The company Meta, previously called Facebook, owns four of the most popular social media platforms worldwide, WhatsApp, Facebook Messenger, Facebook, and Instagram.  This post is focused on Facebook.

In the first quarter of 2022, Facebook took action on 1.6 billion fake accounts, In the first quarter of 2019, a record figure of approximately 2.2 billion fake accounts were removed by the social media platform.
In India alone, there are nearly 239.65 million Facebook users, making it the leading country in terms of Facebook audience size. So, one can imagine, the larger the user base, the larger is the number of scammers.

The vast majority of those deleted accounts were automated accounts that are often created by software programs. We all know that bots have been used for years to manipulate people. The good news is that in recent years, Facebook, Twitter and other tech companies have gotten much better at catching bots.

However, the challenge still lies when real humans create the fake accounts. In such cases, these social media companies have a much harder time catching them because such accounts are hard to identify, as they do not carry the same revealing digital signs of a bot. Approaches to find such accounts remain imperfect.  So, what can we do about it?

This means WE MUST OWN RESPONSIBILITY TO STAY SAFE. Here are some tips that can help you identify fake Facebook profiles.

FIRST & FOREMOST: TRUST BUT VERIFY
This means Do Not talk to strangers online. If you do not know them or recognize them, DO NOT accept friend request. These fake accounts would generally have an attractive photo because attractive photos entice people to befriend the account.

DO A REVERSE IMAGE SEARCH
If you want to know more, then the best way to identify a fake Facebook profile is to save the profile photo, and then do a reverse image search using https://www.google.com/imghp?hl=EN or www.tineye.com, and there are few more options that you may use to do a reverse image search. Doing so would reveal if the profile photo is real or fake? Such an exercise will show all the places where the photo has been used and it will be easy for you to spot if the profile photo is real or fake.

SEEING YOUR FRIENDS ALREADY BEING FRIENDS WITH STRANGER’S ACCOUNT DOES NOT MEAN ACCOUNT IS REAL
It is also important to remember that if you find such accounts already friends with your friends, it does not mean the accounts is genuine or real. Please know that fake accounts can connect with your friends as well as you. If you are unsure about an account, DO NOT accept the friend request, but send a message and enquire how does this person know you or where did you meet? Chances are such accounts will never respond, and if you do get a response, verify the correctness of the response.

Some of the other ways to spot a fake profile are:

• Check if the picture truly looks real or appears to be taken from the internet
• Check for group pictures on the account. Fake accounts would not have many group pictures
• The information shared in the profile would seem far from real
• Generally, fake accounts would not have wall posts on the Facebook page
• Messages would be far from practical. You might find them too nice or too good to be true
• Fake accounts are mostly fairly new accounts and not an old account
• Fake accounts may have no friends or they may have very few friends.

Remember, you can identify fake accounts, just stay alert!

Almost every day, we go online so we can keep in touch with the world and based on our interests, we either watch news, stock market, or spend time on social media and look at what is new and who is doing what? What is happening around us, what is the latest & the greatest, what are the new inventions, ideas and trends? Professionals go online to stay updated on the professional front.

Sharing posts about where we are and what we are doing keeps our near and dear ones excited and updated. Of course, it keeps us motivated.

Reports indicate that just few years ago, almost 80% smart phone users were using phones with location services enabled, the trend has now changed in the western world but in developing countries, still a very large number of users are not aware about the location services and privacy. Those in the IT world have known for a long time that every time we go online, we are leaving our digital footprint out there.

Some of us also think what all is secure and what is not so secure? When people innocently share their kid’s birthday photos, school graduation pics with other details, they do so thinking there is nothing to worry about! They think who is looking at these details?

But, little they know while staying online is a need but then staying secure while online is also a need. It is like driving on the road, while there is a need to be on the road to travel from one place to another but there is also a need to take all precautions to stay safe on the road.

Let us talk about Cyber Security – this is something that needs attention of everyone because in today’s day and age, Cyber Security must fall into everyone’s “need to understand and comply” scope.

Today all across the world, businesses have their presence online – directly or indirectly. Majority of business have some presence online When all our clients are online, where else would we promote our business? So, many of the marketing campaigns are happening online.

All these businesses also need to understand, and follow cyber security norms and stay safe. What all are we sharing online in our marketing campaign?  For example, If we are sharing our IT/Network structure, hackers will know how to crack it.

Simply put, all the information put out online is “publicly available information”. In the world of cyber security, this is called open source intelligence (OSINT). Here, open source means that the sources that provide information are open/public. OSINT is an important part of Recon (Reconnaissance).

Different stages in Cyber Security are,

1. Pre Security
2. Offensive Pen testing
3. Cyber Defense

For Cyber Security professionals, working at any of the above stages, Recon is the very first step taken whenever they get ready to perform Vulnerability Assessment or Penetration Testing. While Active Recon includes direct interaction with the target, Passive Recon includes finding and using the information available on the web.

