Scam of the day – October 30, 2016 – Hacker of nude celebrity photos sentenced

I first reported to you about a major hacking of nude photos of celebrities on September 2, 2014.   At that time, news of stolen nude photos and videos of more than a hundred celebrities including Jennifer Lawrence, Kate Upton, Jenny McCarthy, Rhianna, Avril Lavigne, Hayden Pannettiere, Hope Solo, Cat Deeley, Kayley Cuoco, Kim Kardashian, Scarlet Johansson and others was sweeping across the Internet. The photos were taken from  the Apple’s iCloud accounts of the hacked celebrities as well as their Gmail accounts.  A few days ago, Ryan Collins, the hacker who had pleaded guilty to the hacking the accounts was sentenced to 18 months in federal prison.

The manner by which Collins accomplished the hacking was simple but effective.  He sent spear phishing emails to his intended victims that appeared to come from Apple or Google in which under various pretenses he requested the victims’ usernames and passwords, which he then used to access their email accounts and iCloud accounts from where he stole the photos and videos.  Using the same spear phishing tactics two other unrelated hackers in Illinois and Oregon also hacked nude photos of various celebrities with both of these hackers having pleaded guilty.


There are a number of lessons to be learned from this crime about how to protect your own security.  You should use a unique password for all of your accounts so if any of your accounts are hacked, all of your other accounts are not in jeopardy.  Make sure the password is a complex password that is not able to be guessed through a brute force attack.   Also, even if you are not a celebrity, you would be surprised how much information is online about you that can be used to come up with the answer to your security questions that can permit a hacker to gain access to your email account.  It is for this reason that I advise you to use a nonsensical answer to your security question, such as the answer “Grapefruit” for the question of  what is your mother’s maiden name.  Also, take advantage of the dual-factor identification protocols offered by Apple and many others.  With dual-factor identification, your password is only the starting point for accessing your account.  After you have inputted your password, the site you are attempting to access will send a special one-time code to your smartphone for you to use to be able to access your account.  Had Jennifer Lawrence and the other hacked celebrities used the dual-factor identification protocol, they would still have their privacy.  It is also important to note that merely because you think you have deleted a photograph or video from your smartphone, that may not be the truth.  Smartphones save deleted photographs and videos on their cloud servers such as the Google+service for Android phones and the iCloud for iPhones.  However, you can change the settings on your smartphone to prevent your photos from automatically being preserved in the cloud.

It is also important to resist providing your username and passwords in response to emails and text messages unless you have absolutely independently confirmed that the request is legitimate, which such requests seldom are.

Finally, for people considering looking up these nude celebrity photos on line, my advice is simple.  Don’t do it.   Ethically, it is the wrong thing to do.  However practically speaking, it also is too risky an activity.  You cannot trust any email, text message or social media posting that promises access to these photos and videos.  Many of these will be laced with malware and you cannot know which ones to trust.  Trust me, you can’t trust anyone.  In addition, identity thieves set up phony websites that promise to provide these photos and videos, but instead install malware on your computer when you click on links in these websites.  Identity thieves are often adept at search engine optimizing so a phony website might appear high in a search from your web browser.  Merely because a website turns up high in a search engine such as Google does not mean that the website is legitimate.

Scam of the day – July 16, 2016 – Google warning Gmail users about foreign hackers

State sponsored hacking from countries such as China, North Korea and Russia pose a threat to everyone, but Google, which has for years been monitoring hacking attempts by foreign governments, is notifying Gmail customers when Google has reason to believe that their Gmail accounts are being targeted.  If Google finds that you have been targeted you will receive the following message that takes up your entire screen warning you of the danger and urging you to use the more security dual factor authentication.  In its warning, Google indicates that less than 0.1% of all Gmail accounts are targeted, however, it is important to note that this percentage translates into more than a million people who are in jeopardy.

Screen Shot 2016-04-01 at 3.52.40 PM


As I have suggested many times, whenever you have the opportunity to use dual factor authentication, it is a wise choice to make because even if someone manages to steal your password or even trick you into providing it, as was the case with Jennifer Lawrence when she was convinced by a phishing email to provide her password to a cybercriminal who used it to access nude photos of her that she stored in the cloud, the hacker will not be able to access your email or other account because a special code provided to you through your cell phone is required whenever you wish to gain access to your account.

Finally, as I so often say, even paranoids have enemies so I urge you to err on the side of caution if you receive this type of notice and not necessarily trust it.  It could be a phishing communication from a cybercriminal luring you into clicking on a link which will either get you to provide personal information that can be used to make you a victim of identity theft or will download keystroke logging malware or ransomware.  The best course of action would be to merely go to Google directly from your browser without clicking on the link contained in the notification.  Here is a link you can trust that will take you to instructions for enabling dual factor authentication for Gmail

Scam of the day – September 14, 2014 – Gmail passwords being sold on the blackmarket

Reports have surfaced that hackers have made available approximately five million Gmail passwords along with associated Gmail addresses on black market websites used by identity thieves.  This may be related to the recent disclosure of the greatest data theft in history which I reported to you about on August 7th in which a Russian gang stole 1.2 billion user names and passwords along with 500 million email addresses.  If you are a user of Gmail, this news can appear to be extremely threatening, but the truth is not quite so bad.  In fact, the passwords in many instances have turned out to be passwords for other accounts of the Gmail account holders and that these passwords were obtained, not from hacking Gmail, but by hacking other accounts.  As a result of their investigation, Google has determined that less than 2% were working Gmail passwords.  Google has already acted to secure those affected accounts and contacting those people affected and advised them to change their passwords.  In response to this situation, Google has set up a new service called Account Checkup by which you can check to see if someone has logged on to your account.


The good news is that if you have a Gmail account, it is unlikely that your Gmail password has been compromised, however the bad news is that some other password of yours has been compromised and you are in danger of identity theft.  The important thing for everyone is to have separate complex passwords for all of your accounts and to change them on a regular basis, such as every six months.  For more information about how to create complex, but easy to remember passwords, I suggest that you pick up a copy of my new book, “Identity Theft Alert.”  On the right side of this page is a link to the book on Amazon.  Where possible, you should also consider two-factor authentication for additional protection.