's this crime so cyber criminal groups for this demographic that's a major concern is financially motivated cyber criminals where are they they're not like the mobsters of old who were in you know queens and chicago right these guys most of these groups operate out of eastern europe russia former soviet republics some in china some in other countries africa but generally they are beyond operating from beyond our borders which makes solving these problems very difficult because their jurisdiction issues sponsored hacking outfits doesn't mean that they are actually parts of militaries although they could be they could be kind of loosely affiliated or funded or encouraged by national governments and they do often very sophisticated long term types of cyber espionage so stealing plans for warships and planes  or doing very sophisticated types of commercial corporate espionage to steal you know go to dupont and find out the manufacturing process for teflon so that we can set up a teflon factory for one of our domestic companies and compete against upon that type of stuff you don't have to worry about these guys so much they're not after you and that's a really good thing because they're really sophisticated and they're hard to hack hard to hard to catch hacktivist is probably the third major group was a really big deal a few years ago we were talking a lot about a group called anonymous they were doing all of these attacks against sony and against bank of america these are kind of ideologically motivated hacking groups hard to pin them down their amorphous their you tend to their members tend to be all over the place tend to be a lot of kind of younger people probably in that teen to twent age group and they will go and do things whether that's a deny naca web page offline of denial of service attack or break in steal information and then dump it online to embarrass somebody that type of stuff leaks is more of a maybe a platform that hacktivists would use then i don't think julian a sauna is actively anymore going out and taking information and hacking into companies are trying to take websites online but he's provided a platform that those people can use to get their message out but that's a really good question ok well it is animations ok ok so common myth if i'm not on my computer these are like things that you might say to yourself or think that you need to stop saying and thinking if i'm not a mike your computer i can't be vandalized victimized obviously not true if your computer's online and connected to the internet it can be targeted regardless of whether you're sitting at the keyboard or not there are bad neighborhoods online that i can just avoid right so well if i'm not going to like pornography sites or where they're selling fenced good fencing goods then i don't have to worry so that analogy kind of from our from our early lives that there are good neighborhoods and bad neighborhoods doesn't really apply online anymore it might have applied at one point you know maybe ten or fifteen years ago that was more true than it is today today it's really not true you can be attacked or or compromise attacked from very legitimate sites not because they've been compromised but because maybe an advertiser who's displaying on their site has been so there isn't it isn't the case unfortunately you can say well i'm going to the new york times dot com and i don't have anything to worry about generally you don't but you can't be sure i don't have anything a cyber criminals and shouldn't stealing yes no no but if you have a web mail account through g mail or hotmail or comcast that could be attacked regardless whether you're at your computer or not so and that's part of what we're talking about so your exposure is more than just what's on your computer what's on your computers really valuable but it's these days the chances are you've got accounts all over the place amazon dot com your bank your web mail that are there and available accessible whether you're physically or computer and your computers powered on or not know the information so the web mail is in the cloud right so it's on servers at microsoft operates or google operates and so it's there it doesn't just materialize when dawn wants to access it it's there all the time yep yep if you don't go into your email account can you get yes well they can get in i think what i'm trying to say is they can get into your email whether you're accessing it or not whether you're online or not like the email account it's like object permanence right like your shoes that you took off and put in your closet when you leave the room your shoes are still in the closet right like you're in webmail account they didn't disappear just because you left the room your you mailbox all there in the cloud regardless of whether your there at the screen looking at it or in near kitchen talking to your wife and so for the for the purposes of the security of the data that's in that account it doesn't matter whether you're online or not yes is that is it then removed from their cloud and put on your computer and then it lives there i say no generally you're right so i see what you're asking so generally so generally people get you're going to get attacked by clicking on something interacting in some way simply just downloading an e mail into your onto your mail client and seeing the subject line or seeing a body then line message is not going to have you be attacked the attack is going to come by clicking a link in that e mail by opening an yes in some way ok i don't know of anything cyber criminals interested in stealing yes so we're going to get into all the things that you have that they want they have a professional looking website ok so it must be a legitimate that's again like used to be could drive up to a building and below you i don't know the place does not look right i'm a little bit wary and i don't want to go in there with web pages you really can't tell at all at all could look very professional beautiful you know pictures and graphics and so on and still be a malicious site or or a dangerous site so i mean one of the things i like to try and do is make like we all grew up in the world and we all have a sense of like danger and what are what are weird situations where our red flags are going to go up in what seem like normal situations right so we all have those in the real world and being secure online means kind of developing that sixth sense online which is harder because we don't have a lifetime of experience online most was came to the internet later in life right and so we didn't develop that so that's kind of what i want to try and get you guys doing is getting it so that like those little flags go up and say oh you