For Passive Recon, there are some very powerful tools available that will check the target’s online presence, from various different domains, social media platforms, what all has been shared, when it was shared, patterns are set and noted, Pictures and Videos are retrieved and these tools help Cyber Security professionals put very important, and sometimes, private and sensitive information together. These professionals are then able to join the dots and infer the underlying secrets/information.

OSINT or Recon tools are not magical. They only pull out publicly available information and put it together for these professionals to join the dots. Many a times, to start the Recon, all the professionals have with them is a name, or if they are lucky, an email address, or a domain. They start digging with it and in very little time they have a great amount of intel with them.

Once they know something like a website they can use, they will try and find out weaknesses, if any, that they can exploit. This is the process of Vulnerability Assessment. A part of the website might be weak/vulnerable or using some outdated technology, and becomes vulnerable.

Once a vulnerability is found, the next process of Penetration testing begins. Here, those vulnerabilities are targeted and exploited. The experts try and get into the target’s network, system, database, based on the type of vulnerability. Once they are in, they will try and exploit it, causing damage to the target’s  assets. Many a times, cookies from a device give away access to sensitive data.

To stay safe, it is important to clear your browsing history from time to time. Delete all cookies from your device from time to time. When you are using your browser to look at confidential, private or sensitive information, it is not a bad idea to use Incognito mode. Today we have the options available for using encrypted emails.

Firewalls will protect you when you are approached from an unknown website. Antivirus software are available for your further protection and there are range of protective software available. These are the most common, easily available and easy to implement security measures that we should follow.

As a common practice, companies pay the ethical hackers to find vulnerabilities in their system and some companies even pay them to penetrate into the company’s internal assets and see what kind of exploitations are they vulnerable to. If hacker is able to find vulnerabilities on the target’s request, the proof is shared with the target to enhance the security and eliminate the vulnerabilities.

To summarize, we agree that staying online is a need and that staying secure while online is a need too. Cyber Security, I think, should have a place in everybody’s “need to understand and comply” scope.

Stay Online, Stay Safe!

Author: Shital Rai

LinkedIn: www.linkedin.com/in/shitalrai

Our world is becoming more and more dependent on digital technologies. In my previous blog, Alert:You are being watched!, we looked at how vulnerable we are and hence the need to stay alert while we are online . While digital technology is creating lot many opportunities, it also brings the perils of cybercrime, which is affecting organizations and governments all across the globe.

The most challenging part with cybercrime is that the risk landscape is constantly changing. As technology advances, this challenge keeps intensifying. As existing hacking tools enhance and new tools come in to play, securing networks becomes more challenging.

Cybersecurity is the only solution to protect your digital data and resources by mitigating security threats and vulnerabilities originating from cybercrime.

So, what are we dealing with?

Some of the most common cyber security threats are ransomware, malware, phishing and theft of personal and confidential data etc. Data breaches tops the list.

 Phishing and Trojan Horse attacks: Attacker sends malicious emails that appear to be originating from credible sources such as banks or similar credible organizations. When the recipient opens such emails, and/or attachments and/or clicks on a link in it, the malware enter target’s network and steals or damage personal, sensitive and confidential information, customer details, intellectual property and more. Hackers might steal, delete, or corrupt data. Stolen data is either used for by hackers for their intended purpose or it might even get posted on the DarkNet for sale, or just get posted online for anyone to see.

• DOS – Denial of Service attacks: In a DOS attack, hackers penetrate into target’s network and they send so many messages that overwhelms the target’s network system, this prevents the authorized users from getting an access to the system and can create server outages and monetary loss and undue excessive pressure on the IT staff.
• Ransomware: As the name indicates, the purpose of this type of attack is to hold the target to ransom. Hackers penetrate into target’s network and they encrypt data files on the target’s network. A ransom in terms of monetary payment is demanded in exchange for access to data files.

    So, what all can be done to protect ourselves?

Many insurance companies offer cybersecurity policies that provide coverage from activities such as identity theft, unauthorized transactions, and more. Two types of coverage is generally available.

(1) Vendor Indemnity Insurance for cybersecurity vendors and
(2) Third-Party Cybersecurity Insurance for businesses with a risk profile higher than average.

The cost on these policies can be extremely high because of the frequency of attacks.

Below are some very simple and easy to follow recommendations that can go a long way.

1. Restricted Access Policy- Employees  should have access to only the part of data they need to work with. Access to data and resources should be on need-to-know-basis.
2. Keep operating systems and other software up to date. An outdated software can become an easy entry point for hackers.
3. Strong Password. It is a good idea to to have 12 characters password that has upper case letter(s), lower case letter(s), number(s) and special character(s).
4. Network administrators to ensure safety of the network by frequently changing network passwords.
5. Install firewall and protective software like antivirus, antimalware, antispyware.
6. Regularly scan devices for malware
7. Train all employees on cyber security.

    If you rely on the internet for communication and for carrying out daily operations, you must use cybersecurity measures to safe guard your data and resources.

Author: Shital Rai

LinkedIn: www.linkedin.com/in/shitalrai