know that doesn't that's a seems weird or wrong and like i don't know exactly what's wrong but i know that like i'm going to step back from this situation you know like  personal relationships we all do that very readily ok ok so as a senior or just a grown up why are you are target like i said you know you're online most of us here are on the internet in some way from the cyber criminal standpoint you're less tech savvy no offense no insult but that's just the way they look at it and in some cases it might not be true but often it is you are more trusting what i talked about so you grew up you didn't grow up in the internet age and so your sense of boundaries is different right you don't have the sense that like my daughter my teenagers probably have a more than i do you know like they cause they're just immersed in it and because that's where the money is because you have assets you have bank accounts you have lines of credit you have mortgages you have you have equity in your house i should say  ere these are criminals they want money right so this is what this is why you're valuable about how they do that so basically any personal information that you might have that resides either on york personal computer or in an account online that you have access that you control could be useful to th m in your e mail you know you're getting messages from your credit card company you're getting messages from your bank just you know deposit to your account or here's an update that information is useful to them obviously any tax returns  personal files of that nature that you might have on a computer very useful has a ton of information about you where your bank accounts are what your birthdate is what your social is all that your username and password that you use to access any account interesting to them because if you're like most people you probably use the same username and password in other accounts as well and they will the doesn't even matter if the count is valuable there engineer you name password because we're going to go around to bank of america and wells fargo and every other major bank in the country and say header they have an account there oh guess what these are the same username password obviously social security numbers can be used in identity theft  s to access to tax filings i was actually a victim of tax file fraud in the last two taxpaying seasons they got my social security number they gamed a website that the i r s had for filing online and filed a return for my wife and i before we did and so you know i you know we filed our own return and with an affidavit saying we had had our identity stolen so what they were doing for a while is the i r s was allowing you to do so so one of the big problems is that the i r s web site if you had a certain very meager amount of personal information like social security number and again the been so many data leaks that pretty much all of our source care to numbers are out there somewhere on some cyber criminal form they'd like your social your mailing address and some other piece of information when they went to file online the i r s would actually populate the form with like all your return information from the previous year right so when they were due to go in they would auto populate they'd change numbers around to make sure they got a big return and then file and what the iris was doing was sending out credit cards or debit cards that that you could use and so they would put in you know they would put in a different address yeah oh of course or or a different order or a bank account what they call a mule account so they have somebody who is kind of in on it that has set up an account for them to use and they would have it sent there by the hoping that by the time the i r s gets wind of the fraud they've wired that money yes if the i r s ran like american express or visa or master card and invested hundreds of millions of dollars in fraud detection they should they should have said huh here's somebody who first of all filled out his tax return form in like forty seconds because he's doing it using a script and b has requested to have you know has put in a new mailing address and a new bank account to have a refund and oh by the way even though this person has paid considerable taxes in the last three years suddenly they're getting a huge refund that's like those are all fraud right but the i r s is actually processing returns on technology on software that was written in the one nine hundred fifty s on hardware that was made in the one nine hundred seventy s so like they're not there yet ok they're still running on i b m mainframes some like nine hundred seventy four don't even get me started so yeah so you know american express all those those companies they've got they've got that part of it down to fraud detection down i'm sure you've all had the experience of having  either a charge blocked or getting a phone call or something saying there's a weird pattern of behavior ok they're very good with fraud detection the i r s because federal government and frankly i'd say it the i r s has had their budget slash in the last decade they have not they're not there yet so they're not where the private sector is but they're you know they're getting there they're learning the hardware know it doesn't i mean it's the accountants it's another layer between you in the problem and the accounts not going to keep you from getting hacked although all that i could have done would have been to pretty much file as soon as the i r s opened up that portal and beat the criminals to the punch and i did because i filed after the new year and they filed in december or something i mean so no i don't  yes well the problem wasn't that they stole the tax return from my computer the problem was they had my social security number and a few other pieces of information about me and impersonated me in filing through the i b a through the i r s his own website so on your computer will going to get that base about basically by securing your computer both from viruses and then encrypting the data on the computer so that god forbid your laptop is stolen or something or your desktop that the that the people who steal it can go in and read the contents of your hard drive so that that's what you would do you just secure the data where it lives and then if you're going to file you're going to do it through software like quicken or something like that they're handling security from your computer up into the i r s so this wasn't that this was just them knowing some information about paul roberts and using a site that the i r s operated i had nothing to do with the file forming  ok e mail accounts are a gold mine for identity thieves as i said they've got a ton of you've got a ton of information in them stuff that you're probably not even interested in you might not even open the e mail but it they can use it to map out basically your financial life or as well as your social graph ok and then use their access to it maybe e mail other people and pretend to be you and get information out of the you know you know your if you've got an account and you got an e mail chain with your account ok they might reach out to that person and or a stockbroker oh you know what i want to i want to liquidate this account and here i'm going to give you a bank account number to e mail it to ok that type of s i'm going to get to that what you do is you need to you need to secure your e mail account to make sure that it's that they can't get into it if it's not you personally ok ok so this just really quickly what's the deep into the cyber underground and he did a couple great graphics a few years back on kind of the chop shop nature of online assets like e mail and this is what he this is the graph that he  created so you can see it's you know kind of what are they interested in photos google skype chats call records your location so privacy related stuff access to accounts for retail ok macy's amazon wal mart netflix bank accounts employment information that you may have gotten from your employer could be or what have you e mail all the all the kind of social stuff from your e mail and so on and then obviously you know there are people out there spammers who are sending you bogus emails and stuff like that to try and get you to buy a product or go to a website or something like that so e mail is useful as a as a medium as well what's what i want to focus on here you know same basically you know it's basically a platform for viewing a bunch of different things we're going to talk about ransomware which is which is a type of crime where they encrypt the data on your computer and hold it hostage obviously it holds e mail if it holds a lot of e mail you might have quicken and have cracks or turns on it you might have or quick books you might have access or information on passwords if they take it over ok if they compromise it using malicious software or malware then they can use it to launch attacks on other sites denial of service attacks send out spam you know  hosts illegal software or images and that type of thing so those your computer has used your laptop has used to them and many just like a chop shop just like we would take a stolen car and they chop it up and pull out the airbags and same idea like if they own your computer they can use it for all kinds of stuff they can steal your data they can use it to post their own militias files they can use it to get involved in other attacks online that they're selling out this network of compromised computers to do attacks bet is to buy and install and keep up to date antivirus software i used to work for a company called kaspersky lab that makes an antivirus product that's pretty good a russian company they have some of the best some of the best engineers working for them they are good guys i don't employ cyber criminals so kaspersky is good you know microsoft windows comes with windows defender which is a really good you know the advantage microsoft has is they have access to all the windows machines out there so they have very good data on viruses and stuff and windows defender is free it just comes with windows it's perfectly good and doesn't cost you anything you know the big names are that's really that's what grant that's what grandchildren are for frankly yeah but but yes geek squad or you know micro center on memorial drive has a little shop as well and also frankly you can you can look you can go to the library or the town hall and you have people computer technicians who have just put flyers up who could probably come and help you less expensively than than  they are the yes you know if it's a good question if this were if you were a group of adolescents i'd be having a very different conversation it would be less about financial fraud because i don't think kids generally they don't have assets they don't have credit cards or not doing a lot of financial stuff online it's more about personal safety it's about you know allowing yourself to be groomed by some weirdo or you know give more information about yourself than you need to or cyber bullying and so it's a lot of that stuff you know basically keep your clothes on you know and i've got three daughters me this is you know so seniors biggers biggest concern again is is really financially motivated cyber crime the persistent threats in the hacktivists i don't really consider an issue for you guys and so that's what we're going to focus on ok so and i'm going to just get through this fairly quickly so that we can we can talk about prevention  intent there are many different ways that you can be attacked the victim of a cyber attack ok there are many different ways but by and large really for you guys most of the most of what you have to worry about are really e mail based attacks people sending you links or attachments that they're going to try and entice you to click on and by clicking on them you're going to either install a piece of malicious software or you're going to be taken to a web site that's going to a solid piece of malicious software or you can be taken to a website where you're going to enter in some personal information that you think you're giving to a legitimate company but really you're giving to a cyber no they're not cookies cookies are just what web sites use to track you to keep a record of you and what you do on their site so that when you come back again you don't have to enter in a whole bunch of information so it's a convenience for you and it's also a great way for the company to understand how you're interacting with them so those aren't necessarily bad they might be annoying you might want to block them but they're not in and of themselves malicious so common factors threats mostly are going to arrive either be via e mail or increasingly obviously social media facebook messages skype if you go to skype with people that's a vector or they're going to contain a link to a website or a file attachment and ask you to do something with it to your point don you're going to have to interact with it in some way and they're going to use kind of psychological tricks to to compel you to do that could be trying to scare you your accounts going to be deactivated i need your help check this out this crazy video of hillary clinton doing whatever and you're like ooh that's kind of played a curiosity fear or you know you're going to be fined or we're going to revoke your license or something like that they're going to use some psychological trick to get you to interact with something and kind of get you past that what is this i'm confused by this and then something's going to happen again often it's malicious software is placed on your computer you won't necessarily see it windows or whatever computer using won't necessarily warn you about it you'd like it if they did but often this stuff going to be installed without you being aware of it happening it's happening s which is the operating system that they use is is is pretty secure and it i'm not going to say there are no problems with i pad or i phone but it's vanishingly small compared to what most of what's out there ninety something percent of all the online threats malicious software are for windows because that's what most people use and if you're a criminal you fish where the fish are right so most people nine out of ten people using windows are going to make something that runs on windows so the biggest phishing is the biggest kind of threat for you because not because fishing in and of itself is so horrible but phishing is kind of the step one in whatever bad stuff is going to happen to you it's kind of the equivalent of like the criminal like jiggling the door handle like is a store open or is a store not open that's fishing and fishing is basically and it's pronounced it's spelled p h i s i n g but it is fishing pronounce fishing it's basically the the act of getting you to divulge some information about yourself ok think of it is like fishing or dangling a hook they're trying to get you to bite the hook and it could be via an email off and fishing fishing sites fishing is is conveyed the attacks happen via email but as i said social media as well common ones are the you know the message from your bank you know that you know your count is overdrawn or there's been a fine or there's an important document you need to download that type of stuff has anybody ever gotten a message from a bank that you don't have an account to like wells fargo or bank of america that ever happened e mails and you're like i don't have a wells fargo account it's like exactly what they'll do is just send out a message like that and figure out well wells fargo's got however many millions of customers in the united states we consented to everybody and chances are we're going to get a few people who are wells fargo customers the other big type of online trying to going to talk about is ransom previous years i would have talked about different types of viruses and so on these days pretty much everything ninety three ninety three percent of all the phishing emails that are sent are connected to ransomware are the are the first step in a ransomware attack and ransomware is  like is a really amazing and amazing kind of evolution of cyber threats right so for many years cyber criminals had a problem which was that a couple problems one problem was they they could they could steal your data but they had to figure out then they had to find a buyer for the data so they could steal your credit card information bank account information so security information and then they would go to these forums online underground forums and they would try and fence it they'd say i've got a hundred thousand and max credit card numbers who want to buy them and of course each day that goes by amex is identifying more of the fraud and cancelling these cards ransomware was was the criminals realizing a ha there's actually one person who is really interested in this data and it's the person i just stole it from they want it back and so what they decided to do was instead of i mean they would take your data but they would also encrypt the contents of your hard drive they would lock your hard drive so you could not get anything and then they would hold it for ransom and say if you want to get access to your data your photos your kids in your bank accounts and also the stuff you're going to pay off and you're going to pay us using a digital currency called bitcoin that's an trace a that's basically like digital cash it's not really traceable because the other probably used to have was it was very difficult to get paid they would need to go to money graham or western union but those are legitimate companies and they got savvy to it so it got a lot of very difficult for them to get the money out of the scam bitcoin basically solve that problem for them big point is a malicious but it's like digital cash  so so ransomware and this is you can get it in a bunch of different ways and i'll talk about what what it looks like so we talked about this just qualities of phishing e mails  they urge you to take immediate action click a link open a file attachment often you're not going to recognize the sender if you does everyone know that if you kind of move your mouse over a link in an email or a web page that you can see what the link is too so the link might be text it might say click this link but if you move your mouse over it you can see and i'll show you where to well so not right in your not right in your browser but but these days if you try and go to a malicious link google will often tell you so here's so here's a screen that i'm going to show  you and if i go to you you can see that text setting security security settings page is highlighted right it's a hyperlink so if i hover over that with my mouse right down here right down a little bar here i can see go dot microsoft dot com slash forward link slash whatever but i can see ok it's microsoft dot com ok similarly that's what i'm talking a simile here you know i hover over it oh ok that goes to  support thought microsoft dot com ok so what i'm saying is often with fission phishing links up with phishing links ok it's often the case that when you hover over the link almost always the case when you hover over that link so the link might say bank of america dot com or whatever when you hover over it look down a little bar it's going to say something different it's going to go to a different domain it might look like they might have said they might have registered bank of america refunds dot com but it isn't bank of america dot com or it isn't wells fargo dot com it is infidelity dot  write yeah ok that's it's a little creepy but sometimes you can write so so one of the things i said right so one of the things i do person have their e mail account compromise they could then use that as a platform to go after you and all your all the right to the important thing right so if there's no context to it right like hey check this out are so cool exclamation point either delete it or do what you did which is that link is different spelling and grammar errors a lot of these scams originate outside the us so while it very simply does the grammar is terrible or weird you know it just gets you like that's weird it's asking for personal information includes suspicious attachments as are all things to just watch out for could something that's a totally legitimate email have all of these qualities yeah sure but chances are  if it's a phishing e mail ok so here's an example of one this is from microsoft as part of our security measures we regularly screen activity in the facebook system we recently contacted you after noticing an issue on your account our system detected unusual copyright activity linked your facebook account please follow below spell b e l l o w to fill out the copyright law form like the copyright law what is that ok so links in e mail threats your account will be permanently blocked you know it using the name of facebook a very popular and well known company to again get your guard down all just a scam ok is is it a verified domain and you can tell that in modern browsers in most browsers ease days by looking up here ok you see how this is chrome but it would be the same pretty much in any browser up here they've got this green lock and microsoft corporation us right that's what's called an extended validation sort of certificate and you can click on that and it will show of information on your business registration and you know show that you're a legitimate concern so scammers might have but not not all h e t p s sites are all secure h t t p has the extended validation using a secure web connection good for them the money they steal from you or the data they steal will be encrypted from you know your computer up to their web server but it doesn't necessarily make make it the case that you're not going to you're not being scammed but the even the extended validation if you go to their web site type it in yourself don't follow their link but type in yourself and they've got that evy cert then you can go and look and say is this really the company that they say there are and that that would be an added measure of comfort i guess but it should certainly not outweigh all the other stuff so this is an e mail this is a phishing e mail that i  got and it says it's from the apple store right and it's saying recently we notice a massive unsuccessful log in to your attempts attempts to your account blah blah blah once you've updated your account records your information will be confirmed in your account will start to work as normal again blah blah blah ok and so it says it's from the apple store but when you look it's the resolution center is phoenix  y r which is a french domain right totally just doesn't add up this is from the app this isn't from the apple store has nothing to do with apple ok that's a red flag ok so you look at who this message is from this from apple nothing about this is from apple or certainly not the important information which is the link they want me to click on right is not from apple so that's my that's my red flag to just delete it ok in the news right everyone heard about hillary's chief advisor john podesta had his e mail hacked right and he got a lot of interesting information out of that e mail account that that has made its way into the news he got fished that's how they got access to his account with a fake google password reset message so he got an e mail message that said hey someone just used your password and tried to sign into your google account and this is actually this is exactly what it would look like if google sent you one of these messages they do send these messages out but what they don't to is to say click on this button to change your password so if he had mo over and then it has you know where they tried to log into it if he had mouse over that link what he would have seen is he was not going to google dot com he was going to a phishing website that was good that was made up to look exactly like google's password reset page to enter his username and password and reset his password so they'd then harvested his e mail and password they might have even gone in and changed his password for him to whatever he set it to just to make him extra comfortable that it was really google but in the meantime right now they both have the huge name and password for his account and they harvested all that e mail so that's how they got him ok very simple it's not there was no malicious software used right it has got him to go to a page and give cough up his username and password right so if you had hovered over that that change password thing is just an image file right if you harvard over that down in the bottom of your browser you'd see the little link that that button was going to send you to when you clicked on it and what he would have seen is almost certainly it was not a google dot com domain it was some other  domain another good point yes they're not perfect i mean they're processing hundreds of billions e mails a day their spam filters in my experience are pretty good but they're not perfect yeah i know first sure i mean especially you know especially for high value how high profile individuals like that there should be an extra level of but  good good luck with that good luck with not being on your computer of course yes i i i retrieved a nine hundred thirty zero remington typewriter from my mother's attic and it cannot be completely mechanical there's not there's no did nothing digital in it this right so if i want to write a super secure message that would be a machine to do it on however i'm going to be about one one hundredth as productive as i am on my laptop you know somebody somebodies in trouble ok fake any virus these are just a couple screen shots fake any virus this is what it looks like it's was a really big issue about four or five years ago this is the this is the most common type of online scam usually you go to a website and this ng would drop down in front of your eyes like you've been infected with a virus you know your we've detected a virus you need see the progress bars were scanning your computer now you've got all kinds of viruses click here to get rid of them and of course the the program they wanted you to get rid of them with would be malicious program right and this is what a ransomware file ransome if you get ransomware this pops up your personal files are encrypted it's got usually instructions on how to pay them off and they have support lines that you can call because they're just very run like any other business so give him a call they'll help you to walk you through the process of setting up your bitcoin account and getting in the money they need and so this is a crypto locker screen and this is what malware bytes yeah yeah mellower bytes is like an anti virus program so there they're pretty good at catching this stuff but they're not perfect so many of these programs rely on having seen something before to be able to stop it and cyber criminals have gotten really good at just making slight variations to these melt malicious programs and just keep them keep churning them out thousands of them a day slightly different from the one before and so the software  thinks it's a new file this doesn't recognise that they're getting better but again it's a numbers game and you can never be sure  i want to going to jump ahead just a little bit and talk about some of the some of the things that you can do to protect yourself online before i before e go down the scams rabbit hole ok ok so number one and this is what this is kind of my message right is use common sense you need to kind of develop that six that sense that you have in the real world right so if you are in the parking lot right and somebody came up and said hey i got it you want to buy a new car i got a new chevy you want to buy it you'd be like no you know there's that's not where you buy a new car you don't buy a car in a supermarket parking lot you go to a car dealer right and we all know that right  just intuitively you would be like this is a weird situation that i'm going to get myself out of because this guy's clearly either you stole this car or something right it's the same thing with the internet right so i mean if you you know you're sitting in you know you're on a web page and all of a sudden something's popping in front of your face and saying hey you know look here go do this click there it should be inherent just intuitively be like no this is not what this web page is about and i didn't request this information so i'm going to kind of disregard it and you know same thing with e mail messages write things that don't have context things that seem weird things that are asking you to download things or click on things with no it's not part of a conversation you're having oh yeah you asked for this here's a link i told you i'd send you that type of thing  pop ups might pop up on their own browsers have gotten a lot better about blocking that type of stuff so you're probably seeing fewer pop ups and there's a reason for that more problematic would be like social media sites so it appear like it appears in your facebook feed like oh you know check out this video of this teacher doing this amazing thing or whatever and it's this you know or click on this if you you know that type of thing that that's getting people in a place where their guard is down give traffic to a site so they're not putting anything bad on your computer they're just looking for you to to go to a web site probably because they're getting reimbursed for everybody you visit i would say in general that's called click bait you know be very be very wary of click  bait and he's and i've fallen for those too you know the slide show or whatever but yeah those are all most of them are been a benign but it's a it's a situation it's a type a bait that they could easily used to do something that's not  so be wary but in general use common sense and most of those tips are really regarding scams and i'll get back to that but so keep things updated and i know that's like simple sounding advice that probably is really complex or hard to follow but you know if you're using a computer are going to be prompted to update windows to update this thing called java every once in a while which is a kind of technology that is used owned by oracle now and is used in a lot of websites less and less but it's still out there products are programs like flash and shockwave that are used to display information online there was or made by adobe if you're an apple user you know oh s ten you'll get a little message up in the window just install the update don't put it off don't cancel it don't tell it to go away  keeping your software updated is kind of step number one in keeping yourself secure because a lot of malicious programs are going to get onto your computer because windows and apple have put protections in  from running on their computer they're going to get by that by using often by exploiting a hole or a vulnerability and one of these kind of very common technologies either windows a windows browser like internet explorer  java shockwave flash stuff that's on everybody's computer and so keep your faith you know if you've got a smartphone keep your smartphone updated it's a lot easier with apple than it is with android but do the best you can do keep you operating system updated and any programs like office that you might use keep other stuff that you might have in your house that's electronic and connected to the internet up to date and that things like your home router right you ever see the thing with all the blinking lights that's where the internet comes in it actually run software it's a small computer and it's got a web in or it's got an interface that you can go to and it has software that every once in a yes you should be on w p a too yes it's a wireless security technology but you don't yes you should have just have some security in your home wireless network don't have a wide open wireless network if it's what whatever encrypted whatever wireless security protocol you're using i'm not i don't think that's the biggest thing you have to worry about but definitely you want you want something you don't want everybody use can within range of your house to be able to get on your wireless network you mean like a cellular hotspot like a femtocell type thing yeah i mean is it more secure than wireless not really i mean those can be insecure as well those cellular modems can be vulnerable just like cable modem the same as a different network you're not you're you're on the you're on the cell carriers network not on fries and you know one of these things so starbucks that's a really good example right like public wi fi starbucks is hosted by google and in general is secure in other words he used to be in the old days that those why fire hotspots wouldn't have any security on them and often the web pages themselves weren't using secure h t t p so basically everything you were doing could be seen by other people in the cafe right and including usernames and passwords that's less true now so those wireless hotspots are usually encrypted certainly at starbucks maybe not it smaller so you want to make sure that they're asking you to enter in some kind of a password to to get on the account or that you see that little lock down in the corner to indicate of your browser indicate that the session is secure you don't want to be in secure wireless and if you are then you want to use virtual private network or something like that y yes same i mean again public library has a secure why five set up so in theory people can snoop on your traffic and see what you're sending back and forth to the web but you know you're always you're taking a little bit more of a risk any time you're connecting the public wife i ha again you're going to put you're on a public network so but if you've got any virus on your computer if you're going to secure web sites  and encrypted traffic back and forth and not you know i would necessarily do like online banking and stuff from here or the public library or starbucks save that for your home network but in general you're going to ok but you want to keep your software up to date and you want to you know use a secure browser and make sure the web site is secure you can actually use one of these as a as a cell cellular hotspot i don't know if a lot of you guys don't know going right up to the cellular network so if you don't like your choice of wireless networks you can always use cell phone to be a little wireless hotspot ok the other thing use strong passwords ok and what is a strong password is one of the big problems that people have which is we're using weak passwords and we're caught we're adding insult to injury by using the same weak password on a bunch of different sites so you need to if you want to get serious and companies are getting hacked they're having passwords leaked to cyber criminals if you've got a weak password the cyber criminals are going to be able to probably not going to have the actual past where they're going to have what's called an encrypted hash of it and if you've got a weak password going to be able to break that really quick if you've got a strong password they're not going to be able to so the difference between even a six character password and an eight or ten character password in terms of the cyber criminals ability to crack it is actually huge it's exponential the amount of compute power they need to do it and if it's fifteen or twenty characters and it's and it's different characters are probably not able to break it all ye which the password keeper yes so i'm going to get to that yes so at least seven characters long don't use your name or company  name don't use a complete dictionary word use upper case a mix of upper case lower case numbers symbols think passphrase not password ok that's kind of the conventional wisdom now so don't think of like what's my daughter's middle name think what's my favorite line from a movie or my favorite lyric from a song and that phrase becomes your password ok because then it's just as easy to remember maybe even easier and it's along ok plus special characters right right right you do so some tips create an acronym for an easy to remember information personal information page favorite hobby substitute numbers symbols misspellings write it down and keep it in a safe place like in a home safe ok very important so here's some example my son's birthday is twelve december two thousand and four becomes m s b i twelve slash december comma for ok or i love to play badminton  and then it's you know that capital l u v two for the number two for the two the ampersand for the i mean the the at symbol for the a you know that type of thing so there are just ways to randomize  of course you've got to get familiar with the make sense looking at it but if you don't write it down you might you might forget it and then you can if you want you can customize it for each site's o b o bank of america password is going to start would be a way amazon will start with you can maybe use the same bit of information but tailor it to a specific site so you always know based on where you are like oh i'm on amazon so it's amzi and whatever ok those are easy ways the great the best thing to do is to use a password manager which is what i use and i'll show it to you i use last pass which is one of the more popular ones dash lane seems to be very well respected these are all like pretty good ones keep passes open source it's free so these are programs that will actually save all your passwords for different sites and therefore and so you really only need one password which is the password to get into the password manager and it does everything else for you ok well that's that's an afternoon for you right that then after just like going to each site i mean usually i'll do it as on a on a you know ok i'm going to amazon today and i'm going to take the time to update my password but yes you have to do that manually at each site it would it well actually last past will change your passwords for you but frankly i wouldn't rely on it i would do it manually and because you want to lock yourself out and you what you do is you log in you go to account settings and you go to security and there will be a way there to change your password but but there isn't an easy way to just blast out all the new passwords and for right well so because you only have one of them you can protect you so you can make it really strong and you can protect it with tools like multi factor authentication you don't forget there's only one of them so you know you're forget your passwords all the time but it does get to be a problem if you i mean it can i mean there are ways to recover your password you can have a printed recovery key that you keep in a safe those types of things but it does increase the risk but the risk of having weak passwords is much greater so you're just swapping one risk for another so you're talking in the case where you lost your last pass password or whatever and all that data is orphaned i mean if you really can't get it back and it's encrypted on a server in a data you know it on amazon's web services or something there to dot right i mean where your credit card bills from five years ago i don't know in some landfill somewhere in my basement i mean you know we've got data all over the place so we don't know where it is  ok the other thing i would strongly recommend is what's called multi factor authentication ok multi factor logon or two step logon to factor log in these goes by a bunch of different names pretty much every major site that you use high value site and has on your online bank google microsoft allow you to do this ok for e mail for online banking for retail  online commerce and basically what it does is it gives you have a username password just like normal and then so you'll enter that and click logon and then it will send one time code usually just a numeric code to your phone ok or to something else you know a different e mail account or something like that but generally it's a phone via text message and then of so a screen will pop up after you log in saying ok now enter the one time code and you type that and then you get i so even if a cyber criminal were to steal your username and password and try and log in as you they would be able to get in because they'd be prompted for this code and they wouldn't be you they wouldn't have your phone and they would they would be blocked  to show you how this works real quickly i've got it set up for my i'm going to show you a couple things are going to show you last pass ok so here is microsoft microsoft e mail accounts ok so you can see these little icons here that's last pass i'm just going to right mouse click to autofill actually hold on ok and this is going to this is actually me ok and now you say it's saying ok and in a second i should get a little text message here on my phone i only have one bar here which is not ideal but ok there it is and it says just came up says use five five two two one seven eight as your microsoft so i'm going to do five what is it five five two two one seven eight two two one seven eight ok and you can see here it's a nice sign in frequently on this device device so don't ask me for a code so you can depending on what the if you're doing it from your laptop you can say don't don't give me this code all the time i use this device so i'm going to leave that blank ok and then it brings me into my microsoft account my and if you look at it it's if i go to my vault ok you can see it's gone ok all my different websites ok from my home  network news sites i belong to and as i go to those web sites that will say oh you have an account here and you want to log in and it will just do all that for you so that would be the other recommendation i would have would be use one of these password management tools that way you can so if you were to ask me like paul what your email password i would be like i have absolutely no idea i don't know what any of my passwords that some huge fifteen eighteen true for pretty much every online service i use i've no idea what a  i don't think so no it pretty much becomes effective right away no it should it should be instantaneous basically ok so use strong packs words particularly for those high value side i mean i'm not going to say there's no site that's so low value that you can't get away with a weak password but again one of the big threats is using reusing a week huge a name and password so it gets stolen and they go around logging into accounts and getting access to them  verification we went through that ok other stuff is just the general use any virus software you know security essentials on windows symantec mcafee kaspersky lab so  folks any of the ones you can get it online or if you go to costco they deals on them frequently they're all fine they all do a good job and they've got a bunch of different they've got firewall as well as antivirus so there are a bunch of different security programs they've got wrapped into them you should absolutely have them on your computer if you don't already the only other thing i would say is back up your stuff ok use both you all have seen ease at costco or whatever these little external hard drives that you plug in i've got one right here ok you plug  into your computer and it's got a terabyte of data storage on it you can backup windows or backup your mac computer to these devices and then unplug i'm ok it's pretty much the only way to recover from ransomware short of paying the ransom so if god forbid you got ransomware you you have two choices one of which is to pay the ransom which is not easy to do and the other if you've got a backup you can just restore your data from the backup it'll get rid of the ransomware and you'll be back up and running so this is really important and it's also just important in case your hard drive fails in case you spill coffee into your laptop or you know all the more likely things that are to happen  have it on your desk plug it in a daily basis do a back up it once you've done the first one the other ones will be quite quick because it's just updating the data that's changed and just make that part of your routine the other thing is even lower touch are these online backup services like mosey or carbonite their data is run kind of in the background your computer and whenever you're on the internet often in the dead of night it will back up your data to the cloud ok and you can restore it there so that the other option as well it doesn't require you to remember to plug anything in but also it's in the cloud ok and then just  just resources online again this is all in a password google it google a google google is your best friend ok you got an e mail from that sounds funky you know s you know it says you refund go to google and be like iris refund e mail and i guarantee you it's going to be like oh yeah this is a scam you know and here's what it says so google is a huge source of it should be your first stop if something kind of has your antenna up but you're not sure just search it just be like e mail that book and see if anybody else is seen it chances are somebody has and then there are other sites that are generally less you know they're good for some things and not other the f b i is a scam site the federal trade commission and so on and so some of this stuff so there's a whole section of the of the presentation i didn't do which is focus just on scams like the all those things and some of those are both they're coming to you by phone but they're trying to get information out of you so the rearrested right so the i r s doesn't generally call anybody and they definitely don't threaten people with  ok and so those are the other things and the other things is to be aware of our kind of some of the some of the scams out there to try and sometimes get you especially if you're retired get you involved in some of these scam organizations or like work from home schemes where it's like oh we're going to send you a check and all you have to do is deposit the check and then you can keep ten percent of and just send the other ninety to this he'd be you know you shake your head like this stuff or the mystery shopper that's another big one and a lot of people get the hook up in a mower going to go buy all this stuff for us and then will reimburse you be the mystery shopper people lose a lot of money doing this stuff you know you're buying it send it to us and then we'll say we've sent you the reimbursement check with the check is rubber so those types of things i mean just in general you know again things have changed a lot technologies change a lot but nobody makes money for doing nothing people don't give valuable stuff away i mean like the world doesn't change that much so if it sounds too good to be true it is too good to be true and just be where ok and that is that's really all i have